[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #16669 [Website]: check.torproject.org should have WebRTC IPv4 and IPv6 address leak detection to protect Orbot VPN users
#16669: check.torproject.org should have WebRTC IPv4 and IPv6 address leak
detection to protect Orbot VPN users
---------------------+---------------------------
Reporter: diafygi | Owner: Sebastian
Type: defect | Status: new
Priority: major | Milestone:
Component: Website | Version:
Keywords: | Actual Points:
Parent ID: | Points:
---------------------+---------------------------
Orbot for Android offers an option to use Tor as a VPN. This is great
because Orweb is End-of-Life, and other browsers don't allow configuring
proxies and the VPN feature also tunnels traffic for apps through Tor.
However, the Android's VPN feature doesn't hide the IP addresses from
WebRTC's STUN requests. This means that Orbot users will still leak their
IP addresses when using the VPN feature and using a browser with WebRTC
capabilities.
Here's the proof-of-concept I wrote to detect IP addresses via WebRTC.
Please include this test code in your https://check.torproject.org/
website, so that users who are stuck using regular browsers on Android can
know about the IP address leak.
https://github.com/diafygi/webrtc-ips
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16669>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs