Hacker News Reader

Comment by TekMol | Hacker News Reader

When you run "pktstat -n" while watching the video, you can see the IPs of other visitors of the website. I see people from Sweden, the USA, Japan, Brazil...

Since among the HN users there are probably a lot of developers, I tried to put some of the IPs into my browser. And indeed, already the second IP I tried sent back a reply from a (misconfigured) server.

I have to say it feels frightening, that the other users can see my IP. And probably other data about me.

Also I would expect it's not legal in most places around the world to give away the IP of a visitor to other visitors. Can't imagine it is legal in Europe.

View on HN

I agree that it's a bit frightening, but I would put that more on the browser makers than sites in general.

The various browsers decided that webrtc (websockets as well) didn't need to follow the "same origin" rules that they set up for XmlHttpRequest.

It almost feels like browsers should have some way to delineate "web pages" from "web applications" and provide different ways to present them to end users, different rules, etc.

I think browsers should simply pop up a dialog "WebRTC Request: This website wants to connect your computer to other computers. Allow?".

For now, I have disabled WebRTC in FireFox by setting media.peerconnection.enabled to false in about:config.

That seems to work for now, but I'm thinking more of where it's headed. Websockets, WebRTC, WebWorkers, and then other pending proposals all eventually end up being like a "VM" running apps on your local machine.

At some point, it's much closer to an "App Store", which arguably has finer grained (and more usable) control presented to the user to manage what applications can (and cannot) do.

When a user access any website of content providers online, they implicitly agree to the terms of service of that provider. When using Peer5, the terms of service includes a language about public IP temporarily visible to other users.

This line of thinking makes me feel uncomfortable. That you can secretly give away data about me and which videos I watch because of some text in your TOS.

I also doubt it would hold in court. TOS have a very restricted applicability. You can not use them to restrict people's rights in unexpected ways.

Why not use VPN if you feel that uncomfortable? That's what it's designed for to hide your real IP.

An IP address is not PII. Linking it to viewed videos is still not PII. Good luck in court.

True in the US, not true in the EU. There is a reason Google Analytics has a switch to throw a few bits of an IP away, and it surely isn't because Google hates data.

Given that they are selling a CDN, and thus likely want to sell to globally operating customers, that might become relevant relatively quickly.

I can tell you at the BBC it was 100% considered PII.

IP addresses are not secret anyway.

More importantly they are also basically 100% allocated, so it's not like, say, telephone numbers where there are large unused swathes of the numberspace.

Why is that important?

Because it means that knowing an IP address is active doesn't really tell you anything. 99.99% of them are.

the interesting thing about a phone number also isn't if it is active or not, it is who it belongs to/what other activity originates from it. Knowledge about an IPs activity wouldn't be more useful if there were billions of unused IPs. E.g. introduction and rising adoption of IPv6, with massive unused space does not make data about an IPv4 address worth less.

Reply on news.ycombinator.com