VPN leaks users’ IPs via WebRTC

by BlueGh0st • 8 years ago

434 167 8 years ago

Just want to point anyone looking to test their own VPN to https://ipleak.net/. That's been my go-to, and it seems more comprehensive than the linked service.

jgalt212• 8 years ago

FWIW, I show that Opera's free VPN does not leak the client's IP address.

https://www.opera.com/computer/features/free-vpn

herbst• 8 years ago

Operas VPN is not even a VPN tho. Check their phrasing they call it 'Web vpn' or something like this and already committed in the past that the naming scheme for their proxy was just a marketing trick.

Written from Opera tho. So not saying it sucks :)

cpeterso• 8 years ago

You can test WebRTC IP address (and media device id) leakage using https://browserleaks.com/webrtc.

To disable WebRTC in Firefox, set the about:config prefs "media.peerconnection.enabled" and "media.navigator.enabled" to false.

anfilt3• 8 years ago

More like this:

    media.peerconnection.turn.disable = true
    media.peerconnection.use_document_iceservers = false
    media.peerconnection.video.enabled = false
    media.peerconnection.video.vp9_enabled = false
    media.peerconnection.video.h264_enabled = false
    media.peerconnection.identity.enabled = false
    media.peerconnection.identity.timeout = 1

tobltobs• 8 years ago

Or try https://www.doileak.com . (Shameless plug of of a project of mine)

zaroth• 8 years ago

Nice project - but that name.... Sounds like a bad medical condition!

progval2• 8 years ago

WebRTC IP Leak: Your local IP: 10.41.41.2 .
Your browser supports WebRTC! Your real IP address is visible to every website you visit.
Web Real-Time Communication (WebRTC) is enabled by default in Firefox, Opera and Google Chrome, and enables video chat, voice calling and P2P sharing from within your browser.
A neat trick, but it allows any website to instantly see your true IP address. The only way to avoid sharing your IP address this way is to disable WebRTC completely.

Nope, that's not my "real" IP address

progval2• 8 years ago

Timezone Difference: The time zone of your browser is while your request IP location timezone is Europe/Paris.

Looks like there is a word missing.

balupton• 8 years ago

Seems my setup has me covered: https://www.doileak.com/?cb=liq1xtjsp37zvit5

Actual location is Kuala Lumpur, which was caught by the time zone... So need to look into fixing that.

For those wondering, my setup is:

ProtonVPN via the ProtonVPN Mac Beta (before I used Tunnelblick - which actually was more reliable - the ProtonVPN Mac Beta disconnects often)

AdGuard Pro, with DNSCrypt using the Adguard Family servers: https://gist.github.com/balupton/48057270a67d70e2ac984fdfa47...

Safari. With Camera, Microphone, Location, and Notifications all set as deny by default.

bringtheaction2• 8 years ago

To detect data from your torrent client we provide a magnet link to a fake file. The magnet contains an http url of a controlled by us tracker which archives the information coming from the torrent client.

That’s pretty clever. Alternatively they could have a unique file of garbage and have some seeders for it and then when someone connects it would also be the same person. But the tracker solution is less work and probably almost entirely as good.

Digital-Citizen• 8 years ago

And it needlessly requires Javascript to do things other services don't need Javascript to do. That's not a good plan.

One's IP address should be detectable to at least some degree with data from the packets making the request for the webpage. Some of this is remedied with what appears to be duplicative information further down the page.

DNS Address detection is done better by https://dnsleaktest.com/.

Geolocation detection is likely done by looking up what geolocation is paired with one's IP (and sometimes this data is wrong), so there's no real need for Javascript here either. It's not as if the requesting computer should supply this information, else it becomes even more easily spoofed. Some of this is remedied with what appears to be duplicative information further down the page.

Torrent detection is also needlessly JS-driven, and done better at http://dev.cbcdn.com/ipmagnet/.

There are also some grammar errors confusing singular and plural in the text at the bottom of the page.

ensignro23402• 8 years ago

Anyone interested in setting up their own VPN should check out Algo: https://github.com/trailofbits/algo

hyperpower• 8 years ago

What's the advantage of this over OpenVPN?

jakebasile• 8 years ago

It's natively supported by more operating systems. Namely, macOS and iOS. Also generates mobileprofile files that you can AirDrop to your device and have it set up in an instant.

superkuh5• 8 years ago

Or reconsider the need for a VPN at all. By using a VPN you cut yourself off from participating as an equal citizen on the net. If it's just for browsing the web, irc, or the like it's much easier and better just to use a socks 5 proxy to a cheap VPS. I like shadowsocks-libev.

