[tor-talk] WebRTC to uncover local IP

[l.m]

spencerone at openmailbox.org wrote:
>Understanding very little about WebRTC and STUN servers, what does
this 
>mean for people?

It means:
1) The network configuration of linux is more secure than the network 
configuration of windows. Even when using a VPN. Unless the VPN drops 
(and leaks).
2) If you're using a browser without some control over  how javascript
is used you'll encounter web bugs. Some of which might  make your VPN
service useless from the perspective of hiding your ISP  address.
3) For some reason Chrome is only able to succeed in using  UDP for
STUN. Meaning, if I understand correctly, that if you point a  Chrome
install to Tor via socks the STUN fails and doesn't leak. If  that's
any consolation...
4) Even if you restrict javascript use you  still need to worry about
the adversary who poisons your DNS cache. Such  an adversary can pose
as a whitelisted domain and force your ISP  address to leak.

So, the take home message:
1) Windows isn't a privacy oriented OS, and should be avoided if
possible. If you're not using windows you're already set.
2)  Irregardless of the OS you should be using extensions/addons to
control  how javascript gets used. Noscript/ScriptSafe for example. 
Alternatively disable the web bug using WebRTC Block (Chrome), or 
media.peerconnection.enable (FF). If you're using Tor Browser you're 
already set.
3) Consider using secure DNS methods (dnscrypt for  example) for your
non-torified browsers where you've opted to leave  webrtc enabled and
instead restrict the use of javascript.

-- leeroy