News for hackers. Stuff that matters.

A comment on Excuse Me Sir, Your WebRTC Is Leaking.

Re:Excuse Me Sir, Your WebRTC Is Leaking by 0x0 on Thursday February 26, 2015 @10:23AM (#9112943)
Interesting, maybe browsers should add a permission prompt like they do for web camera access before allowing a webrtc stun request?
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by Golgi_SDK on Thursday February 26, 2015 @11:40AM (#9113416)
There is a permission request to access the camera but this is triggered by a call to getUserMedia(). This would be done if setting up a peer connection to transmit voice and/or video. However, if you want to set up a WebRTC data channel no such prompt occurs.
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by echeese on Thursday February 26, 2015 @02:53PM (#9114980)
Why would you want to disable STUN requests? Wouldn't they just return the public-facing IP that the server already knows about?
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by 0x0 on Thursday February 26, 2015 @03:35PM (#9115296)
Did you even read the article and click the demo link? :) https://diafygi.github.io/webrtc-ips/
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by echeese on Thursday February 26, 2015 @03:56PM (#9115429)
Yeah, but you don't even need a stun server for that. The browser itself provides the local IP addresses.
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by 0x0 on Thursday February 26, 2015 @04:00PM (#9115456)
Oh, I thought it had to read them back from the STUN server negotiation because of javascript limitations.
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by AdrianRossouw on Thursday February 26, 2015 @11:05AM (#9113196)
i was under the impression it already does.
[ Parent | on HN ]
Re:Excuse Me Sir, Your WebRTC Is Leaking by mikeash on Thursday February 26, 2015 @11:46AM (#9113447)
Doesn't look like it. The LAN scanner in another comment didn't put up any prompts for me. It might look like it does because WebRTC is normally used with audio or video, which does require a prompt, but you don't have to use it that way.
[ Parent | on HN ]