But then again I don't use popular browsers that cram in fancy new features every week to expose new leaks and attack surfaces.

Hnrobert42• 8 years ago

By using a VPN you cut yourself off from participating as an equal citizen on the net.

What?

rjsw• 8 years ago

The WebRTC implementation in Firefox isn't as configurable as it could be, it just assumes that you are behind a firewall that doesn't understand SCTP so encapsulates everything in UDP and searches for the best way to escape to the internet.

mehrdadn• 8 years ago

What's so "legacy" about L2TP that it refuses to support it? Unlike others it's actually both secure and supported natively on most platforms...

ensignro23402• 8 years ago

Sorry, I'm not actually affiliated with the project, I just use it, so you'll have to shoot your question to the people behind it.

rahimnathwani• 8 years ago

Not 'anyone'. Algo is not suitable for avoiding censorship, and it doesn't target this use-case.

patentatt2• 8 years ago

I use it just to secure open or shifty public wi-fi in cafes and such. I do trust the data center the VPN terminates in more than the open wifi at the corner cafe, so it works for me.

patentatt2• 8 years ago

FYI: Windows' built-in IKEv2 VPN client is not leaking IPs. Works great with Algo.

MaupitiBlue• 8 years ago

Given that its hard to figure out how they could be profitable, should we assume private internet access is a NSA honeypot?

lima• 8 years ago

Bandwidth is cheap, massive overcommitment. Why wouldn't it be profitable?

protonimitate• 8 years ago

I don't understand this. Is profitability the only metric for if a service can be trusted or not?

It's also not even mentioned in the article linked, not sure why you brought it up at all tbh.

jaxn2• 8 years ago

Profitability (or the possibility of profitability) is absolutely a measure of whether something can be relied on. And if it can't possibly be profitable, then it means there is likely a non-obvious revenue stream or funding source, which means a ulterior motive.

So yeah, if a service can't be profitable, it can't be trusted.

tehwebguy• 8 years ago

Makes total sense -- if they aren't making money on the service they sell they will naturally have to do something else to keep the lights / servers on.

piracykills2• 8 years ago

It's likely quite profitable, they don't buy bandwidth from Amazon, they get a few colo'd machines or dedicated servers in many DCs - you can get dedicated gigabit lines in several DCs for a few hundred a month. Most subscribers only use the service occasionally and won't place that much load on it.

rubbingalcohol• 8 years ago

I worked at a well-known civil rights advocacy nonprofit for a long time and Private Internet Access was one of our major supporters. The owner is a huge ally of Internet freedom and privacy - a very good person who is an activist in their own way and using their success to make a positive impact.

So perhaps I'm biased (even though I'm not in nonprofit anymore), but I would put the chance of an NSA honeypot at close to 0%...

wlesieutre• 8 years ago

Krita’s 4.0 release was on here recently, which reminded me of this https://krita.org/en/item/krita-foundation-update/

PIA put up £20,000 to keep them going after a tax mixup dropped a large bill on the foundation.

Of course, it could conceivably all be government funded philanthropy to make them look like the good guys, but there’s no evidence to suggest that.

amadeusw• 8 years ago

What you say concerns me as PIA user. What do you base your allegations on? It seems that PIA sponsors a lot of organizations [0], which I don't think they would if they were not profitable.

[0] https://www.privateinternetaccess.com/pages/companies-we-spo...

confounded4• 8 years ago

Seems very unlikely to me.

Both the founder (Andrew Lee) and the CEO (Ted Kim) are known in the industry, have made their views on encryption and authoritarianism pretty clear in interviews, articles, and even full-page ads in the NYT and WaPo to argue for broadband privacy[0] and encryption.

PIA also seems pretty profitable; they certainly have enough to contribute to various open source projects, join pro-net-neutrality lobbying efforts like Fight For the Future, saved the Linux Journal from death (considered an "extremist forum" by the NSA's XKeyScore), and pay to keep Freenode ticking over (they also do loads of glitzy events for the Korean-American community).

You could argue that all of this is an elaborate hoax of course, but you could do that with anything.

