4 ms·

I agree with a lot of this, but not turning off WebRTC in general. Certainly you should turn it off (or force TURN only) if you're trying to hide your IP behind

I agree with a lot of this, but not turning off WebRTC in general. Certainly you should turn it off (or force TURN only) if you're trying to hide your IP behind a VPN. But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server.

ultramancool 11y ago
> But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configuration. Remember though, this leaks all interface IPs, I have many virtual machines installed with their own network adapters added to my system, VPN adapters, etc which also leaks data as all of those adapters will have v6LL IPs on them even if they're not in use. Additionally, this issue is already actively being used for fingerprinting. Not some exploit of tomorrow. There was a New York Times advertiser caught doing it a few days ago. > I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server. Yeah, which is why I encourage disabling it completely. Until either they fix the privacy issues or the value of using some WebRTC application appears to trump them to you.
- deleted 11y ago
  [deleted]
- TD-Linux 11y ago
  >Extremely few people have active IPv6, it seems unlikely to catch on now. Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1]. >Remember though, this leaks all interface IPs Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
  - ultramancool 11y ago
    > Except that over 20% of the United States has IPv6 connectivity. The entire rest of the world has near-zero, just look at your own link. I'm in Canada and we have 0.55% here. No local ISP will offer it to me, and the one that did withdrew it completely last year. So perhaps I'm just slighted. There are a few other countries with 5%+ but it still makes up only a very small percentage of internet users. To top it off, while there has been some IPv6 adoption in the US, CGN has also caught on pretty heavily all over the world and seems to be, sadly, the solution most ISPs will actually go with for the near term at least. > Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ is able to immediately reveal all the VM interfaces on my system even with no VMs using them. I suspect this is done so that faster routes may be established, but it is indeed a major problem for anyone who doesn't like fingerprinting.
- technofiend 11y ago
  Are you aware IOS 9 will prefer IPV6 by default? And that many browsers already have a "Happy Eyeballs" Implementation? https://en.wikipedia.org/wiki/Happy_Eyeballs https://en.wikipedia.org/wiki/Happy_Eyeballs IPV6 isn't going anywhere: IPV4 exhaustion is a real concern and with the internet / internet of things growing, the only place to grow is really the IPV6 space. NAT only delayed the inevitable. See here - https://ipv6.he.net/statistics/ https://ipv6.he.net/statistics/ - for current statistics on how many IPV4 addresses are left.
  - ultramancool 11y ago
    Yeah, I know, many OSes do already prefer it by default. I see more pushes for CGN than I do for IPv6 as a solution to IPv4 depletion though, it just seems dead in the water, in my country at least. Maybe your ISPs are better, but no locally available ISP will offer me native v6, it's either real v4 or CGN v4.

ultramancool 11y ago

> But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configuration. Remember though, this leaks all interface IPs, I have many virtual machines installed with their own network adapters added to my system, VPN adapters, etc which also leaks data as all of those adapters will have v6LL IPs on them even if they're not in use. Additionally, this issue is already actively being used for fingerprinting. Not some exploit of tomorrow. There was a New York Times advertiser caught doing it a few days ago. > I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server. Yeah, which is why I encourage disabling it completely. Until either they fix the privacy issues or the value of using some WebRTC application appears to trump them to you.

deleted 11y ago
[deleted]
TD-Linux 11y ago
>Extremely few people have active IPv6, it seems unlikely to catch on now. Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1]. >Remember though, this leaks all interface IPs Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
- ultramancool 11y ago
  > Except that over 20% of the United States has IPv6 connectivity. The entire rest of the world has near-zero, just look at your own link. I'm in Canada and we have 0.55% here. No local ISP will offer it to me, and the one that did withdrew it completely last year. So perhaps I'm just slighted. There are a few other countries with 5%+ but it still makes up only a very small percentage of internet users. To top it off, while there has been some IPv6 adoption in the US, CGN has also caught on pretty heavily all over the world and seems to be, sadly, the solution most ISPs will actually go with for the near term at least. > Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ is able to immediately reveal all the VM interfaces on my system even with no VMs using them. I suspect this is done so that faster routes may be established, but it is indeed a major problem for anyone who doesn't like fingerprinting.
technofiend 11y ago
Are you aware IOS 9 will prefer IPV6 by default? And that many browsers already have a "Happy Eyeballs" Implementation? https://en.wikipedia.org/wiki/Happy_Eyeballs https://en.wikipedia.org/wiki/Happy_Eyeballs IPV6 isn't going anywhere: IPV4 exhaustion is a real concern and with the internet / internet of things growing, the only place to grow is really the IPV6 space. NAT only delayed the inevitable. See here - https://ipv6.he.net/statistics/ https://ipv6.he.net/statistics/ - for current statistics on how many IPV4 addresses are left.
- ultramancool 11y ago
  Yeah, I know, many OSes do already prefer it by default. I see more pushes for CGN than I do for IPv6 as a solution to IPv4 depletion though, it just seems dead in the water, in my country at least. Maybe your ISPs are better, but no locally available ISP will offer me native v6, it's either real v4 or CGN v4.