Reply to thread

Message

<blockquote data-quote="Prime" data-source="post: 229" data-attributes="member: 18">Content1. Brief information2. Why is it not safe?3. How to check4. How to disable it4.1 Firefox4.2 Usage statistics.4.3 Chrome/ChromiumWebRTC (Web Real-Time Communication) is an open source technology that allows streaming data between browsers using point — to-point (p2p) technology.WebRTC is built in by default in the latest versions of Firefox, Chrome/Chromium, and Opera, and allows you to connect between two or more browsers for video / audio calls and more.<h3>Why isn&#039;t it safe?</h3>The fact is that for a p2p connection, you need to know the real IP address and WebRTC shamelessly merges this information. Even if you are sitting under TOR / VPN, it will not be difficult to find out your local IP address on the network and on the side of, for example, a VPN server. And with the use of vulnerabilities, you can determine your real IP address, behind which you are hiding.<h3>How to check it</h3>To check the local IP address, use the page: <a href="https://diafygi.github.io/webrtc-ips/" target="_blank">https://diafygi.github.io/webrtc-ips/</a>The JavaScript code and description are available on the following page: <a href="https://github.com/diafygi/webrtc-ips" target="_blank">https://github.com/diafygi/webrtc-ips</a>To check whether the camera, audio, screen capture, etc. are enabled in the browser, follow the link: <a href="https://www.browserleaks.com/webrtc" target="_blank">https://www.browserleaks.com/webrtc</a><h3>How to disable it</h3><h4>Firefox</h4>We call the hidden software settings about:configin the address bar, search for the parameter media.peerconnection.enabled, and set it to false.Code:[ad name=»Responbl»]In addition, you need to disable the following services::<h4>Google Safe Browsing</h4>Which merges your browsing history to Google. You need a warning that disabling Safe Browsing increases the risk of getting infected as a result of visiting a malicious site.Code:browser.safebrowsing.enabledbrowser.safebrowsing.downloads.enabledbrowser.safebrowsing.malware.enabled<h4>Firefox Statistics</h4>Sends stability and performance reports to Mozilla.Code:datareporting.healthreport.service.enableddatareporting.healthreport.uploadEnabled<h4>Usage statistics.</h4>Code:toolkit.telemetry.enabled<h4>Encrypted Media Extensions (DRM)</h4>A binary plugin with unknown source code that comes with Firefox starting with version V. 38. Allows you to play encrypted media content and use Netflix, etc. without Microsoft Silverlight. To completely remove the plugin, you need to install the EME-free version of the Firefox browser.Code:media.eme.enabledmedia.gmp-eme-adobe.enabled<h4>Firefox Hello</h4>Firefox connects to third-party servers (Telefonica) without permission.Code:loop.enabled<h4>Integration with Pocket</h4>A third-party service for managing the list of articles that you have set aside for reading.Code:browser.pocket.enabled<h4>Geolocation</h4>Code:geo.enabled<h4>Search suggestions</h4>Everything typed in the search bar is sent to the search engine. If you disable this option, suggestions will continue to work, but only based on the local search history.Code:browser.search.suggest.enabled<h4>Protection from site surveillance</h4>Unlike all the options listed above, you should enable this option instead. This is necessary to actively block sites that are known for their incorrect behavior in relation to tracking users. Not to be confused with DNT, which only &quot;asks&quot; sites not to track you. Here you can also apply a forced lock.Code:privacy.trackingprotection.enabled<h4>Chrome/Chromium</h4>It is disabled only by installing a small extension (~10 kb): WebRTC Block, although the local IP address of the browser does not stop shining.Chromium and Firefox-based browsers support WebRTC technology for audio and video chats directly from the browser window. In addition to convenience, this feature has an unpleasant side effect.In particular, WebRTC allows sending requests to STUN servers that return the user&#039;s local and public IP addresses. Such requests can be made using a script, so IP addresses are displayed using JavaScript.Requests are sent bypassing the standard XMLHttpRequest procedure and are not visible from the developer console. You can&#039;t block them with plugins like AdBlockPlus or Ghostery. Thus, these queries can be used, for example, by advertisers to secretly track users.On this demo page, you will see your own local and external IP address.