[0] https://twitter.com/Hunckler/status/846204241731575808

rainieri• 8 years ago

What's your take on the recent releases that claim that the US government is funding the Tor network and its development? Information obtained from FOIA requests.

piracykills2• 8 years ago

Would enabling this uBlock option not be perfectly sufficient at preventing this attack?

https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

ryuuchin2• 8 years ago

It should unless this is something new? I'm not sure why this is really news. We've known about this problem with WebRTC for quite some time now.

voidsec2• 8 years ago

Quite funny, I've published this yesterday and went unnoticed until now, lol

BlueGh0st• 8 years ago

I was surprised it didn't tell me it was posted here before. I found the post and your comments on it over at /netsec.

Really appreciate your work on this!

en4bz• 8 years ago

Another thing to watch out for is leaking IPv6 connections. Depending on your configuration your VPN may not set the IPv6 default gateway.

zorkw4rg• 8 years ago

Clickbait? Its not "VPN providers" its "VPN provider software", I never even thought of using their software, most just give you the credentials for OpenVPN/IPSEC/PPTP or similar. Also if anonymity is of "real" concern you should never use a system that knows your real IP address in the first place. Instead create the vpn tunnel on a separate host system and run something like Tails in a VM (or better yet separate physical hardware).

3pt14159• 8 years ago

That tunnel won't help against real adversaries. Timing attacks and text content analysis will expose you. It's getting harder to be truly black online.

bringtheaction2• 8 years ago

text content analysis

The solution to that is to use memes and bad grammar. I am not kidding. Keep your messages really brief and have a community of people that talk in a very similar fashion to one-another.

fauigerzigerk5• 8 years ago

Its not "VPN providers" its "VPN provider software"

OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault.

The WebRTC leaks discussed in this article are not prevented by OpenVPN either (last time I checked, which was a while ago). You have to disable WebRTC in the browser.

mahkoh• 8 years ago

You have to disable WebRTC in the browser

Incorrect. An easy and foolproof way of using VPNs is with network namespaces. You start the VPN in your init network namespace and then move the created device into a dedicated VPN namespace. OpenVPN has support for this because it allows you to execute a shell script after the VPN device has been created. Then you simply start your browser, torrent client, whatever in this namespace and you are completely safe:

1. If the VPN fails, then the only network device inside the network namespace disappears (modulo the lo device) and the programs in this namespace cannot use the internet.

2. Since the browser can only see the devices within the network namespace, the only IP it can see is the one assigned to you by your VPN provider (usually 10.x.y.z or similar.)

DNS leaks can be prevented by using a generic DNS provider such as 8.8.8.8.

singularity2001• 8 years ago

use sshuttle -dns $server

bubblethink2• 8 years ago

OpenVPN leaks DNS on every default Ubuntu installation I have tried. But I think it's actually Ubuntu NetworkManager's fault.

Yeah, that's known behaviour. I think it's working as intended from Ubuntu/NM's standpoint since that bug has been open for a while with no fixes. The one line fix for that is to comment out dns=dnsmasq in NM's config. This is the bug for reference: https://bugs.launchpad.net/ubuntu/+source/network-manager/+b...

lr4444lr• 8 years ago

I can appreciate the use of Tails in a VM, but doesn't the provider of the "separate host system" have your identity through your payment information?

roywiggins• 8 years ago

Running Tails in a VM is so your browser can't leak your real IP to the wider internet even if it wants to, because it doesn't know what it is. Your VM provider still knows your real IP address.

mandelbulb• 8 years ago

Clickbait?

Partially. Obviously, self-marketing was the motivation for this test. However, it is still a helpful reference. If your provider doesn't even release a properly configured VPN client, you might want to reflect on whether to rely on the rest of their infrastructure.

Also if anonymity is of "real" concern

You're digressing. Whatever a user wishes to anonymize their information for can be a valid concern but that does not necessarily require absolute anonymity.

lovelearning5• 8 years ago

I don't use VPNs. For me, the more alarming information here is that SOCKS and Tor proxies are also leaking IP addresses. If a SOCKS proxy is configured in browser, isn't it the browser's responsibility to ensure all outgoing traffic - including WebRTC - goes via the proxy? Are these browser bugs?

Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear!

Update 2: I didn't realize this is how WebRTC actually works. FF even has an entire page for tweaking this stuff https://wiki.mozilla.org/Media/WebRTC/Privacy. I hate it when features like these, which atleast in my case go mostly unused, have such critical weaknesses by design and it's not announced anywhere with a big red danger sign.

confounded4• 8 years ago

I didn't realize this is how WebRTC actually works.

