13 ms·
“We are considering adding an extension to restrict the use of WebRTC”
- anfedorov 11y agoThe external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
- pjc50 11y agoIt makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)
- jnbiche 11y agoCan you expand on this, please? How does it make it easier to XSS?
- pjc50 11y agoPreviously you'd have to guess that the router was on 192.168.x.1. http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ http://www.gironsec.com/blog/2015/01/owning_modems_and_route...
- chadrs 11y agoWell, I'm not sure about XSS, but imagine you know someone's home IP is: 192.168.1.10 Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns. Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
- malka 11y agofunny, of all the routers I used (all were provided by my ISP), their IP were 192.168.1.254
- deleted 11y ago[deleted]
- milankragujevic 11y agoIt doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
- pjc50 11y agoJust tested img and iframe and they work quite happily from the web to the local network.
- callesgg 11y ago"Somewhat" is kind of important here. In practice you can easily just test 10 or so most common router ip addresses in under 5 seconds. And probably get a 95% hit ratio: 192.168.1.1 192.168.0.1 192.168.2.1 192.168.10.1 192.168.100.1 10.0.0.1 172.30.0.1 172.30.1.1 172.30.1.1
- gbl08ma 11y agoKnowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
- jnbiche 11y agoSo we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
- gbl08ma 11y agoI simply stated facts, I did not say WebRTC should be dropped or restricted because of IP address leaks. With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions. Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed. > Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.
- Confusion 11y agoReal VPN addresses are also leaked.
- mahouse 11y agoFingerprinting and more evil deeds.
- tmorgan 11y agoExposing the LAN address is less of a concern than exposing the real IP address of people using a VPN or proxy for anonymity.
- rc4algorithm 11y agoDon't be simple. This can reveal people that are using proxies like Tor and VPNs, and it's already being exploited by trackers: https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/
- anfedorov 11y agoGood point re: VPN [0]. The example you point to is not a tracker, though. Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :) 0. PPTP exposes that you're on VPN and your computer's IP http://i.imgur.com/mKKfjj7.png http://i.imgur.com/mKKfjj7.png, as does L2TP http://i.imgur.com/C68HvSN.png http://i.imgur.com/C68HvSN.png, while OpenVPN only exposes that you're (probably) on a VPN: http://i.imgur.com/IVQkwsd.png http://i.imgur.com/IVQkwsd.png. 1. https://trac.torproject.org/projects/tor/ticket/8178 https://trac.torproject.org/projects/tor/ticket/8178 2. http://i.imgur.com/9zEPduB.png http://i.imgur.com/9zEPduB.png
- christop 11y agoIt makes DNS rebinding attacks simpler, for example: https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-stealing-wifi-passwords-with-a-website/ https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-st...
- adam-a 11y agoI think this is a legitimate question. If people are saying knowledge of specific computer addresses is harmful it's the same as saying IPv6 is harmful, which would be a shame. I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.
- higherpurpose 11y agoWhy can't they just disable WebRTC by default and ask the user for permission like they do with location and so on, without revealing the IP before the user accepts the connection? Also, maybe the user could easily whitelist some connections/WebRTC IDs?
- jon-wood 11y agoI'm not sure asking permission really helps. With things like location and video end users at least know what it means, and can make a somewhat educated choice. How do you properly ask an uneducated user the question "Should this site be allowed to open an arbitrary data connection?" - sites that want to will think of some vaguely plausible reason and users will click away.
- jnbiche 11y agoI don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being done in good faith (even though I strongly disagree), but other users will not be so understanding. Edit: s/advertiser-driven/corporate-driven I think there are a lot of big companies, particularly social media, that have a huge vested interest in suppressing web-based peer-to-peer networks. Not claiming that's what's happening here, but the threat posed by WebRTC to those companies is very real. At present, a peer-to-peer Twitter would not be impossible to pull off technically with WebRTC, a DHT, and a modest number of STUN servers. The hard part is convincing users it's in their best interest to switch, but if that could be accomplished...
- madeofpalk 11y agoWebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.
- jnbiche 11y agoWell, websockets introduced a massive new opportunity for advertisers to exfiltrate user data that wasn't even subject to the normal cross-site restrictions until recently in most browsers. But nobody proposed eliminating Websockets, or requiring explicit user approval for connections. Instead, they fixed the problem.
- kuschku 11y agoThe issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/
- anfedorov 11y ago
- j-pb 11y agoIn other news, Mozilla is considering the restriction of IPv6, because it leaks the internal IP. (VPN leakage is a valid concern though)
- kuschku 11y agoVPN leakage, like the NYT did, is definitely a concern that can’t be dismissed.
- makomk 11y agoMost IPv6 implementations these days use a randomly-generated address which is periodically rotated to avoid this problem. Unfortunately, I'm pretty sure WebRTC renders this useless because it leaks all the IPv6 addresses, including link-local ones containing the hardware MAC address.
