The external IP is leaked, too! Clearly this peer to peer encrypted video protocol needs to be restricted, for the good of privacy and security, of course.
Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?
Knowing the local area IP lets advertising companies and other "less liked" parties distinguish the devices behind your public IP, without having to use e.g. cookies. At the very least, it's another data source for helping with browser fingerprinting.
So we're willing to destroy the web's big shot at peer-to-peer networking out of concern that this adds one more data point for fingerprinting, out of dozens?
Let's keep the big picture in mind here, people. Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies. Please let's not kill it while it's just starting to grow.
I simply stated facts, I did not say WebRTC should be dropped or restricted because of IP address leaks.
With that said, now let me express an opinion (not a fact): for every technological innovation there are downsides and upsides, and it's up to people to decide if the greatness makes up for the (potential) problems. With cell phones for instance, most people accept potentially having their location disclosed to the accuracy cell towers and triangulation allow, because it's super damn convenient to be able to place and receive calls and text from just about anywhere. Of course, there's a minority that is not comfortable with this and refuses to use cell phones or takes extra precautions.
Similarly, people may be willing to accept the problems of WebRTC because its applications are enough to make up for the disadvantages. People who don't accept will find ways to not use it. If the majority of users ends up blocking it, we can conclude that people don't want a peer-to-peer web, but a more sensible conclusion will be that people were not OK with that particular implementation of peer-to-peer networking, and a different implementation is in order, or that at least patches to the current implementation are needed.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
I think that most likely, these data-scarfing companies (and other parties) will learn to use WebRTC (as it is now) for nefarious purposes, before it hurts a tiny bit of their bottom line. I bet it's much easier and there is much more immediate monetary support for developing the pieces necessary to track users with WebRTC, than to implement an actual peer-to-peer application with it.
No, just make sure the web's big shot at peer-to-peer networking doesn't poke yet another hole in the already shabby privacy of today's average web user.
I won't even go into the debate of whether or not we want "the web" to be the support for the p2p network of the future.
> Peer-to-peer networking is the web's big chance to weaken these huge personal data-scarfing companies.
On the other hand, this particular problem is another ace in the hands of those huge personal data-scarfing companies.
> So we're willing to destroy the web's big shot at peer-to-peer networking
IPv6 with its built in true end-to-end connectivity just called and wants to have a word with you, but you were stuck behind some inferior IPv4 NAT blockade.
I'm pretty sure that ship has sailed. Users (and perhaps more important, companies) do, in fact, want web browsers to do everything. Even traditionally heavyweight applications like Microsoft Office and Adobe Photoshop are shifting to the web.
Whether that's a good idea or not is certainly open to debate, but pretending that it's not happening isn't the answer.
It's more of an abstraction layer over operating systems than an operating system. Crippling APIs (try opening a datagram socket. or send icmp pings). No gpu-compute, no shared-state multithreading.
It doesn't manage hardware or anything like that.
People use browsers as if they were an operating system. That does not make it one.
It's like calling a java virtual machine an operating system.
Good point re: VPN [0]. The example you point to is not a tracker, though.
Looks like the Tor bundle disabled WebRTC about two years ago [1] [2]. I think a VPN user would expect the WebRTC connection to be routed via a VPN, as well, but I'm still figuring out how those work, exactly :)
"Somewhat" is kind of important here. In practice you can easily just test 10 or so most common router ip addresses in under 5 seconds.
And probably get a 95% hit ratio:
Well, I'm not sure about XSS, but imagine you know someone's home IP is:
192.168.1.10
Based on this, you can probably guess the router is 192.168.1.1 and maybe even have a clue about the vendor based on the IP assigning patterns.
Then you can direct them to a page with an submitting POST <form> that makes modifications to their router settings. This is more like CSRF than XSS though.
It doesn't. All major browsers block connections to 192.168.XX.XX (and any other externally unroutable IP) from external (http on the Web, not localhost) web pages.
I think this is a legitimate question. If people are saying knowledge of specific computer addresses is harmful it's the same as saying IPv6 is harmful, which would be a shame.
I also understand the proxy / vpn IP leaking issue. But since firefox is self reporting here, surely it would be possible to have a plugin to mask the actual IP or report garbage for those who have privacy concerns? It's overkill to disable or lobotomize the whole feature because of that one use case.
Sarcasm aside, what good can 192.168.1.4 possibly be to anyone?