Re: [rtcweb] Please require user consent for data channels

[Matthew Kaufman <[e-mail]>]

On 7/11/2015 9:42 AM, Daniel Roesler wrote:
> Howdy all, this is mostly a re-surfacing of the discussion about IP
> address leaking back in April[1], which unfortunately I did not
> discover until recently.
>
> One of the items in the new proposal was "WebRTC already requires
> permission to access getUserMedia. Why not use that permission to
> control interface enumeration?" That item didn't really get discussed
> much in the thread, but I think it's one of the most important issues.
>
> Why? There is now a documented case where a third party on nytimes.com
> is using a fake webRTC datachannel to silently gather user local (and
> potentially "real" ISP) IP addresses.
> ...

On the IPv6 Internet, the IP address you use to reach the web site is 
almost certainly the same as your "local" IP address. There's no 
additional information exposed by allowing an application to discover 
that information directly via JavaScript.

The IPv4 Internet is essentially out of addresses and in the process of 
being retired. I don't believe there's any reason at this point to 
disable functionality in order to improve compatibility with this legacy 
network.

Matthew Kaufman

ps. You can also gather all these addresses for any browser with Flash 
Player installed by asking Flash to connect via RTMFP to a server, 
whereupon it will report the full enumeration of available IPv4 and IPv6 
addresses to that server.