TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Chromium based browsers leak user local IP via WebRTC foundation attribute

268 点作者 proszkinasenne2超过 2 年前

17 条评论

xg15超过 2 年前
Many comments on this thread are about the pros and cons of leaking the local IP <i>in an ICE candidate entry</i>. You can certainly discuss this, but in my understanding, that&#x27;s not what this post is about at all.<p>The issue is about leaking the local IP in the <i>foundation</i> which is supposed to be some sort of opaque UUID - the local IP isn&#x27;t supported to be in there at all, whether you want LAN connections or not.<p>Is this correct?
评论 #33330667 未加载
Eisenstein超过 2 年前
This can be disabled in Brave by turning &quot;WebRTC IP handling policy&quot; to &quot;Disable non-Proxied UDP&quot; in &quot;settings - &gt; Privacy and Security&quot;.
评论 #33329737 未加载
评论 #33340833 未加载
评论 #33329165 未加载
Semaphor超过 2 年前
What’s the issue there? How is knowing the local IP a security issue?<p>And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?)<p>edit: Thanks everyone, I completely forgot about fingerprinting.
评论 #33328106 未加载
评论 #33328078 未加载
评论 #33328873 未加载
评论 #33328102 未加载
Fnoord超过 2 年前
WebRTC was already known to leak local IP. Which can be dangerous if you&#x27;re behind a VPN.<p>I use two browsers. One with WebRTC disabled (Firefox) and one with WebRTC enabled (Safari&#x2F;Chromium). The former also runs a myriad of other addons which increase privacy. The latter I use to connect to PiKVM.
评论 #33332384 未加载
评论 #33337327 未加载
评论 #33335653 未加载
thesuperbigfrog超过 2 年前
If you are unfamiliar with WebRTC I recommend checking out &quot;WebRTC for the Curious&quot;:<p><a href="https:&#x2F;&#x2F;webrtcforthecurious.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;webrtcforthecurious.com&#x2F;</a><p>WebRTC is designed to be secure, so a privacy leak is not good.
评论 #33330580 未加载
评论 #33330679 未加载
Scharkenberg超过 2 年前
I am using Microsoft Edge and the test on the linked page times out without detecting anything. Perhaps it is because I&#x27;ve enabled the &quot;Anonymize local IPs exposed by WebRTC&quot; flag.
saghul超过 2 年前
Has this been reported to Chromium &#x2F; WebRTC? At a quick glance I don&#x27;t see it in the WebRTC bug tracker.
ajross超过 2 年前
The root technical issue here seems to be that the IPv4 space is fundamentally pretty small and easy to search, the browser just uses a crc32 to obscure the local IP address, and you can write code to brute force it with a little sophistication.<p>The security impact, as others are pointing out, is pretty minimal. Knowing a local IP address behind a NAT isn&#x27;t &quot;not&quot; a privacy issue (e.g. I can see things like gaming anti-abuse using tricks like this to discriminate users who need to be blocked vs. normal players), but it&#x27;s not much of one.
jackewiehose超过 2 年前
How to disable WebRTC on Firefox Mobile? I have uBlock which prevents from leaking the local IP but I don&#x27;t want WebRTC at all.<p>Why did they take about:config from us?
评论 #33329010 未加载
评论 #33328992 未加载
评论 #33329188 未加载
ck2超过 2 年前
* <a href="https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uBlock&#x2F;wiki&#x2F;Prevent-WebRTC-from-leaking-local-IP-address" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gorhill&#x2F;uBlock&#x2F;wiki&#x2F;Prevent-WebRTC-from-l...</a><p>* <a href="https:&#x2F;&#x2F;browserleaks.com&#x2F;webrtc" rel="nofollow">https:&#x2F;&#x2F;browserleaks.com&#x2F;webrtc</a>
sesm超过 2 年前
Is user IP leaked to another peer if there is a media server (like Kurento) between peers? I’ve worked in 2 WebRTC-based projects and in both cases the connection was not actually P2P, but had some kind of media server in between, either to mux multi-user conferences or to re-encode the media to a format supported by the other peer.
encryptluks2超过 2 年前
I&#x27;m not getting a leak with Chromium, but that is probably because I have my policy set to `default_public_interface_only`. I believe this is by design as WebRTC notoriously leaks local IPs.
AtNightWeCode超过 2 年前
WebRTC again. On the same page. There is no isolation between remote and local networks in browsers.
Gualdrapo超过 2 年前
I seem to recall Fallon (based on Chromium) has a feature which disables that.
评论 #33328419 未加载
plaguepilled超过 2 年前
What does &quot;Used 0 keys for lookups&quot; mean?
评论 #33329302 未加载
matheusmoreira超过 2 年前
I think uBlock Origin prevents that.
评论 #33331496 未加载
jovial_cavalier超过 2 年前
It gets &quot;leaked&quot; to a web app that I&#x27;m choosing to connect to? Why do I care?
评论 #33329859 未加载