identify misbehaving origins by webrtc data channel misuse
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 435
- Avg merge
- 49m
- Merged PRs (30d)
- 1
Description
@wseltzer and i were in the rtcweb discussion at IETF today, and there are several ways that webrtc can be used to gain additional private information about users, or to link concurrent private sessions.
for example, opening a webrtc data channel, collecting the ICE connection candidate IP addresses, and then closing the data channel.
It would be great if privacy badger were to detect this kind of misbehavior from an origin, and use it to identify the origin as something worth blocking.
(i did a skim of the codebase and the Changelog and didn't see anything like this, but maybe PB is already doing this. if so, feel free to close this report, thanks!)
Contributor guide
Research direction
Start by reviewing the codebase and Changelog for existing WebRTC or ICE-candidate handling; the issue names no specific file, entry point, or test. Establish a concrete detection scope and testable criteria for identifying origins that open a data channel, collect candidate IPs, and close it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100