6 ms·

What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN lo

What’s the issue there? How is knowing the local IP a security issue? And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?) edit: Thanks everyone, I completely forgot about fingerprinting.

proszkinasenne2 4y ago
It's both security and privacy issue. Whonix wiki explains the latter in more detail https://www.whonix.org/wiki/Data_Collection_Techniques#:~:text=WebRTC%20local%20IP%20discovery https://www.whonix.org/wiki/Data_Collection_Techniques#:~:te...
- Semaphor 4y ago
  If you use Chrome-exclusive links, please at least also link to the closest standard section [0] and preferably, mention the Chrome-linked text directly. That said, they don't say anything about security, I obviously forgot about fingerprinting, but still don’t see security issues? [0] https://www.whonix.org/wiki/Data_Collection_Techniques#Fingerprinting_Techniques https://www.whonix.org/wiki/Data_Collection_Techniques#Finge...
Etheryte 4y ago
Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.
- scratcheee 4y ago
  I've yet to see a normally configured browser _not_ be uniquely identifiable many times over through fingerprinting. At some point it feels like trying to drain the ocean with a cup. Maybe we just need to accept that anyone who really wants to fingerprint you _can_ fingerprint you unless you use a specialist browser. At that point the solution is fairly obvious, make it legally difficult to use unique fingerprinting and move on (ie stuff like gdpr). People will still do it, but they'll have to balance it with not falling foul of the law and wont be able to abuse it too much. We wont stop real world facial recognition by all trying to make our faces more similar either, we have to accept it's generally possible to do, but discourage the actual doing of it rather than trying to make it impossible. (note in both cases, actually preventing it when you have a reason to is totally possible and valid, via specialist browser modes and physical masks respectively)
  - Semaphor 4y ago
    I just tried a clean FF profile with resistFingerprinting enabled. No dice. Everything adds only very few bits of identifying information (unlike my main profile which is already almost unique thanks to the accept header (English, then German)) yet it still results in 17.75 bits which according to EFF is unique. I’m agreeing with you, though I wonder, is there any way to not be unique? What would you have to do? Use Windows with no extra fonts, Chrome in English, on a FullHD monitor with webgl/canvas/audio fingerprinting protection extensions?
    - hdjjhhvvhga 4y ago
      I believe the only feasible way without bending over backwards is to use the Tor Browser. But privacy and security always come at a price.
      - Semaphor 4y ago
        Actually, resistFingerprinting + switching to the user-agent string tor uses gets me 99% of the way there. All that’s missing is the weird window size (vertical taskbar), if I could get that to report a default size, I’d actually be better than Tor (they have a bunch of responses slightly more unique than FF with resistFingerprinting). But it’s academic for me anyway, I have Accept-Language en-US,en;q=0.7,de-DE;q=0.3 which is close enough to unique that nothing else really matters.
        CommitSyn 4y ago
        > All that’s missing is the weird window size (vertical taskbar) TBB actually adds a border at the bottom of the browser so the reported size isn't the actual size. If you change the size of your browser window to the tor-reported size then it should work. Unless I'm misunderstanding and you mean something to do with the scrollbar?
    - codedokode 4y ago
      I think a HTML-only browser without support for CSS and JS might help.
- megous 4y ago
  Yeah. All that's needed is to leak link-local IPv6 address from a single interface. There's your unique commputer identifier, unless someone's using mac randomization.
rollcat 4y ago
> How is knowing the local IP a security issue? It's a privacy issue. You can use it to fingerprint a user, local IP will give you quite many bits of entropy. <https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/> Honestly I'm not even sure if I'm surprised, but it's 2022 and we've been having this problem basically since the day WebRTC was introduced. At this point, if you care about privacy, you should probably put it in the same bag as third-party cookies and just block it entirely.
- Semaphor 4y ago
  Well, the big non-adtech browser is not vulnerable, so there’s that.
  - amenghra 4y ago
    https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893 is a fun read... Firefox used to also leak the internal IP circa 2015.
    - codedokode 4y ago
      Yes it is interesting how developers race to push new features allowing deanonimization of VPN users and better fingerprinting. There is also WebGL whose main purpose is to provide user's videocard model to advertising companies and governemnt institutions.
- MomoXenosaga 4y ago
  If memory serves Ublock origin does just that.
  - Semaphor 4y ago
    Not anymore on Desktop: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
- 4y ago
tyingq 4y ago
Have a look at this that scans your local network: http://samy.pl/webscan/ http://samy.pl/webscan/ I think some browser changes might have hobbled it a bit, but it was startling when I first tried it.
- Semaphor 4y ago
  A bit? The site claims it found a host on literally every single private IP that exists ;) And closing it nearly killed my FF (full freeze for ~10 seconds).
  - iosjunkie 4y ago
    OTOH, using Mobile Safari, this site leaked my device’s IP as well as a number of connected devices on my internal network. Anyone know an easy fix for this?
    - CommitSyn 4y ago
      If so, I'd love to hear it. As far as I know all iOS browsers are forced to use the same rendering engine, and I suspect there's no way to modify that.

proszkinasenne2 4y ago

It's both security and privacy issue. Whonix wiki explains the latter in more detail https://www.whonix.org/wiki/Data_Collection_Techniques#:~:text=WebRTC%20local%20IP%20discovery https://www.whonix.org/wiki/Data_Collection_Techniques#:~:te...

