Re: [rtcweb] Please require user consent for data channels

[tim panton <[e-mail]>]

> On 12 Jul 2015, at 20:19, Daniel Roesler <[e-mail]> wrote:
> 
> If you read the above articles and discussion surrounding the leak.
> The concern is not around local or private IPs, it's around public IPs
> for VPN users. Personal VPN use is extremely widespread
> internationally, mostly for censorship and content-blocking
> circumvention. Chinese users use them to get around the great
> firewall. Australian users use them to be able to watch Netflix. Tor
> is often not a suitable option because the web service they are trying
> to reach blocks Tor (e.g. bank website) or is too data heavy (e.g.
> streaming video).

The problem is that those VPNs are misconfigured.
If you want your VPN to ensure you don’t reveal the ISP provided public IP,
then you shouldn’t allow it to be the default route. You set the default 
route to the VPN - and then add a specific route to let just the VPN packets flow 
out with that IP.

If you do this correctly the STUN address webRTC gets is that of the far end of the 
VPN tunnel - which your website already knew.

I don’t think that just because some VPN service vendors can’t update their 
scripts correctly we should freeze web protocols.

This doesn’t help http proxy services of course, but that isn’t a VPN.

Tim.