Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [webrtc]

Web Real-Time Communication is an API definition drafted by the World Wide Web Consortium (W3C) created for browser-to-browser communication enabling audio, video and filesharing built directly into the browser.

Filter by
Sorted by
Tagged with
0 votes
1 answer
147 views

Does Google Meet leak my IP?

My friend asked me if it possible to get somebody's IP from Google Meet just by being in the same meeting. He found a video that says it is possible. But when I read about webRTC and STUN servers, I ...
user avatar
  • 1
0 votes
2 answers
218 views

Is WireGuard fixed IP address obtainable by LAN clients if VPN is running on the router? WebRTC/STUN risk?

WireGuard does not assign dynamic IP addresses, which may be a privacy risk. It is known that while WireGuard may offer advantages in terms of performance, by design it is not ideal for privacy, ...
user avatar
  • 3
0 votes
0 answers
189 views

WebRTC IP leak in 2021 [duplicate]

it's been a while since WebRTC was seen as a possible opportunity for IP leak when using a VPN. We're in 2021 today and I was wondering if there have been some improvements with this protocol in term ...
user avatar
  • 161
1 vote
1 answer
155 views

Am I exposed to WebRTC leaks if my IP resulting from WebRTC is the IP of my VPN server with the last digit augmented by one?

I am connecting to the website of ExpressVPN that checks for WebRTC IP leaks. My IP as resulting from that website is the same IP of the VPN server I am connected to but with the last digit augmented ...
user avatar
0 votes
0 answers
191 views

Why does my IP being leaked with system-wide proxy through webTRC, but it doesn't happen when I use system-wide VPN

WebRTC manages to leak my IP when I use proxy, but when I use VPN it only shows VPN server's IP (both proxy and VPN were system-wide). What's the key difference? Google Chrome was used in both tests (...
user avatar
0 votes
2 answers
384 views

Is the video/audio traffic from WebRTC TURN relay servers encrypted end-to-end? As with the applications Signal and Jitsi Meet

Today I found a video on YouTube that surprised me (https://www.youtube.com/watch?v=Pkc3sE6iKV4). It is by Rob Braxman, a privacy advocate with a lot of expertise. He talks about all kinds of video ...
user avatar
1 vote
0 answers
103 views

What, if anything, are the consequences of temporarily enabling and then disabling WebRTC in Firefox?

For security and privacy purposes, it's best to keep WebRTC disabled if you aren't using it. Firefox makes this easy by simply setting media.peerconnection.enabled to false. Due to COVID-19, the use ...
user avatar
0 votes
2 answers
184 views

Can Ed25519 be used to mitigate MITM attack on WebRTC with an untrusted signaling channel?

Based on this question, I've discovered that the signaling channel for WebRTC must be trusted in order to prevent MITM attacks. This is unfortunate for a P2P use-cases where the signaling channel is ...
user avatar
  • 101
1 vote
0 answers
134 views

Is the SDP a=crypto attribute relevant when DTLS-SRTP is used?

The a=crypto attribute in RFC 4568 has a separate section 9.2. for SRTP "Crypto" Attribute Grammar. What it basically includes is a list of attribute values required for encrypting media (...
user avatar
  • 261
1 vote
0 answers
53 views

Is public and local IP addresses of computer behind NAT a sensitive information? [duplicate]

So I'm playing with WebRTC and I've found that you can get public IP and local IP of other computer. Here is my code that show IP https://codepen.io/jcubic/pen/yvMeRg?editors=1010 (the code is used ...
user avatar
  • 209
0 votes
2 answers
3k views

Fortigate "WebRTC.Local.IP.Addresses.Disclosure" Event

We have a Fortigate perimeter firewall, and today I detected this event. What should I do to improve protection? How can someone obtain local IP address through a firewall? The following alert was ...
user avatar
  • 658
5 votes
1 answer
1k views

How to decrypt Diffie-Hellman encryption in WebRTC?

I have installed a WebRTC server application, which is designed for Contact Center solutions: communicates with internal PCs in pure RTP (agents), and with external PCs (customers) using encrypted ...
user avatar
12 votes
4 answers
3k views

What is the point of TURNS in WebRTC

WebRTC makes use of TURN-Servers if the direct peer to peer connection fails. There are two protocols available: TURN and TURNS (TURN over TLS). According to the MDN: All data transferred using ...
user avatar
1 vote
0 answers
108 views

Fooling live-video authentication [closed]

I don't know if this is a good site to ask this question but it's the best fit I've found so far. I've started signing up to cryptocurrency exchanges. Many of them require users to send digital ...
user avatar
  • 2,149
1 vote
1 answer
1k views

Android apps, does WebRTC IP-leak affect other apps than browsers (like youtube etc)

Does it matter if you're using a VPN do hide your ip on an Android phone when you use apps like youtube, facebook, or third party open source apps like NewPipe (youtube) or "Tinfoil for Twitter" or "...
user avatar
  • 11
4 votes
1 answer
2k views

WebRTC security & encryption

I am building a WebRTC application, and really concerned about security. I have read this quite interesting article : https://webrtc-security.github.io As I am far from being an expert in networking ...
user avatar
7 votes
1 answer
2k views

Why does WebRTC need the local IP?

