Show HN: Get your local and public IP addresses in JavaScript

[joshmn]

I use this exact method for fraud detection. 99% of the time, carders " " will simply load up a proxy in Firefox/Chrome (usually a socks5) and fire away. They typically don't tunnel their whole connection through the proxy, just their browser.

If their request IP doesn't match up with this IP, there's a very high chance that the order will is fraudulent.

[adrr]

Interesting. We check to see if Javascript timezone matches GeoIP and/or billing/shipping address. Also Canvas fingerprinting works well. Lastly measuring latency is another good one since you can't cheat the speed light.

[Torgo]

As much as I'm happy that you're able to detect fraudulent transactions, I am really disappointed that there's not a Content Security Policy rule to prevent WebRTC :-(

[vld]

edns-client-subnet (if present) can catch some frauds, too.

[huhtenberg]

That's clever, thanks. Implemented.

Another useful heuristic is to check if the client is coming in from a public Tor exit. YMMV depending on the nature of goods being sold, but in our case not a single legit purchase came in this way and nearly all fraudulent purchases were through Tor.

[sauere]

Not that i'm a expert. But i think only amateurs would be so foolish. Nearly all open proxys out there forward the clients real IP in the HTTP X-FORWARDED-FOR header.

[throwaway125]

This can be disabled in firefox's about:config page by setting media.peerconnection.enabled to false.

The problem with disabling all these features on a case by case basis is that you contribute to a richer fingerprint this way. Browsers will become increasingly more vulnerable to fingerprinting and there doesn't seem to be a way to stop it without going back to the dark ages of the web.

[13]

There really needs to be a writeup of all the Firefox defaults to change to make your browser actually secure. That's one I didn't know about. I think that your local IP is actually going to be very unique for some people, more so than just having this "feature" disabled.

[ChrisAntaki]

If you'd like an easier way to toggle this setting. https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

I wish Chrome would provide this setting too.

[userbinator]

I just disable JS by default and whitelist the (very few, currently) sites that absolutely need it.

That probably means I share the same fingerprint as everyone else using the same browser with JS disabled.

[mirimir]

Privacy at the browser level is hopeless! The answer is to compartmentalize. This VM and its convoluted Internet connectivity are pure Mirimir. I care not that the browser has been fingerprinted, that my IP has been logged, that evercookies have been placed, etc, etc, etc.

[trainbeeps]

If you use Chrome and a Tor SOCKS proxy, get ready for a big surprise.

Edit: owfffjaqvllmh4zi.onion reveals true IP addresses when using Chrome through Privoxy and Tor chain.

[jwise0]

That is an important piece of information, but viewers be advised: that page has a non-work-safe background and is NOT exactly a copy of the GitHub demo page (and has other obfuscated JavaScript running on it).

[hbbio]

This was already shown January 7th by:

http://jsfiddle.net/alokmenghrajani/0qo4kq7x/

[amenghra]

There are some interesting comments in the hackernews thread I started: https://news.ycombinator.com/item?id=8859350

[zobzu]

yeah it comes up regularly on HN actually.. ive seen it 3 or 4 times by now (different url/authors)

[mtmail]

"Additionally, these STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery. This makes these types of requests available for online tracking [...]"

So the extra effort to get around adblockers?

[hackcasual]

You can see it in: chrome://webrtc-internals/

[donatj]

Its particularly interesting in that it gets ALL my local ip addresses. This seems quite dangerous. Could they just start probing around my local network or does cross domain stuff kick in?

[doktrin]

I don't see how. WebRTC may leak your local IP, but that doesn't mean someone outside your local network can interact with it (without compromising a machine on said network).

[binwiederhier]

Holy cow. Browser devs seem to become crazier by the minute. Combine this with the lack of a same-origin policy in the JavaScript websocket API and you can really poke around in the local network.

[wereHamster]

Well, for websockets it's up to the server to check if the connection should be accepted or not. Same as in CORS whnere the server sais who is allowed to access the resources, not the browser.

