WebRTC media devices
-
Hey,
I trust Vivaldi a lot and use it as my daily power tool.
Today I turned off the "Broadcast IP for best WebRTC" setting.
To verify i went on https://browserleaks.com/webrtc and yes, the IP is not being published anymore.
But something else really annoys me. On the same webpage is a "Media Devices" row.
And here are all the connected devices (input / output / camera) and their drivers, IDs, names and so on.
Even when turned that WebRTC setting of. This information has the potential to identify us.I would like to propose a switch / setting to turn that (behavior of WebRTC) off. That would be great.
-
@pamal0sebi For "media devices" check "Settings/Webpages - Default Permissions".
Also, https://help.vivaldi.com/desktop/privacy/website-permissions/
-
@tbgbe Thank you for your answer and it is a good idea. Nevertheless, these restrictions do not apply for WebRTC.
I saw this post:
Device ID's – it's a unique identifiers of an audio/video devices installed in your system. Even if you have no camera/microphone, Chrome may detect more than one device, such as «Line In», «Aux», «CD Player», etc, depending on the system drivers.
Full list of available media devices you can check in «chrome://settings/content ⇒ Media»
Of course, Google Chrome does not allow foreign websites to see the actual Model ID of your hardware devices, instead it provides self-generated hashes. But at the same time, any website is allowed to take this fingerprints without user confirmation.
How persistent and trackable these Device ID's?
Well, for most users this ID's may remain unchanged for months.
WebRTC Device ID is a HMAC of:
-
Value of the "media":{"device_id_salt"} located in «Chrome\Data\profile\Preferences». Salt generates randomly at the Chrome's first launch. It's renew every time user doing «Clear browsing data ⇒ Cookies and other site and plug-in data». Also, Incognito Mode does not touch «device_id_salt», but generates its own salt for every session.
-
Origin, aka «protocol://hostname:port». This dependence is not a problem for user tracking, script can be requested from constant host through iframe, and it will be same origin and same Device ID's on any domains.
-
Raw Device ID of the physical device installed in your system.
So, WebRTC Device Fingerprints persistent to:
- Changing ISP, IP address.
- Restarting browser, rebooting system.
- Clearing cookies and cache through third-party addons like EditThisCookie or CCleaner.
WebRTC Device Fingerprints not persistent to:
- Clearing cookies through «chrome://settings/clearBrowserData».
- Using new session of Incognito mode.
So, I still think that's pretty bad.
For comparison I wanted to check that with the Brave Browser, just to see what they did with that "issue".
And they don't return the "label" and "deviceId" at all by default. Also they give you a more deeper choice of what WebRTC / IP policy you want to use.Wouldn't that be a nice thing in Vivaldi?
-
-
@tbgbe said in WebRTC media devices:
@pamal0sebi For "media devices" check "Settings/Webpages - Default Permissions".
There is no heading called Default Permissions in Preferences > Webpages. There are a number of other settings there, but not that.
-
@pamal0sebi said in WebRTC media devices:
Hey,
I trust Vivaldi a lot and use it as my daily power tool.
Today I turned off the "Broadcast IP for best WebRTC" setting.
To verify i went on https://browserleaks.com/webrtc and yes, the IP is not being published anymore.
But something else really annoys me. On the same webpage is a "Media Devices" row.
And here are all the connected devices (input / output / camera) and their drivers, IDs, names and so on.
Even when turned that WebRTC setting of. This information has the potential to identify us.I would like to propose a switch / setting to turn that (behavior of WebRTC) off. That would be great.
Under Preferences > Privacy, the checkbox for "Broadcast IP for best webRTC performance" is checked. If I uncheck it, the next time I load the browser, it is checked again. To stop being traced by webRTC, I got the extension Trace.
The line for "Media Devices" in browserleaks for me has only n/a.
-
@streptococcus said in WebRTC media devices:
There is no heading called Default Permissions in Preferences > Webpages.
That's what happens when you revive "old threads".
The "Default Permissions" is now under Settings/Privacy.the checkbox for "Broadcast IP for best webRTC performance" is checked. If I uncheck it, the next time I load the browser, it is checked again.
This happens when you have the WebRTC setting controlled by extension(s). The extension "activates" it in the browser so that it is then controlled by the extension.
If you disable control in the extension, then the Vivaldi setting is in control.
-
@tbgbe
I use Trace, which is supposed to be blocking WebRTC from sending out information. -
Ppafflick moved this topic from Culture on -
Ppafflick moved this topic from Security & Privacy on
