The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course.
Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions.
Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.
IPv6 with its built in true end-to-end connectivity just called and wants to have a word with you, but you were stuck behind some inferior IPv4 NAT blockade.
IPV6 over POTS? How retro!
I won't even go into the debate of whether or not we want "the web" to be the support for the p2p network of the future.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
On the other hand, this particular problem is another ace in the hands of those huge personal data-scarfing companies.
Whether that's a good idea or not is certainly open to debate, but pretending that it's not happening isn't the answer.
It doesn't manage hardware or anything like that.
People use browsers as if they were an operating system. That does not make it one.
It's like calling a java virtual machine an operating system.
Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :)
0. PPTP exposes that you're on VPN and your computer's IP http://i.imgur.com/mKKfjj7.png, as does L2TP http://i.imgur.com/C68HvSN.png, while OpenVPN only exposes that you're (probably) on a VPN: http://i.imgur.com/IVQkwsd.png.
(P2P encrypted video? Great. P2P systems in the browser driven by Javascript from any web page or ad network? Less great idea there.)
192.168.1.10
Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns.
Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
192.168.1.1 192.168.0.1 192.168.2.1 192.168.10.1 192.168.100.1 10.0.0.1 172.30.0.1 172.30.1.1 172.30.1.1
I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.