[HN Gopher] Apple's new Private Relay is leaking your original a...
___________________________________________________________________
Apple's new Private Relay is leaking your original address through
WebRTC
Author : rexbee
Score : 230 points
Date : 2021-08-28 16:05 UTC (6 hours ago)
(HTM) web link (old.reddit.com)
(TXT) w3m dump (old.reddit.com)
| sysadm1n wrote:
| This is why I have a VPN router. All traffic is VPN-ified to/from
| the wifi signal, and you don't have to risk having your real /
| naked IP exposed. You can even route another VPN over that VPN
| for a sort of fake Tor with no problems. Check out GL.iNEt
| routers: https://www.gl-inet.com/
|
| You can even get little travel routers that you can use when
| traveling. No affiliation, just pointing out something many don't
| even see as an option they have.
| collsni wrote:
| I do this too. I also use dns over tls for my VPN network. Non
| VPN network uses root hints. Two ssids one two different vlans.
| One VPN, one web.
| femiagbabiaka wrote:
| #ad
|
| you don't need specialized hardware to do this
| nathancahill wrote:
| No, but GL.iNet routers come with a 1-click solution. It's
| really handy, cheap and capable. Of course, you can install
| OpenWRT etc on any router as well. Just not quite as easy.
| Also no affiliation, but I love the little travel routers.
| eugeniub wrote:
| WebRTC has been having these problems for at least 6 years
| straight. At what point can we call this a deliberate back door?
| acdha wrote:
| When there's evidence that it's either deliberate or a back
| door? Those words have specific meanings and WebRTC doesn't fit
| that description.
| elliekelly wrote:
| I agree it's not a back door but if you've been put on notice
| of a serious security flaw then after a certain amount of
| time I do think your failure to take corrective action is
| "deliberate".
| crtasm wrote:
| Should at least warn you, "this site wants to use WebRTC,
| this will reveal your real IP address. OK?"
| acdha wrote:
| How serious is it, really? The vast majority of users will
| connect to a web server with their IP anyway so I'd assume
| it's more a question of weighting it behind other privacy
| improvements -- for example, ad blocking and tracker
| protection are probably making more of a difference for
| most people.
| cwizou wrote:
| Not terribly surprising as I believe WebRTC has been a known
| issue for leaking your IP for a long time with VPNs. With that
| said I confirmed it does indeed leak my IP on iPad. The
| surprising part is that Apple sidestepped the issue.
|
| Side note: tried to test it on my Mac but for some reason it
| wanted me to "upgrade" to iCloud+, despite being an Apple One
| customer. Guess that's because the macOS betas are fairly out of
| cycle compared to the iOS ones and (presumably) their infra.
| aaomidi wrote:
| After you press the upgrade button it realizes you have it and
| opens the gates.
| cwizou wrote:
| Thanks for the tip, tried a few times but no luck. I did use
| relay previously so could be a random bug.
| floatingatoll wrote:
| If you haven't tried it yet, quit all Apple apps, sign out
| of iCloud in System Preferences, reboot (do not skip this
| step), sign back in at System Preferences and see if that
| heals it.
| coldcode wrote:
| Can you turn it off, there are some options in the Develop menu
| in Safari regarding WebRTC. Not sure its enough though.
| mercacona wrote:
| You do need iCloud+, which is not included in Apple One despite
| the extra iCloud GB.
| bredren wrote:
| Huh? This is surprising to me. I was just about to
| consolidate to apple one.
| gjsman-1000 wrote:
| I _expect_ that for clarity 's sake this will be changed
| when iCloud+ officially launches.
| mercacona wrote:
| Some webs says it's included, but in Beta 1 wasn't and I
| didn't look further. It make sense it's just an update in
| the branding.
| djrogers wrote:
| No, it's included - there's just a beta glitch the first time
| (or two) you try to turn it on.
| echelon wrote:
| One outcome of the CSAM debacle is that security researchers will
| be poking lots of new holes in Apple.
| Grustaf wrote:
| What does this mean? Is this only relevant for users of WebRTC,
| whatever that is, or for everyone?
| easrng wrote:
| WebRTC is a JavaScript API, so this is relevant to anyone who
| uses the web. (Assuming, of course, they have JS enabled.)
| YLYvYkHeB2NRNT wrote:
| I just tested this on my android device with an always on VPN and
| kill switch that's on. Even the egress IP is not leaked - Only
| the local 10.x.x.x addresses are.