<img src="https://cryptoworld.su/wp-content/uploads/2015/06/00338.jpg" alt="003" class="fr-fic fr-dii fr-draggable " style="" />This code works in Firefox and Chrome. You can copy it to the developer console for testing.Code://get the IP addresses associated with an accountfunction getIPs(callback){&nbsp; &nbsp; var ip_dups = {};&nbsp; &nbsp; //compatibility for firefox and chrome&nbsp; &nbsp; var RTCPeerConnection = window.RTCPeerConnection&nbsp; &nbsp; &nbsp; &nbsp; || window.mozRTCPeerConnection&nbsp; &nbsp; &nbsp; &nbsp; || window.webkitRTCPeerConnection;&nbsp; &nbsp; var mediaConstraints = {&nbsp; &nbsp; &nbsp; &nbsp; optional: [{RtpDataChannels: true}]&nbsp; &nbsp; };&nbsp; &nbsp; //firefox already has a default stun server in about:config&nbsp; &nbsp; //&nbsp; &nbsp; media.peerconnection.default_iceservers =&nbsp; &nbsp; //&nbsp; &nbsp; [{&quot;url&quot;: &quot;stun:stun.services.mozilla.com&quot;}]&nbsp; &nbsp; var servers = undefined;&nbsp; &nbsp; //add same stun server for chrome&nbsp; &nbsp; if(window.webkitRTCPeerConnection)&nbsp; &nbsp; &nbsp; &nbsp; servers = {iceServers: [{urls: &quot;stun:stun.services.mozilla.com&quot;}]};&nbsp; &nbsp; //construct a new RTCPeerConnection&nbsp; &nbsp; var pc = new RTCPeerConnection(servers, mediaConstraints);&nbsp; &nbsp; //listen for candidate events&nbsp; &nbsp; pc.onicecandidate = function(ice){&nbsp; &nbsp; &nbsp; &nbsp; //skip non-candidate events&nbsp; &nbsp; &nbsp; &nbsp; if(ice.candidate){veloper console for testing.Code://get the IP addresses associated with an accountfunction getIPs(callback){&nbsp; &nbsp; var ip_dups = {};&nbsp; &nbsp; //compatibility for firefox and chrome&nbsp; &nbsp; var RTCPeerConnection = window.RTCPeerConnection&nbsp; &nbsp; &nbsp; &nbsp; || window.mozRTCPeerConnection&nbsp; &nbsp; &nbsp; &nbsp; || window.webkitRTCPeerConnection;&nbsp; &nbsp; var mediaConstraints = {&nbsp; &nbsp; &nbsp; &nbsp; optional: [{RtpDataChannels: true}]&nbsp; &nbsp; };&nbsp; &nbsp; //firefox already has a default stun server in about:config&nbsp; &nbsp; //&nbsp; &nbsp; media.peerconnection.default_iceservers =&nbsp; &nbsp; //&nbsp; &nbsp; [{&quot;url&quot;: &quot;stun:stun.services.mozilla.com&quot;}]&nbsp; &nbsp; var servers = undefined;&nbsp; &nbsp; //add same stun server for chrome&nbsp; &nbsp; if(window.webkitRTCPeerConnection)&nbsp; &nbsp; &nbsp; &nbsp; servers = {iceServers: [{urls: &quot;stun:stun.services.mozilla.com&quot;}]};&nbsp; &nbsp; //construct a new RTCPeerConnection&nbsp; &nbsp; var pc = new RTCPeerConnection(servers, mediaConstraints);&nbsp; &nbsp; //listen for candidate events&nbsp; &nbsp; pc.onicecandidate = function(ice){&nbsp; &nbsp; &nbsp; &nbsp; //skip non-candidate events&nbsp; &nbsp; &nbsp; &nbsp; if(ice.candidate){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //match just the IP address&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var ip_regex = /([0-9]{1,3}(.[0-9]{1,3}){3})/&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //remove duplicates&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(ip_dups[ip_addr] === undefined)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; callback(ip_addr);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ip_dups[ip_addr] = true;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; };&nbsp; &nbsp; //create a bogus data channel&nbsp; &nbsp; pc.createDataChannel(&quot;&quot;);&nbsp; &nbsp; //create an offer sdp&nbsp; &nbsp; pc.createOffer(function(result){&nbsp; &nbsp; &nbsp; &nbsp; //trigger the stun server request&nbsp; &nbsp; &nbsp; &nbsp; pc.setLocalDescription(result, function(){}, function(){});&nbsp; &nbsp; }, function(){});}//Test: Print the IP addresses into the consolegetIPs(function(ip){console.log(ip);});The only extensions that block such requests are extensions that completely prohibit script execution, like NoScript for Firefox. Of course, there is also an option in the browser settings to disable scripts.