Re: ICE exposes 'real' local IP to javascript

Standards-wise: You might want to have a look at
http://tools.ietf.org/html/draft-schwartz-rtcweb-return-04#section-5.3 (a
draft which I'm hoping will be adopted by the rtcweb group).

Reality-wise:
Tor is not a VPN.  It acts as a SOCKS5 proxy.  Tor doesn't support UDP, and
none of the major browsers support SOCKS5-UDP anyway, so it's not much use
for WebRTC.  Tor Browser Bundle, IMHO the only responsible way to use Tor,
has disabled WebRTC from the beginning, precisely to avoid revealing the
user's IP address.

VPN users who want to be safe should set permissions such that the browser
can only access the VPN, not the physical network.  (I don't personally
know how to do this, especially on all different operating systems!)

On Mon, Feb 2, 2015 at 9:16 AM, Tim Panton <thp@westhawk.co.uk> wrote:

> Firstly- sorry for cross posting - I’m not sure which side of the line
> this falls.
> Secondly - if this is covered, please let me know, I don’t recall it
> cropping up...
>
> I’ve been reading worried blogs that WEBRTC in browsers ‘leaks’ the local
> ‘real’ ip addresses to the javascript.
> The principle worriers are VPN users e.g
> https://cryptostorm.org/viewtopic.php?f=50&t=2867&p=13096#p13096
> The concern is that this can be done without user notification
> (DataChannel request) and might be used to
> identify or finger-print users. Clearly the most vulnerable are Tor users
> who are on a real routeable IP address
> or directly on a carrier grade nat (eg android phones etc) where the IP
> may reveal the identity or location of the user.
>
> It seems to me that this concern will be increased in the case of ipv6
> deployments (MNOs).
>
> Do we need to specify a config option on the browser ‘I’m using a VPN
> don’t expose my local IP’
>
> Again, sorry if I missed this being hashed to death already.
>
> T
>
> Tim Panton - Web/VoIP consultant and implementor
> www.westhawk.co.uk
>
>
>
>