search

ghostwords / chameleon

Browser fingerprinting protection for everybody.
Mozilla Public License 2.0
532 stars 61 forks source link

WebRTC #14

Open Patryk-S-W opened 9 years ago

Patryk-S-W commented 9 years ago

WebRTC can checking your local IP, u can add to Chameleon switch to disabling WebRTC?

https://www.browserleaks.com

ghostwords commented 9 years ago

I just added detection of WebRTC initialization. This should help me find use of WebRTC by fingerprinters in the wild, using Chameleon Crawler. Once I have some samples, I will try to improve detection to judge whether WebRTC is specifically being used for fingerprinting.

In the meantime, you can can disable WebRTC in Chrome with the WebRTC Block extension.

ghostwords commented 9 years ago

Note that Browser Leaks' WebRTC page breaks with Chameleon enabled. The page detects the webkit-prefixed WebRTC API, assumes a Chrome user agent string will be present, and tries to parse out Chrome's version number, but the parsing fails since Chameleon replaced Chrome's user agent string by that of Firefox.

This will be resolved when Chameleon stops masquerading as Tor and starts (intelligently) randomizing browser attributes instead: #1.

gunesacar commented 9 years ago

I tried this demo: https://diafygi.github.io/webrtc-ips/ This time the demo works but Chameleon fails to detect WebRTC initialization (or I miss something). I'm using Chameleon 0.7.0, Chromium 40.0.2214.111 and Ubuntu.

ghostwords commented 9 years ago

I believe that's #5. WebRTC initialization on that demo page is done inside an internal (to the page) script tag, which executes before Chameleon's overrides.

gunesacar commented 9 years ago

Indeed! When I put the script into a separate file, Chameleon detects webkitRTCPeerConnection. Thanks!

ghostwords commented 9 years ago

The injected script race condition should be resolved in the master branch, so inline scripts should now always get processed same as external scripts.

gunesacar commented 9 years ago

WebRTC demo page linked above is now being detected by Chameleon. Thanks for the great work!

ghostwords commented 9 years ago

You're welcome!

ghostwords commented 9 years ago

Relevant: EFForg/privacybadgerfirefox/issues/394