EFForg / EFForg/privacybadger

identify misbehaving origins by webrtc data channel misuse

Open
#2,102 6 comments 0 reactions 0 assignees View on GitHub
enhancement heuristic
Dominant language
JavaScript
Stars
3.8k
Forks
435
Avg merge
49m
Merged PRs (30d)
1

Description

@wseltzer and i were in the rtcweb discussion at IETF today, and there are several ways that webrtc can be used to gain additional private information about users, or to link concurrent private sessions.

for example, opening a webrtc data channel, collecting the ICE connection candidate IP addresses, and then closing the data channel.

It would be great if privacy badger were to detect this kind of misbehavior from an origin, and use it to identify the origin as something worth blocking.

(i did a skim of the codebase and the Changelog and didn't see anything like this, but maybe PB is already doing this. if so, feel free to close this report, thanks!)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the codebase and Changelog for existing WebRTC or ICE-candidate handling; the issue names no specific file, entry point, or test. Establish a concrete detection scope and testable criteria for identifying origins that open a data channel, collect candidate IPs, and close it.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.