Yep. STUN is in the spec, and always has been. This has been a thing for years.

scottlu2• 8 years ago

STUN is part of the story. The overall process is called Interactive Connectivity Establishment (ICE).

blattimwind4• 8 years ago

https://www.privacytools.io/#webrtc

lovelearning5• 8 years ago

Thank you for that site. Looks like I have to become more aware of browser internals.

MichaelGG4• 8 years ago

This is the fault of the browser and WebRTC. They know about this but deliberately break it. The truth is WebRTC should never activate without user permission.

But no, WebRTC added data-channels. They have no good use to be silent and especially not to override SOCKS proxy. In fact, some key people on the WebRTC group, when I pressed them, could not provide a single real use-case for silent data channels.

Firefox is absolutely in the wrong to ignore your proxy settings, especially without getting consent first to start a call. It's a complete mess. Regardless of what the "spec" says, Firefox is responsible for implementing broken software that harms users.

Then again, so is STUN/ICE and basically every single thing that has to do with SIP/VoIP. It's like they go out of their way to be obtuse and come up with shitty standards then take glee in how bad it gets. As an example, look up SIP Torture Tests. There's an RFC just to illustrate the moronic edge-cases in SIP parsing that at one point implies your software needs to be conscious to infer the intention of malformed messages.

t. been working in telecom for far too long

blattimwind4• 8 years ago

TBH just from setting up one (1) PBX with about half a dozen devices from only two manufacturers -- I would never take a job anywhere near anything having something todo with SIP, ever.

pythonaut_16• 8 years ago

It really seems like adding a permission handler with a warning on WebRTC would be an easy fix for this problem and/or browsers should respect proxies and such when generating WebRTC candidates.

And I say that as someone who thinks WebRTC has some pretty cool use cases.

Paul-ish• 8 years ago

My impression is that this is a conflict between the WebRTC folks and the UX folks. The WebRTC team is happy to prompt you to use data channels, but the UX team doesn't want to over saturate people with security warnings. Especially warnings that people wont understand.

Waterluvian• 8 years ago

I use wrbrtc for lossy robot pose data. It would suck to require another approval popup in my software, but really, it's no big deal. Certainly the UX cost is worth the security benefits if we can't have both.

matheusmoreira• 8 years ago

What if the entire system is configured to use Tor? Does the use of Tails mitigate this weakness?

mirimir3• 8 years ago

Yes, this is largely the browser's problem. Because all available uplinks are available. Tor browser doesn't leak, because WebRTC is blocked. But other browsers with WebRTC enabled will leak with a standard Tor setup.

However, using Whonix for Tor, even if you install a random browser with WebRTC enabled, there is no WebRTC leak. Because the workstation VM has no Internet access except through Tor. The gateway VM is not a router. There is no forwarding, and it's firewalled. It just exposes Tor ports to a private internal network, for the workstation VM.

And one can do the same for VPNs, using pfSense VMs as VPN gateways. Apps in workspace VMs have no Internet access except through the VPN client running in the gateway VM.

th0ma52• 8 years ago

I tried some of the leak tests here, it seems to leak my NAT address not my nearest public IP? Can anyone chime in?

bubblethink2• 8 years ago

It's not even the local ip of your home network. It's the ip of the tunnel interface. I don't know how this can be misused. It's only on firefox though. On chromium, it just shows 0.0.0.0 instead.

swiley• 8 years ago

This is why when I actually do anything with tor it's always curl -H ""

Using something as complex as firefox for anything important is just stupid.

lallysingh2• 8 years ago

Or just use Qubes on Tor

mirimir3• 8 years ago

Or just use Whonix. Or better, Whonix in Qubes.

jwilk2• 8 years ago

Why -H ""? AFAICT, it doesn't do anything.

urda2• 8 years ago

Update: Can confirm Firefox Quantum with SOCKS proxy leaks the address. Oh dear!

Did you file a bug report?

lovelearning5• 8 years ago

I searched for one and found some that seem to be related. Will file one today and also work on a fix, since it appears this is known from a long time and nobody has bothered to provide even a simple fix.

Crontab• 8 years ago

I am so annoyed with this. It feels like every advance in web browser technology takes away as much as it gives. Some days, it feels like the web was better back in the HTML4 days.

