11 ms·

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sar

The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course. Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?

pjc50 11y ago
It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)
- jnbiche 11y ago
  Can you expand on this, please? How does it make it easier to XSS?
  - pjc50 11y ago
    Previously you'd have to guess that the router was on 192.168.x.1. http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ http://www.gironsec.com/blog/2015/01/owning_modems_and_route...
  - chadrs 11y ago
    Well, I'm not sure about XSS, but imagine you know someone's home IP is: 192.168.1.10 Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns. Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
    - malka 11y ago
      funny, of all the routers I used (all were provided by my ISP), their IP were 192.168.1.254
  - deleted 11y ago
    [deleted]
  - milankragujevic 11y ago
    It doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
    - pjc50 11y ago
      Just tested img and iframe and they work quite happily from the web to the local network.
- callesgg 11y ago
  "Somewhat" is kind of important here. In practice you can easily just test 10 or so most common router ip addresses in under 5 seconds. And probably get a 95% hit ratio: 192.168.1.1 192.168.0.1 192.168.2.1 192.168.10.1 192.168.100.1 10.0.0.1 172.30.0.1 172.30.1.1 172.30.1.1
gbl08ma 11y ago
Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
- jnbiche 11y ago
  So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
  - gbl08ma 11y ago
    I simply stated facts, I did not say WebRTC should be dropped or restricted because of IP address leaks. With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions. Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed. > Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.
Confusion 11y ago
Real VPN addresses are also leaked.
mahouse 11y ago
Fingerprinting and more evil deeds.
tmorgan 11y ago
Exposing the LAN address is less of a concern than exposing the real IP address of people using a VPN or proxy for anonymity.
rc4algorithm 11y ago
Don't be simple. This can reveal people that are using proxies like Tor and VPNs, and it's already being exploited by trackers: https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/
- anfedorov 11y ago
  Good point re: VPN [0]. The example you point to is not a tracker, though. Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :) 0. PPTP exposes that you're on VPN and your computer's IP http://i.imgur.com/mKKfjj7.png http://i.imgur.com/mKKfjj7.png, as does L2TP http://i.imgur.com/C68HvSN.png http://i.imgur.com/C68HvSN.png, while OpenVPN only exposes that you're (probably) on a VPN: http://i.imgur.com/IVQkwsd.png http://i.imgur.com/IVQkwsd.png. 1. https://trac.torproject.org/projects/tor/ticket/8178 https://trac.torproject.org/projects/tor/ticket/8178 2. http://i.imgur.com/9zEPduB.png http://i.imgur.com/9zEPduB.png
christop 11y ago
It makes DNS rebinding attacks simpler, for example: https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-stealing-wifi-passwords-with-a-website/ https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-st...
adam-a 11y ago
I think this is a legitimate question. If people are saying knowledge of specific computer addresses is harmful it's the same as saying IPv6 is harmful, which would be a shame. I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.

pjc50 11y ago

It makes it somewhat easier to XSS into your router. (P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)

jnbiche 11y ago
Can you expand on this, please? How does it make it easier to XSS?
- pjc50 11y ago
  Previously you'd have to guess that the router was on 192.168.x.1. http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ http://www.gironsec.com/blog/2015/01/owning_modems_and_route...
- chadrs 11y ago
  Well, I'm not sure about XSS, but imagine you know someone's home IP is: 192.168.1.10 Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns. Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
  - malka 11y ago
    funny, of all the routers I used (all were provided by my ISP), their IP were 192.168.1.254
- deleted 11y ago
  [deleted]
- milankragujevic 11y ago
  It doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
  - pjc50 11y ago
    Just tested img and iframe and they work quite happily from the web to the local network.
callesgg 11y ago
"Somewhat" is kind of important here. In practice you can easily just test 10 or so most common router ip addresses in under 5 seconds. And probably get a 95% hit ratio: 192.168.1.1 192.168.0.1 192.168.2.1 192.168.10.1 192.168.100.1 10.0.0.1 172.30.0.1 172.30.1.1 172.30.1.1

gbl08ma 11y ago

Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.

jnbiche 11y ago
So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens? Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
- gbl08ma 11y ago
  I simply stated facts, I did not say WebRTC should be dropped or restricted because of IP address leaks. With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions. Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed. > Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.

Confusion 11y ago

Real VPN addresses are also leaked.

mahouse 11y ago

Fingerprinting and more evil deeds.

tmorgan 11y ago

Exposing the LAN address is less of a concern than exposing the real IP address of people using a VPN or proxy for anonymity.

rc4algorithm 11y ago

Don't be simple. This can reveal people that are using proxies like Tor and VPNs, and it's already being exploited by trackers: https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/

anfedorov 11y ago
Good point re: VPN [0]. The example you point to is not a tracker, though. Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :) 0. PPTP exposes that you're on VPN and your computer's IP http://i.imgur.com/mKKfjj7.png http://i.imgur.com/mKKfjj7.png, as does L2TP http://i.imgur.com/C68HvSN.png http://i.imgur.com/C68HvSN.png, while OpenVPN only exposes that you're (probably) on a VPN: http://i.imgur.com/IVQkwsd.png http://i.imgur.com/IVQkwsd.png. 1. https://trac.torproject.org/projects/tor/ticket/8178 https://trac.torproject.org/projects/tor/ticket/8178 2. http://i.imgur.com/9zEPduB.png http://i.imgur.com/9zEPduB.png

christop 11y ago

It makes DNS rebinding attacks simpler, for example: https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-stealing-wifi-passwords-with-a-website/ https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-st...

adam-a 11y ago

I think this is a legitimate question. If people are saying knowledge of specific computer addresses is harmful it's the same as saying IPv6 is harmful, which would be a shame. I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.