The law of unintended effects appears to have been used to WebRTC because one little attribute that is useful could be turned into an ideal user tracker.
The Internet runs on IP4 and to make it work we have to use NAT, or Network Address Translation. Virtually all internal networks use local or private IP addresses that can’t be utilized on the public web. A machine uses a public IP address it shares with other machines when it needs to make a connection to the public net. The machine’s identity is saved as the port number – efficiently raising the variety of IP address in use by 16 more address bits. One public IP address can therefore function around 216 users that are local.

Many ISPs make use of a dynamic allocation of public IP addresses to users. That means you may not get the exact same public IP address whenever you connect to the net.

NAT is an inventive alternative that has enabled IP4 to continue being workable nicely into an age where IP6, with its enormous address space, should be an essential upgrade. Provided that you do not need to support incoming links, or if you do, you could use port forwarding, then NAT is connectivity that is as much as you need.

In addition, it supplies an excellent measure of anonymity.

When you connect to a site, say, all the web site gets is the port number to be utilized to send the data back to you personally as well as your IP address. Given that the IP address could be shared with users that are lots of it’s not much use in tracking your browsing.

Place just a web site can not understand it’s you the next time because these are mapped to local IP addresses, which transform a request from the same IP address and port number turns up.

This is actually the main reason the urban myth that your public IP address identifies you is only that – a myth. Obviously, your ISP can log the sites you connect to because the ISP accounts for issuing a public IP address to you and, if a NAT, an allocated port number runs. The ISP can not log which user on the local network is seeing what, however, in case your local network attaches via its own NAT.

While it may not be accurate that for most users they are identified by a public IP address, it’s almost always true a local IP address is an identifier. That do not alter frequently so it’s alarming to find that there’s quite a simple method for a web site to detect your local IP address.

Daniel Roesler is not the first to discover this, but he’s put together a fine demo of the mechanism in activity on GitHub.

WebRTC is a peer to peer communications protocol which makes it super easy for just two browsers to set up video or voice communications without needing an intermediate server. As you may imagine this occasionally wants knowledge of the public and local IP address of a machine.

STUN – (Session Traversal Utilities for Nat) is a protocol that enables a machine to find its IP address that is public, even if it’s behind a NAT. All that occurs is that the machine and the STUN server send a UDP packet and a reply packet including the public IP address, respectively. It’s very straightforward and Firefox has a default STUN server that could even be properly used by Chrome.

Now, nevertheless, we’ve got a WebRTC mechanism that is not difficult to utilize in JavaScript which will find the local and public IP address utilizing the default servers. This does not use the common Ajax XMLHttpRequest and by solitude addins and is not blocked now does not show in the developer console. In addition the WebRTC facilities are turned on by default right now.