Semaphor 4y ago
If you use Chrome-exclusive links, please at least also link to the closest standard section [0] and preferably, mention the Chrome-linked text directly. That said, they don't say anything about security, I obviously forgot about fingerprinting, but still don’t see security issues? [0] https://www.whonix.org/wiki/Data_Collection_Techniques#Fingerprinting_Techniques https://www.whonix.org/wiki/Data_Collection_Techniques#Finge...

Etheryte 4y ago

Leaking any kind of data is yet another data point for fingerprinting. You only need a few to uniquely identify a user.

scratcheee 4y ago
I've yet to see a normally configured browser _not_ be uniquely identifiable many times over through fingerprinting. At some point it feels like trying to drain the ocean with a cup. Maybe we just need to accept that anyone who really wants to fingerprint you _can_ fingerprint you unless you use a specialist browser. At that point the solution is fairly obvious, make it legally difficult to use unique fingerprinting and move on (ie stuff like gdpr). People will still do it, but they'll have to balance it with not falling foul of the law and wont be able to abuse it too much. We wont stop real world facial recognition by all trying to make our faces more similar either, we have to accept it's generally possible to do, but discourage the actual doing of it rather than trying to make it impossible. (note in both cases, actually preventing it when you have a reason to is totally possible and valid, via specialist browser modes and physical masks respectively)
- Semaphor 4y ago
  I just tried a clean FF profile with resistFingerprinting enabled. No dice. Everything adds only very few bits of identifying information (unlike my main profile which is already almost unique thanks to the accept header (English, then German)) yet it still results in 17.75 bits which according to EFF is unique. I’m agreeing with you, though I wonder, is there any way to not be unique? What would you have to do? Use Windows with no extra fonts, Chrome in English, on a FullHD monitor with webgl/canvas/audio fingerprinting protection extensions?
  - hdjjhhvvhga 4y ago
    I believe the only feasible way without bending over backwards is to use the Tor Browser. But privacy and security always come at a price.
    - Semaphor 4y ago
      Actually, resistFingerprinting + switching to the user-agent string tor uses gets me 99% of the way there. All that’s missing is the weird window size (vertical taskbar), if I could get that to report a default size, I’d actually be better than Tor (they have a bunch of responses slightly more unique than FF with resistFingerprinting). But it’s academic for me anyway, I have Accept-Language en-US,en;q=0.7,de-DE;q=0.3 which is close enough to unique that nothing else really matters.
      - CommitSyn 4y ago
        > All that’s missing is the weird window size (vertical taskbar) TBB actually adds a border at the bottom of the browser so the reported size isn't the actual size. If you change the size of your browser window to the tor-reported size then it should work. Unless I'm misunderstanding and you mean something to do with the scrollbar?
  - codedokode 4y ago
    I think a HTML-only browser without support for CSS and JS might help.
megous 4y ago
Yeah. All that's needed is to leak link-local IPv6 address from a single interface. There's your unique commputer identifier, unless someone's using mac randomization.

rollcat 4y ago

> How is knowing the local IP a security issue? It's a privacy issue. You can use it to fingerprint a user, local IP will give you quite many bits of entropy. <https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/> Honestly I'm not even sure if I'm surprised, but it's 2022 and we've been having this problem basically since the day WebRTC was introduced. At this point, if you care about privacy, you should probably put it in the same bag as third-party cookies and just block it entirely.

Semaphor 4y ago
Well, the big non-adtech browser is not vulnerable, so there’s that.
- amenghra 4y ago
  https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893 is a fun read... Firefox used to also leak the internal IP circa 2015.
  - codedokode 4y ago
    Yes it is interesting how developers race to push new features allowing deanonimization of VPN users and better fingerprinting. There is also WebGL whose main purpose is to provide user's videocard model to advertising companies and governemnt institutions.
MomoXenosaga 4y ago
If memory serves Ublock origin does just that.
- Semaphor 4y ago
  Not anymore on Desktop: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
4y ago

tyingq 4y ago

Have a look at this that scans your local network: http://samy.pl/webscan/ http://samy.pl/webscan/ I think some browser changes might have hobbled it a bit, but it was startling when I first tried it.

Semaphor 4y ago
A bit? The site claims it found a host on literally every single private IP that exists ;) And closing it nearly killed my FF (full freeze for ~10 seconds).
- iosjunkie 4y ago
  OTOH, using Mobile Safari, this site leaked my device’s IP as well as a number of connected devices on my internal network. Anyone know an easy fix for this?
  - CommitSyn 4y ago
    If so, I'd love to hear it. As far as I know all iOS browsers are forced to use the same rendering engine, and I suspect there's no way to modify that.