<img src="https://cryptoworld.su/wp-content/uploads/2015/06/00424.jpg" alt="00424.jpg" class="fr-fic fr-dii fr-draggable " style="" />Click to rate this post!(c) <a href="https://cryptoworld.su/%D0%BA%D0%B0%D0%BA-%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B8%D1%82%D1%8C-webrtc-%D0%B2-%D0%B1%D1%80%D0%B0%D1%83%D0%B7%D0%B5%D1%80%D0%B5-firefox-%D0%B8-chrome/" target="_blank">https://cryptoworld.su/как-отключить-webrtc-в-браузере-firefox-и-chrome/</a></blockquote>

[QUOTE="Prime, post: 229, member: 18"] [B]Content[/B] 1. Brief information 2. Why is it not safe? 3. How to check 4. How to disable it 4.1 Firefox 4.2 Usage statistics. 4.3 Chrome/Chromium [B]WebRTC[/B] (Web Real-Time Communication) is an open source technology that allows streaming data between browsers using point — to-point (p2p) technology. WebRTC is built in by default in the latest versions of Firefox, Chrome/Chromium, and Opera, and allows you to connect between two or more browsers for video / audio calls and more. [HEADING=2]Why isn't it safe?[/HEADING] The fact is that for a p2p connection, you need to know the real IP address and WebRTC shamelessly merges this information. Even if you are sitting under [B]TOR[/B] / [B]VPN[/B], it will not be difficult to find out your local IP address on the network and on the side of, for example, a VPN server. And with the use of vulnerabilities, you can determine your real IP address, behind which you are hiding. [HEADING=2]How to check it[/HEADING] To check the local IP address, use the page: [URL]https://diafygi.github.io/webrtc-ips/[/URL] The JavaScript code and description are available on the following page: [URL]https://github.com/diafygi/webrtc-ips[/URL] To check whether the camera, audio, screen capture, etc. are enabled in the browser, follow the link: [URL]https://www.browserleaks.com/webrtc[/URL] [HEADING=2]How to disable it[/HEADING] [HEADING=3]Firefox[/HEADING] We call the hidden software settings about:configin the address bar, search for the parameter [B]media.peerconnection.enabled[/B], and set it to false. Code: [ad name=»Responbl»] In addition, you need to disable the following services:: [HEADING=3]Google Safe Browsing[/HEADING] Which merges your browsing history to Google. You need a warning that disabling Safe Browsing increases the risk of getting infected as a result of visiting a malicious site. Code: browser.safebrowsing.enabled browser.safebrowsing.downloads.enabled browser.safebrowsing.malware.enabled [HEADING=3]Firefox Statistics[/HEADING] Sends stability and performance reports to Mozilla. Code: datareporting.healthreport.service.enabled datareporting.healthreport.uploadEnabled [HEADING=3]Usage statistics.[/HEADING] Code: toolkit.telemetry.enabled [HEADING=3]Encrypted Media Extensions (DRM)[/HEADING] A binary plugin with unknown source code that comes with Firefox starting with version V. 38. Allows you to play encrypted media content and use Netflix, etc. without Microsoft Silverlight. To completely remove the plugin, you need to install the EME-free version of the Firefox browser. Code: media.eme.enabled media.gmp-eme-adobe.enabled [HEADING=3]Firefox Hello[/HEADING] Firefox connects to third-party servers (Telefonica) without permission. Code: loop.enabled [HEADING=3]Integration with Pocket[/HEADING] A third-party service for managing the list of articles that you have set aside for reading. Code: browser.pocket.enabled [HEADING=3]Geolocation[/HEADING] Code: geo.enabled [HEADING=3]Search suggestions[/HEADING] Everything typed in the search bar is sent to the search engine. If you disable this option, suggestions will continue to work, but only based on the local search history. Code: browser.search.suggest.enabled [HEADING=3]Protection from site surveillance[/HEADING] Unlike all the options listed above, you should enable this option instead. This is