14 ms·

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in brow

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs? Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Update 2: I didn't realize this is how WebRTC actually works. FF even has an entire page for tweaking this stuff https://wiki.mozilla.org/Media/WebRTC/Privacy https://wiki.mozilla.org/Media/WebRTC/Privacy. I hate it when features like these, which atleast in my case go mostly unused, have such critical weaknesses by design and it's not announced anywhere with a big red danger sign.

confounded 9y ago
> I didn't realize this is how WebRTC actually works. Yep. STUN is in the spec, and always has been. This has been a thing for years.
- scottlu2 9y ago
  STUN is part of the story. The overall process is called Interactive Connectivity Establishment (ICE).
  - confounded 9y ago
    TIL, thank you!
blattimwind 9y ago
https://www.privacytools.io/#webrtc https://www.privacytools.io/#webrtc
- lovelearning 9y ago
  Thank you for that site. Looks like I have to become more aware of browser internals.
MichaelGG 9y ago
This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is absolutely in the wrong to ignore your proxy settings, especially without getting consent first to start a call. It's a complete mess. Regardless of what the "spec" says, Firefox is responsible for implementing broken software that harms users. Then again, so is STUN/ICE and basically every single thing that has to do with SIP/VoIP. It's like they go out of their way to be obtuse and come up with shitty standards then take glee in how bad it gets. As an example, look up SIP Torture Tests. There's an RFC just to illustrate the moronic edge-cases in SIP parsing that at one point implies your software needs to be conscious to infer the intention of malformed messages. t. been working in telecom for far too long
- blattimwind 9y ago
  TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.
  - Aloha 9y ago
    SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.
    - MichaelGG 9y ago
      Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP? They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of those are inherited from HTTP. Tell me how many HTTP stacks handle comments and line folding properly... It opens up security holes, too. One proxy interprets \r\r\n as 1 line break, another as 2 line breaks and start of body. Oops, now you can end up sending fun headers to your target because they try to be flexible in accepting input. IIRC there is essentially no way to implement SIP standardly because of so many broken implementations. You have to make some decisions on certain parsing that will break one but any other way will break another. Text-based protocols invite abuse by designers and implementors alike. IETF compounds these by living in a fantasy world.
th0ma5 9y ago
I tried some of the leak tests here, it seems to leak my NAT address not my nearest public IP? Can anyone chime in?
- bubblethink 9y ago
  It's not even the local ip of your home network. It's the ip of the tunnel interface. I don't know how this can be misused. It's only on firefox though. On chromium, it just shows 0.0.0.0 instead.
  - th0ma5 9y ago
    Yes that's exactly what I see. This seems to me to be a non-issue but perhaps other configurations and VPNs behave differently? I was using my phone into my home router with OpenVPN and it showed my VPN assigned NAT address 10.x.x.x ...
giancarlostoro 9y ago
The weird thing for me is I'm on Firefox on my Mac and I ran all those tests and it said WebRTC is enabled, but never gave my actual factual IP address. I'm running Private Internet Access which they claim is vulnerable... So I'm not sure whose doing that test but they might have their settings a bit jacked up? If you have Private Internet Access there is an "Advanced Settings" panel where you can click on "IPv6 leak protection" it disabled IPv6 while using the VPN, seems to have been enough to fool these leak tests.
swiley 9y ago
This is why when I actually do anything with tor it's always curl -H "" Using something as complex as firefox for anything important is just stupid.
- lallysingh 9y ago
  Or just use Qubes on Tor
- mirimir 9y ago
  Or just use Whonix. Or better, Whonix in Qubes.
- jwilk 9y ago
  Why -H ""? AFAICT, it doesn't do anything.
urda 9y ago
> Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Did you file a bug report?
- lovelearning 9y ago
  I searched for one and found some that seem to be related. Will file one today and also work on a fix, since it appears this is known from a long time and nobody has bothered to provide even a simple fix.
  - urda 9y ago
    Cool, can you link the report here when you do?
Crontab 9y ago
I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days. Can't wait to see how WebAssembly will be used against us.
- throwaway2048 9y ago
  Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads. This is already being worked on.
  - earenndil 9y ago
    It's being fought before it's even fully grown. Computer vision adblockers are also being worked on.
    - TeMPOraL 9y ago
      A sad and stupid zero-sum game wasting both talent and electricity.
  - gear54rus 9y ago
    Any links to that? What kind of enemies of mankind are working on this? Advertisers again?
- whyever 9y ago
  > Can't wait to see how WebAssembly will be used against us. Have you heard of Coinhive [1]? They are using WebAssembly to mine bitcoins in the browser. [1] https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/ https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive...
  - etskinner 9y ago
    On the other hand, this method might be a good way to 'pay' for using a service instead of ads, so long as it's opt-in and the user knows about it.
throw2016 9y ago
It seems Firefox has resigned to some sort of role as 'token' competition to Chrome. Most of its actions seem inexplicable and counterproductive when strong privacy and user protection should be their reason to exist and keep a dedicated user base. The bigger problem is exploding complexity in many areas is a huge concern for open source as it's becoming increasingly impossible for small teams to implement or come up with alternatives. This is going to reduce meaningful choice and leave users at the mercy of a mix of corporate or vested interests.

confounded 9y ago

> I didn't realize this is how WebRTC actually works. Yep. STUN is in the spec, and always has been. This has been a thing for years.

scottlu2 9y ago
STUN is part of the story. The overall process is called Interactive Connectivity Establishment (ICE).
- confounded 9y ago
  TIL, thank you!

blattimwind 9y ago

https://www.privacytools.io/#webrtc https://www.privacytools.io/#webrtc

lovelearning 9y ago
Thank you for that site. Looks like I have to become more aware of browser internals.