[geofft]

There's no SOP in the JS websocket API because websockets are a newly-designed protocol specifically for the use case of being called from JS. If you have websocket servers on your local network (... although, why?) they know they should be checking origin.

[mattaustin]

This is the bug from goole about a year ago saying it is by design. https://code.google.com/p/chromium/issues/detail?id=333752

[The_Fox]

The demo reported 192.168.56.1 as a local IP. Now they know I have VirtualBox installed. I wonder what other IPs can leak information about common apps and network configs.

[droithomme]

The concept is useful, but the API with its need for all these asynchronous callbacks, really sucks donkey balls.

[benmorris]

This is pretty good timing. I got an email from Braintreepayments this week that I needed to implement some code changes for fraud detection and paypal before march. Upon integrating this code I noticed some odd data being sent back: https://www.braintreepayments.com/docs/ruby/general/fraud_to...

It turns out that this script must employ this techinque. After inspecting the requests in chrome Dev tools it appears all my private ips were being collected and sent over the wire back to Braintree (or whatever company is hosting their fraud detection).

[totony]

Does not work on Firefox Developer edition 37.0a2

media.peerconnection.enabled is set to true

EDIT: hbbio's jsfiddle works

[diafygi]

What is in in the about:config for "media.peerconnection.default_iceservers"? They could have removed the default STUN server.

[snake_plissken]

Is there a specific reason stun.services.mozilla.com cannot be pinged successfully? Is this by design?

Edit: Apparently it is by design; ICMP ECHOs are blocked by default on AWS instances, on which stun.services.mozilla.com [54.172.47.69] is running. http://aws.amazon.com/articles/1145?_encoding=UTF8&jiveRedir...

[desdiv]

Let's have a quick survey:

1. Are you currently using WebRTC in any projects?

2. Are you planning on using WebRTC in the future?

3. Do you think that WebRTC should be enabled by default in browsers?

[contingencies]

1. No / 2. No / 3. Yes, with explicit permission and warnings every time.

[daGrevis]

1. Yes, see https://github.com/daGrevis/hndrx

2. Obviously,

3. With explicit permit from user each time it's needed (like it's for webcam);

[josteink]

Fails in Firefox nightly with the following errors:

    This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] webrtc-ips
    TypeError: Not enough arguments to mozRTCPeerConnection.setLocalDescription.

Here's me hoping they're addressing these concerns already.

[szimek]

I've been using it for almost a year on sharedrop.io (p2p file transfer app) to distinguish peers in the same local network. The code I'm using for finding local IP comes from http://net.ipcalf.com. The app even allows you to select your local IP in case you got more than one, e.g. because of VPN.

[olalonde]

Wow, seems like a big privacy issue. Does this mean that VPNs soon won't be effective for masking your IP?

[The_Fox]

No. Your public IP has always been available to a Javascript developer who knows enough to write a one-line PHP script that prints $_SERVER['REMOTE_ADDR'] (as an example). This just makes it available via another protocol.

The new bit is that you can now get local IPs. But that doesn't help someone trying to figure out if you're using a VPN.

[nfriedly]

I set up http://ip.nfriedly.com/json?callback=foo a while ago - it's available if anyone is interested in a simpler version that also works for older browsers.

[madeofpalk]

When you're on the command line:

    curl ifconfig.me

[blueskin_]

Doesn't work for me, thankfully. The funny thing is, I have enough different privacy and security addons that I don't even know which one is protecting me here (best bet is possibly NoScript, even though I allowed scripts on that page).

[aikah]

I hope webrtc isn't authorized by default by browsers.I want to give explicit consent.It should even have been that way for ajax requests.

[ChrisAntaki]

You might be interested in NoScript. With this addon, JavaScript can be blocked by default, and allowed on pages of your choosing.

[slang800]

What makes AJAX requests dangerous?