This makes these types of requests available for online tracking if an advertiser sets up a STUN server with a wildcard domain.Įssentially, this means that any site could simply execute a few Javascript commands to obtain your real IP address through your web browser. These request results are available to javascript, so you can now obtain a users local and public IP addresses in javascript.Īdditionally, these STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery. (An explanation of the difference between your local/internal IP and your public/external IP is here.) The WebRTC VulnerabilityĪnyone seeking to be anonymous online through privacy technology should take action against WebRTC leaks.ĭaniel Roesler exposed this vulnerability in 2015 on his GitHub page, where he stated:įirefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. Note that a local IP address is blacked out on the left. You can see that my public IPv6 address (beginning with 2) is leaking in the WebRTC area, even while the VPN is connected and stable. Below is an example of WebRTC leaks that I found when testing out a VPN service. If you see your ISP-assigned (external) IP address, then this is a WebRTC leak. – In addition to WebRTC leaks, this website also tests for IPv4, IPv6, and DNS leaks.Our guide on testing your VPN lists a few different WebRTC testing tools: While the WebRTC feature may be useful for some users, it poses a threat to those using a VPN and seeking to maintain their online privacy without their IP address being exposed. If you have not protected yourself against WebRTC leaks in your browser, any website you visit could obtain your real (ISP-assigned) IP address through WebRTC STUN requests. This leak can de-anonymize you via WebRTC APIs, even if your VPN is working correctly. What is a WebRTC leak?Ī WebRTC leak is when your external (public) IP address is exposed via your browser’s WebRTC functionality. This basically allows for voice, video chat, and P2P sharing within the browser (real-time communication) without adding extra browser extensions. WebRTC stands for “Web Real-Time Communication”. WebRTC leaks can affect these browsers: Chrome, Firefox, Safari, Opera, Brave, and Chromium-based browsers. While the WebRTC issue is often discussed with VPN services, this is, in fact, a vulnerability with web browsers. (btw, I suspect WebRTC is used to sync the connection status of the application with the icon of the extension in the browser bar, so it's not malicious on the part of ExpressVPN, it's just an unfortunate consequence of the feature).When discussing online privacy and VPNs, the topic of WebRTC leaks and vulnerabilities frequently comes up. Just thought people with a specific setup like this (connecting to ExpressVPN via a proxy) might want to know. So essentially I have to uninstall it everywhere to avoid WebRTC leaks. Most people would only use the app to connect to the VPN, but I find sometimes it's not possible (some online gaming applications hate that for instance, they think you're sharing accounts when you do that), so I prefer in this case just browsing using a web proxy I have installed and connected to the VPN.īut the extension propagates everywhere where my Firefox account is connected (a feature of Firefox). To be clear, this isn't an issue if you connect to ExpressVPN via the desktop app (what the extension is meant for), but it's an issue if the app is disconnected (or not installed) and you connect to your VPN through a proxy on a different machine (or docker), while having the extension installed. The reason why this is not great is that WebRTC leaks your IP if you use a proxy to connect to a VPN. WebRTC is enabled back in about:config automatically even though the VPN is disabled re-install (or re-enable) extension (don't connect the VPN itself) uninstall (or disable) ExpressVPN extension

Mattermost webrtc docker ip issue