MichaelGG 9y ago

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission. But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels. Firefox is absolutely in the wrong to ignore your proxy settings, especially without getting consent first to start a call. It's a complete mess. Regardless of what the "spec" says, Firefox is responsible for implementing broken software that harms users. Then again, so is STUN/ICE and basically every single thing that has to do with SIP/VoIP. It's like they go out of their way to be obtuse and come up with shitty standards then take glee in how bad it gets. As an example, look up SIP Torture Tests. There's an RFC just to illustrate the moronic edge-cases in SIP parsing that at one point implies your software needs to be conscious to infer the intention of malformed messages. t. been working in telecom for far too long

blattimwind 9y ago
TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.
- Aloha 9y ago
  SIP is one of a few protocols where two completely standard-compliant implementations are commonly unable to interop.
  - MichaelGG 9y ago
    Oh it gets better. I have implemented SIP software (written, from scratch). On the SIP implementors mailing list, one of the authors defends the insane parsing rules by saying that C and Java allow you to be flexible with syntax, so why not SIP? They are totally detached from actually implementing elegant or high performance software. Actual engineers achieve this despite of SIP's terrible decisions. Granted, many of those are inherited from HTTP. Tell me how many HTTP stacks handle comments and line folding properly... It opens up security holes, too. One proxy interprets \r\r\n as 1 line break, another as 2 line breaks and start of body. Oops, now you can end up sending fun headers to your target because they try to be flexible in accepting input. IIRC there is essentially no way to implement SIP standardly because of so many broken implementations. You have to make some decisions on certain parsing that will break one but any other way will break another. Text-based protocols invite abuse by designers and implementors alike. IETF compounds these by living in a fantasy world.

th0ma5 9y ago

I tried some of the leak tests here, it seems to leak my NAT address not my nearest public IP? Can anyone chime in?

bubblethink 9y ago
It's not even the local ip of your home network. It's the ip of the tunnel interface. I don't know how this can be misused. It's only on firefox though. On chromium, it just shows 0.0.0.0 instead.
- th0ma5 9y ago
  Yes that's exactly what I see. This seems to me to be a non-issue but perhaps other configurations and VPNs behave differently? I was using my phone into my home router with OpenVPN and it showed my VPN assigned NAT address 10.x.x.x ...

giancarlostoro 9y ago

The weird thing for me is I'm on Firefox on my Mac and I ran all those tests and it said WebRTC is enabled, but never gave my actual factual IP address. I'm running Private Internet Access which they claim is vulnerable... So I'm not sure whose doing that test but they might have their settings a bit jacked up? If you have Private Internet Access there is an "Advanced Settings" panel where you can click on "IPv6 leak protection" it disabled IPv6 while using the VPN, seems to have been enough to fool these leak tests.

swiley 9y ago

This is why when I actually do anything with tor it's always curl -H "" Using something as complex as firefox for anything important is just stupid.

lallysingh 9y ago
Or just use Qubes on Tor
mirimir 9y ago
Or just use Whonix. Or better, Whonix in Qubes.
jwilk 9y ago
Why -H ""? AFAICT, it doesn't do anything.

urda 9y ago

> Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear! Did you file a bug report?

lovelearning 9y ago
I searched for one and found some that seem to be related. Will file one today and also work on a fix, since it appears this is known from a long time and nobody has bothered to provide even a simple fix.
- urda 9y ago
  Cool, can you link the report here when you do?

Crontab 9y ago

I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days. Can't wait to see how WebAssembly will be used against us.

throwaway2048 9y ago
Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads. This is already being worked on.
- earenndil 9y ago
  It's being fought before it's even fully grown. Computer vision adblockers are also being worked on.
  - TeMPOraL 9y ago
    A sad and stupid zero-sum game wasting both talent and electricity.
- gear54rus 9y ago
  Any links to that? What kind of enemies of mankind are working on this? Advertisers again?
whyever 9y ago
> Can't wait to see how WebAssembly will be used against us. Have you heard of Coinhive [1]? They are using WebAssembly to mine bitcoins in the browser. [1] https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/ https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive...
- etskinner 9y ago
  On the other hand, this method might be a good way to 'pay' for using a service instead of ads, so long as it's opt-in and the user knows about it.

throw2016 9y ago

It seems Firefox has resigned to some sort of role as 'token' competition to Chrome. Most of its actions seem inexplicable and counterproductive when strong privacy and user protection should be their reason to exist and keep a dedicated user base. The bigger problem is exploding complexity in many areas is a huge concern for open source as it's becoming increasingly impossible for small teams to implement or come up with alternatives. This is going to reduce meaningful choice and leave users at the mercy of a mix of corporate or vested interests.