webrtc-ips
Security and privacy
ip address detection
SHOW HN2015
How HN took it
3 positive, 23 neutral or asking, 1 mixed, 17 critical, out of 44 comments about the project. Thread score -0.32.
Privacy: 0 for, 13 againstIdea: 3 for, 1 againstExecution: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for fraud detection by checking IP against request IP
From 2 comments
I use this exact method for fraud detection. 99% of the time, carders " " will simply load up a proxy in Firefox/Chrome (usually a socks5) and fire away. They typically don't…
joshmn on HNThat's clever, thanks. Implemented. Another useful heuristic is to check if the client is coming in from a public Tor exit. YMMV depending on the nature of goods being sold, but…
huhtenberg on HN
Objections
WebRTC leaks local and public IPs, a privacy risk
From 4 comments
I hope webrtc isn't authorized by default by browsers.I want to give explicit consent.It should even have been that way for ajax requests.
aikah on HNWow, seems like a big privacy issue. Does this mean that VPNs soon won't be effective for masking your IP?
olalonde on HN> Your public IP has always been available to a Javascript developer who knows enough to write a one-line PHP script that prints $_SERVER['REMOTE_ADDR'] (as an example). The demo…
olalonde on HNThe demo reported 192.168.56.1 as a local IP. Now they know I have VirtualBox installed. I wonder what other IPs can leak information about common apps and network configs.
The_Fox on HN
Browsers should not enable WebRTC by default without consent
From 2 comments
I hope webrtc isn't authorized by default by browsers.I want to give explicit consent.It should even have been that way for ajax requests.
aikah on HNLet's have a quick survey: 1. Are you currently using WebRTC in any projects? 2. Are you planning on using WebRTC in the future? 3. Do you think that WebRTC should be enabled by…
desdiv on HN
Requests
Content Security Policy rule to block WebRTC
From 1 comment
As much as I'm happy that you're able to detect fraudulent transactions, I am really disappointed that there's not a Content Security Policy rule to prevent WebRTC :-(
Torgo on HN
Questions
Why does the demo show two public IP addresses?
From 1 comment
Why do I have two public IP addresses?
xyby on HN
Alternatives named
Disabling WebRTC in Firefox via about:config or addons
From 3 comments
This can be disabled in firefox's about:config page by setting media.peerconnection.enabled to false. The problem with disabling all these features on a case by case basis is…
throwaway125 on HNIf you'd like an easier way to toggle this setting. https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/ I wish Chrome would provide this setting too.
ChrisAntaki on HNYou can use WebRTC Block on the chrome store
xfr on HN
Simpler IP services like ip.nfriedly.com and ifconfig.me
From 2 comments
I set up http://ip.nfriedly.com/json?callback=foo a while ago - it's available if anyone is interested in a simpler version that also works for older browsers.
nfriedly on HNWhen you're on the command line: ``` curl ifconfig.me ```
madeofpalk on HN