| lostmsu wrote:
| When you're not connected to WiFi you likely have a public IPv4
| from the mobile provider.
| TroisM wrote:
| Apple is a privacy nightmare... a bit like google is evil.
| firebaze wrote:
| "Private Relay".
| isatty wrote:
| What critical functionality/common website will I break by
| disabling webrtc on all my devices?
| Boltgolt wrote:
| Most video or audio calling sites for starters
| nceqs3 wrote:
| Icloud private relay is great. I really hope Apple expands it too
| all traffic and not just safari.
| vmladenov wrote:
| Do the extra hops introduce any noticeable latency for you when
| browsing?
| nceqs3 wrote:
| Not really. It's a bit slow but on mobile it doesn't really
| matter as I am not downloading huge amounts of data.
| Sean-Der wrote:
| You can do lots of suprising things with ICE in the browser. I
| was really excited to find[0]. Go to this[1] JSFiddle and type in
| `$hostname.local` or a device on your network. I have a
| `WDMyCloud.local` for example.
|
| I think you could make something really interesting. A web page
| could make a pretty unique fingerprint of you by all the
| IoT/Printers/$X devices on your network.
|
| [0] https://github.com/rtcweb-wg/mdns-ice-candidates/issues/121
|
| [1] https://jsfiddle.net/10eq2rzh/
| 1vuio0pswjnm7 wrote:
| Is it true that using WebRTC relies on Javascripts
| lallysingh wrote:
| Yes. It's a JS API.
| bonestamp2 wrote:
| So, I guess webrtc should be disabled by default and a site
| that tries to use it should trigger a permission prompt (like
| camera and microphone access).
| spyder wrote:
| uBlock Origin has an option to prevent local IP leak:
|
| "Prevent WebRTC from leaking local IP addresses"
|
| https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-
| from-l...
| the_duke wrote:
| I personally use Firefox and have WebRtc disabled
| (about:config => media.peerconnection.enabled: false).
|
| If I really need it I switch to Chromium.
| fsckboy wrote:
| offtopic: what's the non-routable TLD we're all supposed to be
| using now instead of .local? was it .lan? I tried googling with
| ddg:) but it's a noisy search
| ComputerGuru wrote:
| This was just discussed [0] last week, actually! The tl;dr is
| that there's no great alternative to registering an actual
| domain name and using it (or a subdomain of it) for your
| network. The only viable TLD otherwise is .arpa
|
| [0]: https://news.ycombinator.com/item?id=28192247
| thetinguy wrote:
| .Home.arpa not just .arpa
| ComputerGuru wrote:
| Thanks for the correction.
| ace2358 wrote:
| Isn't it a double address like .home.lan or some such?
| PNWChris wrote:
| Yup! If you want something that just works (no need to
| prefix with http[s] in your browser's omnibar, works with
| Apple devices, etc), `.home.arpa`[0] is the canonical
| option.
|
| A somewhat on topic tangent:
|
| I did a fair amount of tinkering with this after finding my
| manually defined `.local` dns entries wouldn't work with
| Apple devices. Apple devices see such addresses as reserved
| for mDNS and will only look them up via mDNS.
|
| To get everything working on my network, I ended up going
| down the rabbit hole of local DNS naming schemes. In the
| end I found I prefer the look and feel of `.lan`, so I live
| on the edge and make my custom DNS entries using that.
|
| Some browsers think I'm searching for stuff when I type
| "hostname.lan", but prefixing with http:// fixes that.
| Wherever I can I try to set up mDNS, though, since it just
| works and doesn't require any central administration.
| Sadly, not all devices are customizable enough for me to
| use mDNS everywhere.
|
| [0]: https://serverfault.com/a/1041148
| thedougd wrote:
| .home.arpa
| bluejekyll wrote:
| see: https://datatracker.ietf.org/doc/html/rfc6761
|
| And .local. is specified in multicast-dns:
| https://datatracker.ietf.org/doc/html/rfc6762
| makeworld wrote:
| What's wrong with .local?
| neilalexander wrote:
| It is reserved for use with Multicast DNS specifically.
| viktorcode wrote:
| Correct me if I'm wrong, but isn't it stated in the description
| that private relay works only with http(s) transport protocol in
| Safari? WebRTC doesn't get through the tunnel by design.
___________________________________________________________________
(page generated 2021-08-28 23:02 UTC)