7 ms·

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections.

by jnbiche 11y ago

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being done in good faith (even though I strongly disagree), but other users will not be so understanding. Edit: s/advertiser-driven/corporate-driven I think there are a lot of big companies, particularly social media, that have a huge vested interest in suppressing web-based peer-to-peer networks. Not claiming that's what's happening here, but the threat posed by WebRTC to those companies is very real. At present, a peer-to-peer Twitter would not be impossible to pull off technically with WebRTC, a DHT, and a modest number of STUN servers. The hard part is convincing users it's in their best interest to switch, but if that could be accomplished...

madeofpalk 11y ago
WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.
- jnbiche 11y ago
  Well, websockets introduced a massive new opportunity for advertisers to exfiltrate user data that wasn't even subject to the normal cross-site restrictions until recently in most browsers. But nobody proposed eliminating Websockets, or requiring explicit user approval for connections. Instead, they fixed the problem.
- kuschku 11y ago
  The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/
  - anfedorov 11y ago
    And by "exactly that purpose" you mean preventing ad fraud [1], right? They weren't using WebRTC to put you in a "VPN user" advertising segment. 1. https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_york_times_uses_webrtc_to_gather/ https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_...
    - monstruoso 11y ago
      Doesn't matter. Privacy is not about right or wrong, it is about privacy.
      - anfedorov 11y ago
        Privacy is not an absolute to be maximized at all costs. Do you have blacked out windows, or do you concede that the practical day-to-day infringement of your privacy is so minuscule and so easily mitigated by window shades that it's not worth the trade-off?
        1stop 11y ago
        no, but I have windows with curtains on the inside. Not the outside. The distinction is both important, and blatantly obvious. Privacy control must remain with the one whose privacy is at stake.
        anfedorov 11y ago
        And sometimes you have these curtains open? But what about privacy? Do you agree that sometimes people being able to look into your living room is not a big deal, even if it decreases your privacy by some definition? Great, then you agree that maximizing privacy at all costs isn't your or people's tradeoff point. Same with WebRTC - your internal network's IP is not the kind of privacy most people care about, nor should they. That said, WebRTC from behind a VPN exposing your personal IP is a bit different. That's kind of like a light you installed rendering your curtains translucent. I'm not sure if it's the curtain's fault, or the light's, but it's certainly not what anyone had expected! Given that OpenVPN somehow works in a way that doesn't expose your personal IP [1], I'd blame the VPN providers for saying that their VPN anonymizes web traffic when it actually doesn't. 1. https://tlog.anfedorov.com/vpns-webrtc https://tlog.anfedorov.com/vpns-webrtc
higherpurpose 11y ago
Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.
- squeeze 11y ago
  TorBrowser might be a reskinned and customized Firefox, but the Tor network is not.
- jacquesm 11y ago
  From my understanding of how this works that's mostly a consequence of the Tor browser trying to achieve network privacy and anonymity at the wrong layer. The right way would be to route all the requests through Tor, not just those from the engine of the browser.
  - daxelrod 11y ago
    I used to be of this opinion, but [1] changed my mind. The problem is that there's a huge potential to deanonymize the user at an exit node because of all sorts of traffic other than web browsing. Do all of your chat programs encrypt everything? How about your email client? What about every daemon on your system that accesses the Internet? At the very least, all of these can be used to fingerprint you. WebRTC is a great example of why the user-agent turns out to be the right level to think about anonymity over Tor. [1]: http://www.wired.com/2014/10/anonymity-routers/ http://www.wired.com/2014/10/anonymity-routers/
- jnbiche 11y ago
  I agree that Tor is a special case, but who uses Tor without Tor Button, Tor Browser, or something similar? It's easy to disable WebRTC in those instances. Regarding internal VPN IPs, I don't understand how this would help an attacker. If someone has broken into a VPN network and is in a position where they could make use of that data, then it's game over anyway. Otherwise, what do you want with an internal IP, besides fingerprinting? By the way, fingerprinting no doubt is an issue, along with a dozen or so other JavaScript APIs that leak data. If you don't want to be fingerprinted, use something like NoScript. Advertisers can already uniquely identify you based on various other data leaked by JS, don't know why WebRTC has been singled out for this reason.
yAnonymous 11y ago
For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.
- LMAlVvQjSGj 11y ago
  Can they actually sue users when the copyright holders are the ones distributing the content?
  - yAnonymous 11y ago
    In many European countries they can. They set up honey pots, log everything and then send costly C&Ds to thousands of people. Courts usually believe their "proof", no matter how bad it is. It's probably a billion dollar business by now.
    - anc84 11y ago
      Citation please.
      - yAnonymous 11y ago
        >http://www.pcwelt.de/ratgeber/Die-Abmahnindustrie-Jeden-kann-es-treffen-5802508.html http://www.pcwelt.de/ratgeber/Die-Abmahnindustrie-Jeden-kann... Estimates of 500,000 yearly C&Ds in Germany from 2011. >http://www.wortfilter.de/news11Q1/news3945.html http://www.wortfilter.de/news11Q1/news3945.html C&D industry in Germany makes about 400 million a year. Don't have numbers from other countries, but it's definitely a big business in Europe.
        anc84 11y ago
        Those are about the Abmahnungen, no mention of honeypots.
pjc50 11y ago
a peer-to-peer Twitter would not be impossible One of the key features of twitter, the global reach of hashtags, would be impossible. Twitter relies very heavily on being centralised. Anyone claiming to build a decentralised twitter needs a very careful numbers-based argument as to what the bandwidth consumption of being a popular user or hashtag might be.
- ef4 11y ago
  If a million people suddenly want to participate in a single hashtag, you necessarily also have a million devices able to contribute to the distribution of the content. It's far from intractable. It's bittorrent for tweets.
return0 11y ago
> I don't understand why a peer-to-peer network connection is different from Ajax Ajax is one-way
- scott_karana 11y ago
  Hardly. One direction's "packet" size is just limited by URL encoding/length restrictions. :)
shkkmo 11y ago
Yeah, it seems like the issue is running unverified third-party javascript on your webpage. This is part of the reason why I use privacy badger because many sites seem to do this. If you want to prevent data from being sent to servers about you, you pretty much have to disable javascript completely though.
- robgibbons 11y ago
  It's ultimately impossible to prevent tracking of all types. Pixel tracking doesn't use JavaScript, so it persists even if JS is disabled. Actually, I can think of a few ways that don't require JS.
Khaine 11y ago
But they should. Most mal-ads are from third party connections. Layers and layers of junk javascript all come from third party connections. Web developers have been shown to be incapable of acting maturely (see http://blog.lmorchard.com/2015/07/22/the-verge-web-sucks/ http://blog.lmorchard.com/2015/07/22/the-verge-web-sucks/). They should be locked down until they can grow up.

