WebRTC IP Leak

[gazza-911]

Does webtorrent fix the WebRTC bug [revealed on February 2015] that allows STUN servers to see the real IP as opposed to VPN IP?

Unfortunately is doesn't seem to be discussed anywhere.

[josephfrazier]

EDIT: Disregard the Firefox bits here. See my next comment instead.

In the browser, you should be able to prevent IP leakage as described by https://ipleak.net/#docs

• Mozilla Firefox: Type "about:config” in the address bar. Scroll down to “media.peerconnection.enabled”, double click to set it to false.
• Google Chrome: Install Google official extension WebRTC Network Limiter.

[gazza-911]

So the bug still remains in WebTorrent itself then.

Also, the docs are only for browsers, not desktop apps using WebTorrent such as Playback. Does this mean that for applications using WebTorrent, you have to contact them to check/fix this?

[josephfrazier]

Oh wow, I definitely just copy/pasted for my previous message without actually reading it... The Firefox fix suggested above disables peer connections entirely, meaning that WebTorrent wouldn't work very well at all. I think the about:config setting needed is media.peerconnection.ice.default_address. See https://wiki.mozilla.org/Media/WebRTC/Privacy for more info.

I don't know whether particular non-browser environments like electron provide an equivalent setting, but if they don't, I imagine it might be possible for WebTorrent to detect which SDP candidates contain private IP addresses, and strip them out before sending the SDP anywhere.

[feross]

This isn't an issue for WebTorrent to resolve. Browsers have already taking steps to mitigate the leak, like always using the default route (i.e. the VPN route) when connecting to STUN servers, and not revealing the local IP addresses unless the user gives camera and mic permissions (which WebTorrent doesn't request).

Given these browser fixes, I see nothing for WebTorrent to do. If you're using a VPN, only the VPN default route should be used (at least in Chrome; I'm less familiar with the steps Mozilla has taken).

[lock]

This thread has been automatically locked because it has not had recent activity. To discuss futher, please open a new issue.