Hacker News Reader

Comment by ilostmykeys | Hacker News Reader

How about the security issue with WebRTC where the browser leaks the IP address? It's part of the way WebRTC works so I can't see how that can be fixed. It's both a security issue and a key enabling feature.

Update:

It looks like Google Chrome (desktop) team has published a plugin that alleviates the problem but can cause performance degradations with apps that use WebRTC. They seem to suggest that a decent fix won't be possible until UDP proxies are in wide use and Chrome adds support for that.

View on HN

Chrome team has now made a permanent change in behavior for the browser, and it is being rolled out to users with Chrome 48 as documented here:

https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0...

This implements the behavior proposed to the IETF https://tools.ietf.org/html/draft-shieh-rtcweb-ip-handling-0...

I don't have a full understanding of WebRTC, but AFAIK its a browser-to-browser connection library. How would that work without leaking the ip address? The browser at least has to know who to connect to?

I don't really know anything about this topic, but the parent comment leads me to believe that you would use a UDP proxy to hide your address. Instead of sending out your address, you'd send out the proxy's address. When the proxy receives data, it would pass it to you. That way the other party doesn't know your address; they only know the proxy address. This is just a guess based on how I assume proxies would work, so I may be wrong.

Who is going to pay for the proxy's bandwidth? Apple, Google, Mozilla? Good luck.

The site owner? Well, the site owner now has your IP!

People are typically okay with site owners having their IP, because site owners tend to not be malicious. You could only connect with people that you completely trust, but with many applications the users might be complete strangers or merely internet acquaintances. Given the power, there would be malicious users taking advantage of it. This was a big deal with Skype because people weren't aware that adding a contact could reveal their IP to that person, and/or were not aware that revealing their IP could lead to DDOS attacks or other forms of abuse/stalking.

If you want this behavior, you have to use WebSockets.

WebRTC is peer-2-peer.

Yes, it's a tradeoff.

Install uBlock origin plugin, which has a "Prevent WebRTC from leaking local IP address" option: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

that doesn't work and if it worked it would cripple WebRTC apps

> How about the security issue with WebRTC where the browser leaks the IP address

Yes, even if the user is behind a VPN, WebRTC will expose their ISP-given public IP. Luckily Firefox allows WebRTC to be disabled. Recently they added a new setting that alleviates that leak for the majority of VPN users, while allowing WebRTC to still be enabled. Would be awesome if Chrome allowed WebRTC to be disabled as well.

Forgive my lack of networking knowledge, but why aren't the UDP packets also sent over the VPN?

If the information in the packets contains your original IP address it doesn't matter how the packet is routed in terms of privacy.

The browser doesn't know you're behind a VPN or more generically it doesn't know your public IP address.

Please read https://groups.google.com/forum/#!topic/discuss-webrtc/_5hL0...

The new Chrome behavior should alleviate the need to disable. Basically, the behavior that caused the concern has been changed significantly.

That's a great change!

Reply on news.ycombinator.com