WebRTC being used on nytimes.com to report visitors' local IP addresses(twitter.com)
twitter.com
WebRTC being used on nytimes.com to report visitors' local IP addresses
https://twitter.com/incloud/status/619624021123010560
3 comments
Why is this such a big deal? When IPv6 is ubiquitous, all IP communication will be 1:1 anyways.
In terms of privacy, IPv4 public + private IP is equivalent to IPv6 public IP (which every device will have).
In terms of privacy, IPv4 public + private IP is equivalent to IPv6 public IP (which every device will have).
This is not, perhaps, the real concern. It seems browsers, via WebRTC, expose all detected public addresses, so even though your default route may be through a specific interface, the browser will probe all local interfaces and discover all possible public IP addresses.
I'll let you figure out how this could be compromising.
I'll let you figure out how this could be compromising.
Can you stop this in Chrome yet? Can ublock origin stop it?
In release notes for version 0.9.9.3 it says: "New privacy setting: ability to prevent local IP address leak through WebRTC" https://github.com/gorhill/uBlock/releases/tag/0.9.9.3
The html served back includes a script tag having
loads
which defines an 'encryption key' that is later used to 'encrypt' POST parameters back to tagsrvcs, but looks a lot like a page load identifer, including using it to namespace 'postbacks' later on.
loads http://s.tagsrvcs.com/2/4.10.0/loaded.js
'postsback' to urls like http://s.tagsrvcs.com/2/4.10.0/818492/L0an5rrDUnnex1s8dQ4fGu...
(Note the 'L0an5rr...' which is the same as the 'encryption key' returned before in the 'analytics.js' file)
This collects some fun things like WebRTC addresses, scripts loaded on the page, and much much more, and sends them out as they become available or more events happen.
If you'd like to investigate this information yourself, the best place to set a breakpoint is in 'loaded.js', inside the function 'e.prototype.emitAsCORSXHR' which is responsible for 'encrypting' the payload before transmission.