- therealmarv 11y agoChrome users, look here: https://chrome.google.com/webstore/detail/webrtc-block/nphkkbaidamjmhfanlpblblcadhfbkdm https://chrome.google.com/webstore/detail/webrtc-block/nphkk... or https://chrome.google.com/webstore/detail/webrtc-leak-prevent/eiadekoaikejlgdbkbdfeijglgfdalml https://chrome.google.com/webstore/detail/webrtc-leak-preven...
- wfunction 11y agoThanks!
- ickwabe 11y agoAnd firefox users here: https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/?src=search https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...
- asquabventured 11y agoBetter to just disable it from the about:config menu in my opinion, no need for an extension. To do this In Firefox: 1) Type 'about:config' in your address bar 2) Set 'media.peerconnection.enabled' value to 'false'. (The Default value is 'true')
- ickwabe 11y agoThis addon does as you suggest but with a simple click as opposed to having to go into about:config. Better if you think you might use webrtc from time to time.
- tracker1 11y agoI can actually see WebRTC becoming very useful... I actually miss the days where the likes of IRC, AOL and Yahoo group chats were more common... I wouldn't even know where to begin if I just wanted to chat with random people who are relatively local to me today. Not just voice/video but text. That said, I'm not sure how useful the P2P aspects of text are, but being able to send files directly would be a nice ability.
- lgrapenthin 11y agoCould somebody please explain whether it is a technical requirement to leak the internal IP address for this technology to succeed or, if not, what possible reasons could exist for this design decision?
- omarforgotpwd 11y agoIt is a technical requirement, because the protocol attempts to connect over the local network if both peers are under the same NAT. The local IP is shared so that the peers can attempt to make a local connection.
- lgrapenthin 11y agoI'd assume that this is a rather rare usecase in the world wide web, so why is it not disabled by default?
- jnbiche 11y agoNo, it's not rare. This is something all peer-to-peer networks running over IPv4 must do. WebRTC video, audio, or data wouldn't work without this.
- the8472 11y ago> all Considering your emphasis, that's a bold claim. Simple to disprove with a single counter-example: Bittorrent does not communicate your internal IP to do its job
- MichaelGG 11y agoThings worked fine before ICE. In fact, stuff like Bittorrent still works fine. If they were truly concerned with connectivity, they'd use upnp. But since that wasn't a standard from a friendly body, they added this ICE hack to try to make things work.
- 11y ago
- pornel 11y agoHow about not disabling it, but merely making use of it visible? (e.g. an icon or a notice in the addressbar) It would discourage reputable sites from abusing it, because users would start asking questions why a news site wants a p2p/videoconference connection.
- SG- 11y agoIf there's security concerns then it should prompt the user to allow/deny as well as whitelist the site for the future with a setting that lets people disable WebRTC easily (not in some obscure area).
- michaelmior 11y agoWebRTC is not just for videoconferencing and I don't think it's obvious that there aren't any legitimate use cases.
- michaelmior 11y agoWebRTC is not just for videoconferencing and I don't think it's obvious that there aren't any legitimate use cases.
- hyperpape 11y agoBecause if you really need to be anonymous, it's not good enough to catch it being used after the fact. Notifying the user after the fact sometimes works for things that are nuisances, but isn't good for privacy/security (imagine if your browser would execute unsandboxed JS and show you an icon each time it did it).
- SG- 11y agoI think the sensible solution (and this goes for anything where there's security or privacy concern like WebGL) is to block it by default however to prompt the user that the website wants to use WebRTC. The user can then choose to allow it for one time or to whitelist or blacklist the site.
- the8472 11y ago> and this goes for anything where there's security or privacy concern It would force web developers to think much harder about feature detection and being non-intrusive about their usage. If someone gets nagged to enable webrtc just to read some news article it might actually cause some head scratching. cross domain cookies, local storage, video/audio playback (at least in background tabs), ... You could even make an argument for cross-domain javascript. Sometimes it's insane what crap shows up in µMatrix. More requests going to 3rd party sites than the actual content that I want to look at.
- rumdz 11y agoI really hope someone from Mozilla reads your comment. That sounds like a good solution to me too.
- realusername 11y agoI don't really understand how it can leak the real IP address when using VPN. Since everything is going to the VPN anyway, how this would work ?
- HappyTypist 11y agoYour network interface still has information about your regular internet connection, even when connected through a VPN. Local apps can query this information. Webrtc clients do this in order to assist setting up direct connections -- it doesn't know you're using a VPN, and will happily hand over info about your network interface to any site.
- deleted 11y ago[deleted]
- kpcyrd 11y agoThis only happens if you're using windows as administrator and your VPN runs directly on your box. If you're running OpenVPN on your router your real external IP won't leak.