Can't wait to see how WebAssembly will be used against us.

throwaway20482• 8 years ago

Just wait till you get a load of content rendering engines being written in (dynamicly re-obfuscated) web assembly and rendered via canvas, so users are totally locked out of modifying content loaded into them or blocking ads.

This is already being worked on.

whyever• 8 years ago

Can't wait to see how WebAssembly will be used against us.

Have you heard of Coinhive [1]? They are using WebAssembly to mine bitcoins in the browser.

[1] https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive...

giancarlostoro• 8 years ago

The weird thing for me is I'm on Firefox on my Mac and I ran all those tests and it said WebRTC is enabled, but never gave my actual factual IP address. I'm running Private Internet Access which they claim is vulnerable... So I'm not sure whose doing that test but they might have their settings a bit jacked up? If you have Private Internet Access there is an "Advanced Settings" panel where you can click on "IPv6 leak protection" it disabled IPv6 while using the VPN, seems to have been enough to fool these leak tests.

throw2016• 8 years ago

It seems Firefox has resigned to some sort of role as 'token' competition to Chrome.

Most of its actions seem inexplicable and counterproductive when strong privacy and user protection should be their reason to exist and keep a dedicated user base.

The bigger problem is exploding complexity in many areas is a huge concern for open source as it's becoming increasingly impossible for small teams to implement or come up with alternatives. This is going to reduce meaningful choice and leave users at the mercy of a mix of corporate or vested interests.

jwilk2• 8 years ago

It's 503 for me. Here's an archived copy:

https://archive.is/XHX74

aviv• 8 years ago

This has been known for a long long time, but keeps coming up in articles as a new finding.

lovelearning5• 8 years ago

If it's been known from a long time, then it's really unfortunate that nobody so far has bothered to contribute a fix to FF that changes its webrtc config flags correctly when a network proxy is configured.

ryuuchin2• 8 years ago

uBlock Origin has an option to do it[1].

[1] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

Thaxll• 8 years ago

Use the VPN on your gateway / router, problem solved.

smaili• 8 years ago

Complete list of tested browsers and VPN providers: https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5...

fwdpropaganda• 8 years ago

VPN isn't leaking anything, your browser is.

A) Don't run javascript

B) Config your firewall to block everything except connection to the VPN entry point.

mtve• 8 years ago

just for the record, "B" option is not helping here.

smsm42• 8 years ago

My VPN provider is listed as "vulnerable" but testing with their test site does not show IP leak...

voidsec2• 8 years ago

Which one?

CydeWeys• 8 years ago

I don't have a need for this high level of security, but if I did, here's what I'd do:

1. Run VPN software on host.

2. Download a widely used, generic VM image.

3. Route VM's entire network connection through host's VPN.

4. Do whatever you need to do, in the VM only.

5. Reset VM to initial settings after each use.

Am I missing anything?

Froyoh• 8 years ago

Ahhh why is the scrolling messed up :/

blunte• 8 years ago

I did find a bit of irony that the page warning about VPNs leaking my IP was hijacking my scrolling.

IronBacon• 8 years ago

I think I've started reading suggestions to disable WebRTC at least a couple of years ago in regards to avoid VPN detection from Netflix, so I thought it was a common knowledge.

LinuxBender• 8 years ago

This is a terminology problem. If you are using a VPN, a browser could not possibly leak your real IP, as all traffic would be encapsulated by the VPN.

What is being described is actually a proxy.

qwaitwhat• 8 years ago

FWIW, various arbitrarily strung together components (your OS, DNS, VPN, Browser, WebRTC) are not going to guarantee anonymity. Simply because it is not their job.

The only possible solution is a piece of software that guarantees end-to-end privacy by literally standing guard at each end (from the moment you connect to your network with your hardware MAC address exposed to the final moment when a web page is retrieved for you from your destiantion website).

Shameless plug: my project proposes to do exactly this. https://qwaitwhat.github.io/

codedokode• 8 years ago

It seems that main purpose of WebRTC was disclosing user's IP addresses. By the way, did you know that Websocket can be used for port scanning [1]? I was surprised to find that Aliexpress code scans 127.0.0.1 (visitor's computer) for VNC, RDP and similar ports.