This question Why is my internal IP address (private) visible from the Internet? highlights that the Local IP can be accessible from a website because WebRTC needs it. However it does not answer why ...
user avatar
  • 183
3 votes
1 answer
3k views

What information can be leaked via unencrypted STUN transmission?

I am brand new to WebRTC and am trying to wrap my head around what the STUN protocol exactly does and the risks of data leakage on an unencrypted transmission. From my understanding, the STUN ...
user avatar
  • 215
3 votes
1 answer
1k views

WebRTC shouldn't leak from a full, transport layer VPN ... right?

I have read and re-read the questions about webRTC leaks and have a good understanding as to how this works and why IP addresses are leaking from so-called "VPN tunnels". However, in all of those ...
user avatar
1 vote
0 answers
347 views

How is webrtc leaking IPs from behind a protocol agnostic, full VPN?

I am using the sshuttle VPN. It's NOT a browser plug-in or a simple proxy - it is a protocol agnostic, full VPN that sends all traffic out of any host you can ssh login to. It creates a bridge0 ...
user avatar
1 vote
1 answer
639 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
user avatar
  • 119
0 votes
1 answer
119 views

What could an attacker do with informations about devices in my local network?

If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it? Does it need to be in the same WIFI-Network in order to login to a service? (for ...
user avatar
  • 1
0 votes
2 answers
215 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
user avatar
1 vote
1 answer
4k views

How does WebRTC bypass a VPN Tunnel

While reading about WebRTC I was wondering how exactly the default route through an established VPN tunnel is being bypassed. If I'm not mistaken the VPN tunnel is normally represented in the system ...
user avatar
2 votes
1 answer
336 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
user avatar
2 votes
1 answer
615 views

Properly solving IP leaking from WebRTC and other apps with STUN when using a VPN

This is really a follow-up question from this: Stun scripts/webRTC IP leaks I'm connecting to a VPN using a virtual adapter, which has a default routing rule so all traffic goes through it. I still ...
user avatar
  • 121
2 votes
0 answers
797 views

SimpleWebRTC Server Side Authentication for Room Access

I am trying to do some sort of server side authentication to allow only specific clients to join a SimpleWebRTC Room. Right now, any client that goes to the SimpleWebRTC "demo" page can join the room....
user avatar
  • 121
4 votes
1 answer
990 views

Webrtc privacy issues?

I've been reading about WebRTC, and I'm interested in using it for a drawing web application that uses real-time collaboration. However, as I understand, WebRTC communication requires all parties ...
user avatar
  • 141
6 votes
2 answers
1k views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
user avatar
16 votes
3 answers
2k views

How secure is "Firefox Hello"? [closed]

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
user avatar
6 votes
1 answer
2k views

Is WebRTC still leaking my IP addresses in incognito or private browsing mode?

WebRTC can leak your private IP address, even though you are using a VPN, from what I learn here. Am I protected against this information leak affecting my privacy, when I'm using the incognito or ...
user avatar
  • 905
6 votes
1 answer
887 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
user avatar
7 votes
2 answers
1k views

Stun scripts/webRTC IP leaks

I've been looking at webRTC and stun scripts in general and their ability to bypass VPN's. And have a few questions I hope someone can help me with. 1) Since using openVPN and other VPN protocols/...
user avatar
1 vote
2 answers
1k views

How can MITM be performed in WebRTC?

From what I could tell, certificates are self-signed. When A wants to call B, after they finish relaying data to server, they initiate communication with each other. Certificates are self-signed, ...
user avatar
  • 21
1 vote
1 answer
414 views

Unexpected/unwanted/unknown participant joined WebRTC session

While running the simpleWebRTC example Step8 of the WebRTC codelab tutorial on my local computer 192.168.2.101 (in my own home private network), when someone (that I don't know) joined in (video + ...
user avatar
  • 161
13 votes
1 answer
7k views

What is WebRTC and how can I protect myself against leaking information that doesn't need to be shared?

What is WebRTC and what is it intended to be used for? According to this Browser Leaks Test for WebRTC and IP Leaks, I am currently leaking IP information for IP addresses that I do not believe ...
user avatar
  • 3,344