- Grue3 11y agoWhat the fuck, this leaked your real IP behind VPN since January 2014 and this isn't fixed yet? This sure looks like a Heartbleed-tier high-priority security hole to me. How is this not bigger news?
- giantdongfuz 11y agothere's no way this is in the same tier
- jnbiche 11y agoThey leak the internal IP assigned to you by a VPN, which is not the same IP as the one seen by the websites you browse, nor is it the same as the IP assigned to you by your ISP.
- gabeio 11y agoYes, the internal IP is leaked. But, also the IP assigned to you by your ISP is leaked (just tested with http://net.ipcalf.com/ http://net.ipcalf.com/ & a vpn). Though, I did test this on a college campus, so the network might just be leaking my internal ip, which ends up being my external ip also because of how they have the network setup. Which in hindsight is actually even scarier.
- billyhoffman 11y agoLeaking a client IP address is not even near the same universe of severity as remotely obtaining a web servers private TLS key. Given the lack of perfect forward secrecy used by web servers at the time, Heartbleed was a "read any encrypted traffic sent by the server, ever" issue.
- diafygi 11y agoWebRTC doesn't just leak the client IP address, it also leaks the public IP address of all network interfaces on the machine. If you're on a VPN, it can mean you leak your real IP address, too. Many Chinese use VPNs to circumvent censorship or participate in speech, so leaking your real IP address is potentially life threatening.
- userbinator 11y agoDoes anyone else feel that there's something terribly odd going on when restricting something needs to be an extension? IMHO it should be a configuration option, per-site, and off by default. WebRTC also isn't the only thing that applies to.
- drzaiusapelord 11y agoThe recent moves to turn the browser into its own OS are worrying. The problem I see is that no one seems to care. Its full steam ahead and its only later do we realize that these new feature and standards are trivial to abuse. I really wish there was some kind of web mission statement on where browsers are going instead of this kitchen sink approach. I have no idea what the W3C is thinking. I don't think even the W3C knows what its thinking. Its just being reactionary; trying to turn HTML5 into a "flash killer" and shoving feature after feature into the spec. I don't want to piss on progress, but I think privacy and security concerns get a backseat with W3C members, especially Google, whose very existence is dependent on finding information about users to sell to advertisers. Soon we'll need sandboxing and privacy apps to wrap our browsers in. I really hope Mozilla leads the way to pushing back on this recent mad push of thoughtless progress. A more moderate approach would be very much welcome and having more "off by default" options for easily abused features like P2P in the browser, which is what webrtc really is, makes sense. Right now I had no idea what my browser is capable of. Can it silently turn on my camera and microphone? Probably. Can it make all sorts of crazy p2p connections to various servers/clients silently? Probably. Its all a little scary.
- marcosdumay 11y agoThe kitchen sink approach is a Nash optimum strategy. Any browser that does not adopt it fails.
- csense 11y ago> no one seems to care Article about browser feature creep, currently on frontpage: https://news.ycombinator.com/item?id=9961613 https://news.ycombinator.com/item?id=9961613 People do care about this stuff. Maybe not enough people, and maybe not the right people to do anything about it. But there are people right here on HN who do care about this stuff.
- ilaksh 11y agoIf they restrict WebRTC then they restrict decentralization and that would move Mozilla out of the Freedom column and into the Fascism column with Microsoft.
- skrebbel 11y agoDo you know what "Fascism" means?
- azdle 11y agoIs there another problem besides leaking your IP address(es)? It sure sounds like that could pretty easily be solved by just sending hashes of the IP addresses along with the salt used to make the hashes. Then the receiver could compare it's own hash and know if it's on the same network. I suppose there might be a problem with IPv4 since there are so few IP addresses, so you'd still be vulnerable to targeted attacks, but it would solve the ad network problem. Am I missing something or just underestimating the usefulness of hashing?
- newscracker 11y agoI hope Mozilla takes a quick decision on this based on its own principles. This sentence saying "we are considering adding an extension" seems to be in stark contrast with the way Pocket was added into the main browser instead of being an ad or recommendation on the new tab page.
- arca_vorago 11y agoI submitted this a few weeks ago and it got removed from the front page, but I think it's relevant for anyone interested. https://news.ycombinator.com/item?id=9900168 https://news.ycombinator.com/item?id=9900168
- dont_care 11y agoWow, big deal. An extension. Oh noes. Plug-ins and extensions are, like, mostly non-existent entities, when released under circumstances without any actual demand for them. (compare/contrast: Java to AdBlock) > But-but-but evil corporate overlords! So what? They can do whatever they want on their core networks, so long as it doesn't bleed outside their edge.
- erkose 11y agoIf Mozilla is really concerned with leaking user information, then the extension should extend the use of WebRTC with a default to restrict the use of WebRTC