[1] https://datatracker.ietf.org/meeting/96/materials/slides-96-...

dillondoyle• 8 years ago

I think it's a bit crazy Chrome web tools/inspector doesn't show these connections easily. You can check out chrome://webrtc-internals but most people just look at the network tab which shows nothing...

anfilt3• 8 years ago

For firefox the following in about:config should do the trick.

    media.peerconnection.turn.disable = true
    media.peerconnection.use_document_iceservers = false
    media.peerconnection.video.enabled = false
    media.peerconnection.video.vp9_enabled = false
    media.peerconnection.video.h264_enabled = false
    media.peerconnection.identity.enabled = false
    media.peerconnection.identity.timeout = 1

godzillabrennus• 8 years ago

Just tested this with http://www.ExpressVPN.com client on MacOS and it protected my IPv4 Public IP from being exposed but it does leak the local (NAT) IPv4 Private IP that I use on my internal network.

Not good that it leaked anything but at least the public IP is hidden by their software.

brink• 8 years ago

Looks like this Chrome plugin allows you to turn on / off WebRTC and fixes the leak. https://chrome.google.com/webstore/detail/webrtc-control/fjk...

andoma• 8 years ago

FWIW, Safari does not include your local IP address in the list of candidate addresses for WebRTC until you also authorize the page to access your camera.

joering2• 8 years ago

I'm suprised to see NordVPN is leaking.

I see commercials everywhere all the time and its #1 or #2 on most VPN reviews websites.

I was very tempted to switch, especially when they routers' Firmware is available for the newest/coolest routers out there; but kind of got used to ExpressVPN over the years, so went with them and their firmware for NETGEAR Nighthawk R7000 is very easy to use. Glad to see ExpressVPN is not leaking and I continue not to find any bad news about them (versus HideMyAss for example LOL)

jlgaddis• 8 years ago

I see commercials everywhere all the time ...

That's because of their marketing budget.

... and its #1 or #2 on most VPN reviews websites.

That's because of their affiliate programs.

silent_comedy• 8 years ago

NordVPN does not leak. Long time user. Simple test after acquiring free three day trial would be enough to clear any doubt, however people just love to speculate

pasbesoin• 8 years ago

One reason I don't want my browser to become a fucking operating system.

We already have Emacs for that. ;-)

_jomo• 8 years ago

While this has long been known, I was never able to actually reproduce this and I'm not sure how it's technically even supposed to work.

Assuming we're using IPv4, the default gateway is a VPN and the machine is behind a NAT: Any outside service (e.g. STUN server) would see the VPN's IP address. How would the browser even technically be able to know the public (i.e. the NAT's) IP address?

However, the WebExtensions API allows tweaking this via the webRTCIPHandlingPolicy to only reveal the public "interface" IP address.

FWIW, I'm always connected to a VPN and I have configured my macOS [0] and Android [1] firewalls to drop any connection other than the VPN's.

0: Wrote it down here: https://jomo.tv/security/pf-prevent-traffic-bypassing-vpn

1: Quite self-explaining: https://f-droid.org/packages/dev.ukanth.ufirewall/

yorby• 8 years ago

Maybe the browser should not have access to your real IP when you are using a VPN? so it's the OS's fault?

chime• 8 years ago

If you use computer/phone-based VPN, try https://www.dnsleaktest.com/ or http://dnsleak.com/

I have VPN on my home router with Tomato firmware. All of my devices pass this flawlessly.

amenghra• 8 years ago

I authored http://jsfiddle.net/alokmenghrajani/0qo4kq7x/ over 3 years ago...

revanx_• 8 years ago

this is old news tho, I was aware of this for ages. If you check privacy websites thats one of the first thing they say, turn off webRTC in your browser.

_o_• 8 years ago

Heh, this webrtc story is at least few years old and everyone privacy / security aware is blocking it.

For testing webrtc and other leaks including fingerprinting rather use https://browserleaks.com/

(and it is unable to capture any exposing data for my browsers on any of my devices)

qwerty456127• 8 years ago

BTW I think I would love a "VPN" (the term itself is misused massively, oftentimes it is just a proxy) accessed via WebRTC so it would be harder for the men in the middle to tell whether I am using a "VPN" or just calling somebody. Perhaps people in countries like China could make great use of such a thing too.

yAnonymous• 8 years ago

Every browser should have settings to disable WebRTC and it should arguably be disabled by default.

It can be very useful, but can also cause a lot of problems.

mido22• 8 years ago

Please stop using clickbaity titles, first line that I saw in the post "I’ve tested seventy VPN providers and 16 of them leaks users’ IPs via WebRTC"

So, more appropriate title would have been "23% of VPN providers leak user IP" :)

VPN leaks users’ IPs via WebRTC

Related Stories