by jnbiche 11y ago

madeofpalk 11y ago

WebRTC is being singled out as it leaks user information that wasn't leaking before. AFAIK, the conspiracy-minded people are claiming that this is a move by 'advertisers' to collect more user-identifying data.

jnbiche 11y ago
Well, websockets introduced a massive new opportunity for advertisers to exfiltrate user data that wasn't even subject to the normal cross-site restrictions until recently in most browsers. But nobody proposed eliminating Websockets, or requiring explicit user approval for connections. Instead, they fixed the problem.
kuschku 11y ago
The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/ https://webrtchacks.com/dear-ny-times/
- anfedorov 11y ago
  And by "exactly that purpose" you mean preventing ad fraud [1], right? They weren't using WebRTC to put you in a "VPN user" advertising segment. 1. https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_york_times_uses_webrtc_to_gather/ https://www.reddit.com/r/netsec/comments/3dgwee/how_the_new_...
  - monstruoso 11y ago
    Doesn't matter. Privacy is not about right or wrong, it is about privacy.
    - anfedorov 11y ago
      Privacy is not an absolute to be maximized at all costs. Do you have blacked out windows, or do you concede that the practical day-to-day infringement of your privacy is so minuscule and so easily mitigated by window shades that it's not worth the trade-off?
      - 1stop 11y ago
        no, but I have windows with curtains on the inside. Not the outside. The distinction is both important, and blatantly obvious. Privacy control must remain with the one whose privacy is at stake.
        anfedorov 11y ago
        And sometimes you have these curtains open? But what about privacy? Do you agree that sometimes people being able to look into your living room is not a big deal, even if it decreases your privacy by some definition? Great, then you agree that maximizing privacy at all costs isn't your or people's tradeoff point. Same with WebRTC - your internal network's IP is not the kind of privacy most people care about, nor should they. That said, WebRTC from behind a VPN exposing your personal IP is a bit different. That's kind of like a light you installed rendering your curtains translucent. I'm not sure if it's the curtain's fault, or the light's, but it's certainly not what anyone had expected! Given that OpenVPN somehow works in a way that doesn't expose your personal IP [1], I'd blame the VPN providers for saying that their VPN anonymizes web traffic when it actually doesn't. 1. https://tlog.anfedorov.com/vpns-webrtc https://tlog.anfedorov.com/vpns-webrtc

higherpurpose 11y ago

Look at it this way - if Tor (which is based on Firefox) allowed WebRTC by default, it would be useless for its intended privacy purpose.

