Re: [rtcweb] Please require user consent for data channels

[Stephen Farrell <[e-mail]>]

On a related point. I'm not sure it's very compelling but there is
a passing reference in [1] to using WebRTC to discover local IP
addresses as a way of assisting in an attack on rc4 - presumably
the NAT'd source address offers some more known plaintext to an
attacker that can presumably see the WPA encrypted packets and hence
helps speed up the attack. See [1] p12 for the mention, though it
lacks details.

I guess the point is that folks will find unexpected ways to
(ab)use such knowledge once it's available. The right reaction of
course in this case is to not use rc4, but equally it perhaps
provides another example of the unexpected consequences of
exposing addresses.

S.

[1] http://www.rc4nomore.com/vanhoef-usenix2015.pdf