Epic Privacy Browser Forums

Tyler

Guest

WebRTC

First of all, media device enumeration works only in Chromium-based web browsers since Chrome 30 or later.

Device ID's — it's a unique identifiers of an audio/video devices installed in your system. Even if you have no microphone/webcam, Chrome may detect more than one device, such as «Line In», «Aux», «CD Player», etc, depending on the system drivers.

Full list of available media devices you can check in «chrome://settings/content ⇒ Media»

Of course, Google Chrome does not allow foreign websites to see the actual Model ID of your hardware devices, instead it provides self-generated hashes. But at the same time, any website is allowed to take this fingerprints without user confirmation.

How persistent and trackable these Device ID's?

Well, for most users this ID's may remain unchanged for months.

WebRTC Device ID is a HMAC of:

Value of the "media":{"device_id_salt"} located in «Chrome\Data\profile\Preferences». Salt generates randomly at the Chrome's first launch. It's renew every time user doing «Clear browsing data ⇒ Cookies and other site and plug-in data». Also, Incognito Mode does not touch «device_id_salt», but generates its own salt for every session.

Origin, aka «protocol://hostname:port». This dependence is not a problem for user tracking, script can be requested from constant host through iframe, and it will be same origin and same Device ID's on any domains.

Raw Device ID of the physical device installed in your system.

http://www.browserleaks.com/webrtc

alok

Administrator

Re: WebRTC

Thanks for the details...you're right, this is a significant privacy issue.  We'll check into this immediately.  We'd like to make WebRTC enable-able via notification.  It may be best though to totally disable it.  We'll investigate.

dickcornflour

Guest

Re: WebRTC

I just wanted to add a bit about this issue.  Thanks for working on it, and I hope you soon find a solution.

According to the web site ipleak.net, Epic Privacy Browser leaks WebRTC requests, thereby revealing the user's IP address, even when the user has invoked the browser's built-in proxy server.  Needless to say, this is an obvious security problem.  Although I haven't used it, there is a Chrome extension built to address this issue.  It's called "WebRTC Block," and it's available at the Chrome store here https://chrome.google.com/webstore/deta … cadhfbkdm.

Could the WebRTC Block extension be adapted for users of the Epic Privacy Browser?

Thanks again for your help.

dickcornflour

Guest

Re: WebRTC

The WebRTC leak problem is well described in a "lifehacker" post published today, February 11, 2015.

Here's a link.

http://lifehacker.com/how-to-see-if-you … 1685180082

sathi

Administrator

Re: WebRTC

Hi dickcornflour,

Thaks for sharing the link. We are looking into this issue.

dlw1412

Guest

Re: WebRTC

I also went to the link and Epic is leaking my real IP Number. A few proxy extensions from Google work better than Epic. I don't trust this (Epic) anymore.

patrick_ooten

Guest

Re: WebRTC

LOL ... i hear crickets! Talk about "Epic" fail!

dlw1412

Guest

Re: WebRTC

Epic is still leaking my real IP # on the WebRTC site! Will this be fixed ,,or should i just uninstall Epic?

dlw1412

Guest

Re: WebRTC

Hello ,,,,, Anybody !?!?!

sathi

Administrator

Re: WebRTC

Hi dlw1412,

Thanks for the post. We are working on stopping the leaks through webrtc. We will come with an update very soon.

baak_nl

Guest

Re: WebRTC

Hi Sathi,

Any updates on this topic? When can we expect a webRTC leak free version?

Thanks.

sathi

Administrator

Re: WebRTC

Hi baak_nl,

We are working on a solution, we are almost there. We will come with an update a.s.a.p !!

madolva

Guest

Re: WebRTC

this product seems to block webrtc for me.
using https://diafygi.github.io/webrtc-ips/ to test.
It's the only chrome-based solution that has so far.

baak_nl

Guest

Re: WebRTC

Hi Epic,

What is the status on the WebRTC leak?

Thanks,
baak

Hi baak_nl,

We are working on a solution, we are almost there. We will come with an update a.s.a.p !!

madolva

Guest

Re: WebRTC

At one time it passed the test, but it sure isn't now?
What's wrong with google, to put this in without a way to disable it.

alok

Administrator

Re: WebRTC

WebRTC calls are all blocked. 

Sorry for the late update to this thread.  We tried for awhile to have a notification come up so users could manually activate WebRTC but that was difficult and buggy hence we eventually just blocked all WebRTC calls.  Looks like it's working fine as on this test, the IPs are blank:

https://diafygi.github.io/webrtc-ips/

thanks @madolva

victor03303

Guest

Re: WebRTC

Hi

When I visit ipleak.net
My ip is still visible

alok_epicteam

Administrator

Re: WebRTC

It may be plugins leaking your IP address.  For maximum protection, in Epic's settings set plugins to click to play or disable them.