squeeze 11y ago
TorBrowser might be a reskinned and customized Firefox, but the Tor network is not.
jacquesm 11y ago
From my understanding of how this works that's mostly a consequence of the Tor browser trying to achieve network privacy and anonymity at the wrong layer. The right way would be to route all the requests through Tor, not just those from the engine of the browser.
- daxelrod 11y ago
  I used to be of this opinion, but [1] changed my mind. The problem is that there's a huge potential to deanonymize the user at an exit node because of all sorts of traffic other than web browsing. Do all of your chat programs encrypt everything? How about your email client? What about every daemon on your system that accesses the Internet? At the very least, all of these can be used to fingerprint you. WebRTC is a great example of why the user-agent turns out to be the right level to think about anonymity over Tor. [1]: http://www.wired.com/2014/10/anonymity-routers/ http://www.wired.com/2014/10/anonymity-routers/
jnbiche 11y ago
I agree that Tor is a special case, but who uses Tor without Tor Button, Tor Browser, or something similar? It's easy to disable WebRTC in those instances. Regarding internal VPN IPs, I don't understand how this would help an attacker. If someone has broken into a VPN network and is in a position where they could make use of that data, then it's game over anyway. Otherwise, what do you want with an internal IP, besides fingerprinting? By the way, fingerprinting no doubt is an issue, along with a dozen or so other JavaScript APIs that leak data. If you don't want to be fingerprinted, use something like NoScript. Advertisers can already uniquely identify you based on various other data leaked by JS, don't know why WebRTC has been singled out for this reason.

yAnonymous 11y ago

For one, the way it's implemented now, it's only a matter of time until we see WebRTC torrent malware downloading copyrighted files to give copyright holders a reason to sue / C&D users. In a time where sharing an MP3 can cost thousands of dollars, having a protocol that can share data like that without the users' consent is crazy.

LMAlVvQjSGj 11y ago
Can they actually sue users when the copyright holders are the ones distributing the content?
- yAnonymous 11y ago
  In many European countries they can. They set up honey pots, log everything and then send costly C&Ds to thousands of people. Courts usually believe their "proof", no matter how bad it is. It's probably a billion dollar business by now.
  - anc84 11y ago
    Citation please.
    - yAnonymous 11y ago
      >http://www.pcwelt.de/ratgeber/Die-Abmahnindustrie-Jeden-kann-es-treffen-5802508.html http://www.pcwelt.de/ratgeber/Die-Abmahnindustrie-Jeden-kann... Estimates of 500,000 yearly C&Ds in Germany from 2011. >http://www.wortfilter.de/news11Q1/news3945.html http://www.wortfilter.de/news11Q1/news3945.html C&D industry in Germany makes about 400 million a year. Don't have numbers from other countries, but it's definitely a big business in Europe.
      - anc84 11y ago
        Those are about the Abmahnungen, no mention of honeypots.

pjc50 11y ago

a peer-to-peer Twitter would not be impossible One of the key features of twitter, the global reach of hashtags, would be impossible. Twitter relies very heavily on being centralised. Anyone claiming to build a decentralised twitter needs a very careful numbers-based argument as to what the bandwidth consumption of being a popular user or hashtag might be.

ef4 11y ago
If a million people suddenly want to participate in a single hashtag, you necessarily also have a million devices able to contribute to the distribution of the content. It's far from intractable. It's bittorrent for tweets.

return0 11y ago

> I don't understand why a peer-to-peer network connection is different from Ajax Ajax is one-way

scott_karana 11y ago
Hardly. One direction's "packet" size is just limited by URL encoding/length restrictions. :)

shkkmo 11y ago

Yeah, it seems like the issue is running unverified third-party javascript on your webpage. This is part of the reason why I use privacy badger because many sites seem to do this. If you want to prevent data from being sent to servers about you, you pretty much have to disable javascript completely though.

robgibbons 11y ago
It's ultimately impossible to prevent tracking of all types. Pixel tracking doesn't use JavaScript, so it persists even if JS is disabled. Actually, I can think of a few ways that don't require JS.

Khaine 11y ago

But they should. Most mal-ads are from third party connections. Layers and layers of junk javascript all come from third party connections. Web developers have been shown to be incapable of acting maturely (see http://blog.lmorchard.com/2015/07/22/the-verge-web-sucks/ http://blog.lmorchard.com/2015/07/22/the-verge-web-sucks/). They should be locked down until they can grow up.