necessary to actively block sites that are known for their incorrect behavior in relation to tracking users. Not to be confused with DNT, which only "asks" sites not to track you. Here you can also apply a forced lock. Code: privacy.trackingprotection.enabled [HEADING=3]Chrome/Chromium[/HEADING] It is disabled only by installing a small extension (~10 kb): WebRTC Block, although the local IP address of the browser does not stop shining. Chromium and Firefox-based browsers support WebRTC technology for audio and video chats directly from the browser window. In addition to convenience, this feature has an unpleasant side effect. In particular, WebRTC allows sending requests to STUN servers that return the user's local and public IP addresses. Such requests can be made using a script, so IP addresses are displayed using JavaScript. Requests are sent bypassing the standard XMLHttpRequest procedure and are not visible from the developer console. You can't block them with plugins like AdBlockPlus or Ghostery. Thus, these queries can be used, for example, by advertisers to secretly track users. On this demo page, you will see your own local and external IP address. [IMG alt="003"]https://cryptoworld.su/wp-content/uploads/2015/06/00338.jpg[/IMG] This code works in Firefox and Chrome. You can copy it to the developer console for testing. Code: //get the IP addresses associated with an account function getIPs(callback){ var ip_dups = {}; //compatibility for firefox and chrome var RTCPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection; var mediaConstraints = { optional: [{RtpDataChannels: true}] }; //firefox already has a default stun server in about:config // media.peerconnection.default_iceservers = // [{"url": "stun:stun.services.mozilla.com"}] var servers = undefined; //add same stun server for chrome if(window.webkitRTCPeerConnection) servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]}; //construct a new RTCPeerConnection var pc = new RTCPeerConnection(servers, mediaConstraints); //listen for candidate events pc.onicecandidate = function(ice){ //skip non-candidate events if(ice.candidate){ veloper console for testing. Code: //get the IP addresses associated with an account function getIPs(callback){ var ip_dups = {}; //compatibility for firefox and chrome var RTCPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection; var mediaConstraints = { optional: [{RtpDataChannels: true}] }; //firefox already has a default stun server in about:config // media.peerconnection.default_iceservers = // [{"url": "stun:stun.services.mozilla.com"}] var servers = undefined; //add same stun server for chrome if(window.webkitRTCPeerConnection) servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]}; //construct a new RTCPeerConnection var pc = new RTCPeerConnection(servers, mediaConstraints); //listen for candidate events pc.onicecandidate = function(ice){ //skip non-candidate events if(ice.candidate){ //match just the IP address var ip_regex = /([0-9]{1,3}(.[0-9]{1,3}){3})/ var ip_addr = ip_regex.exec(ice.candidate.candidate)[1]; //remove duplicates if(ip_dups[ip_addr] === undefined) callback(ip_addr); ip_dups[ip_addr] = true; } }; //create a bogus data channel pc.createDataChannel(""); //create an offer sdp pc.createOffer(function(result){ //trigger the stun server request pc.setLocalDescription(result, function(){}, function(){}); }, function(){}); } //Test: Print the IP addresses into the console getIPs(function(ip){console.log(ip);}); The only extensions that block such requests are extensions that completely prohibit script execution, like NoScript for Firefox. Of course, there is also an option in the browser settings to disable scripts. [IMG alt="00424.jpg"]https://cryptoworld.su/wp-content/uploads/2015/06/00424.jpg[/IMG] Click to rate this post! (c) [URL='https://cryptoworld.su/%D0%BA%D0%B0%D0%BA-%D0%BE%D1%82%D0%BA%D0%BB%D1%8E%D1%87%D0%B8%D1%82%D1%8C-webrtc-%D0%B2-%D0%B1%D1%80%D0%B0%D1%83%D0%B7%D0%B5%D1%80%D0%B5-firefox-%D0%B8-chrome/']https://cryptoworld.su/как-отключить-webrtc-в-браузере-firefox-и-chrome/[/URL] [/QUOTE]

Name

Verification