WebRTC webinar explaining what was all the hype around IP address privacy in WebRTC, what are the risks and how WebRTC is handling them. Webinar also talks about WebRTC browser interoperability and specifically interoperability with Microsoft Edge. Webinar is part of the monthly WebRTC live Q&A sessions by Alex Gouailard, Dan Burnett and Amir Zmora

1. WebRTC Standards &
Implementation Q&A
Amir
Zmora
TheNewDialTone
Dan
Burne3
StandardsPlay
Alex
Gouaillard
WebRTC
by
Dr
Alex
/
Citrix

2. Watch video recording of this session
http://ccst.io/e/webrtcstandards6

3. Session sponsored by
WebRTC.ventures
is
a
custom
design
and
development
shop
dedicated
to
building
WebRTC
based
applicaFons
for
web
and
mobile.
We
have
built
end-­‐to-­‐end
broadcast
soluFons
for
events
and
entertainment
clients,
telehealth
soluFons
for
mulFple
clients,
live
support
tools,
as
well
as
communicaFon
tools
for
a
variety
of
other
applicaFons.
WebRTC.ventures
is
a
recognized
development
partner
of
TokBox
and
has
also
built
naFve
WebRTC
soluFons

4. Session sponsored by
Blacc
Spot
Media
is
comprised
of
a
collaboraFve
team
of
designers,
developers
and
thought
leaders
specializing
in
Web-­‐Real
Time
CommunicaFons
(WebRTC).
Blacc
Spot
Media
was
founded
in
April
2011
with
the
goal
of
creaFng
innovaFve
soluFons
using
new
technologies
such
as
WebRTC.
Our
team
works
on
strategic
projects
developing
custom
applicaFons,
enterprise
plaTorms
and
mobile
applicaFons
for
a
wide
array
of
clients.

5. We use CrowdCast….It’s WebRTC

6. WebRTCStandards.info
Sponsored by

7. About Us
• Amir Zmora • Dan Burnett • Alex Gouaillard

8. Save The Date: August 17
Register Now: http://ccst.io/e/webrtcstandards7
Next Session

9. On The Agenda:
IP Address Privacy in WebRTC
Interoperability with Microsoft Edge (several
posts on the topic: https://thenewdialtone.com/tag/edge/)

10. IP Address Privacy in WebRTC

11. Became a Hot Topic Last Year

12. What is Really Exposed?
Only
addresses
visible
to
STUN
server(s)

13. The Risks
• Local Address
• can reveal internal network structure
• can be used for fingerprinting
• Public Address
• any unencrypted path to a STUN server provides an address
• all such addresses are available to all applications in all browsers
• this is a problem for VPN users if not all traffic goes over the VPN

14. draft-ietf-rtcweb-ip-handling-01
• This draft is out of date, but it's almost right. It says
• Revelation of local and public addresses is not new – both HTTP and Flash can be used
to do this
• Revelation of local network topology can be addressed via network config and controls,
so not critical to address
• For VPN users expecting IP address anonymity, however, this is a problem, so
• WebRTC should "provide a privacy-friendly default behavior" and "provide a means to
customize" the behavior

15. draft-ietf-rtcweb-ip-handling-01 (cont.)
• Recommended default behavior for the "drive-by web":
• Browser will identify the default route (the route used by normal HTTP traffic)
• It will use only that route for STUN traffic
• It will only reveal the local address associated with that route/interface
• Recommended behavior once camera & mic permission have been given:
• WebRTC will bind to and use all available addresses, all routes
• This will reveal everything
• In short, giving camera and mic access also gives full IP address access

16. Discussion of the draft at IETF 95 (April)
• Slides and Minutes available at https://www.ietf.org/proceedings/95/rtcweb.html
• Important points
• Browser vendors agree that no pop-up dialog can sufficiently explain the issues to users for
them to be considered 'informed' when they give consent.
• There is unease with draft's attempt to justify treating media permission as location permission.
• And yet, Google says that this change has resulted in way fewer "drive-by" address captures.
• Action items/decisions
• Reword the draft to indicate that the full IP address disclosure should only occur after some
direct interaction with the user and not say precisely what the dialog is for that interaction.
• There is interest in this document becoming normative.

17. Microsoft Edge Interoperability

18. Microsoft Edge Interoperability
• What
is
the
challenge?
How
different
from,
say
Firefox
and
Chrome
interoperability?
• Automated
(interop)
TesFng?
• Global
interop
status?
• What’s
next?

19. Microsoft Edge Interoperability
• Chrome
<=>
Firefox
interoperability
• on
the
wire:
IETF
specs
• Signaling:
JSEP,
SDP,
OA
• JS:
webRTC
1.0
• [Cr|Fr]
<=>
Edge
interoperability
• on
the
wire:
IETF
specs
• Signaling:
none
• JS:
ORTC

20. Microsoft Edge Interoperability
• Automated
TesFng
• All
browsers
have
theirs,
but
interop
…
• Automated
interop
TesFng
• Sponsored
by
IMTC
(includes
MS)
• Coded
(mostly)
by
Fippo
• Available
for
free
on
github
• Gaps
addressed
• ORTC
to
webRTC
shim
!
• JSEP,
SDP,
OA
implemented
for
Edge
in
JS

21. Microsoft Edge Interoperability
• Automated
Interop
TesFng:
current
scope
and
focus
• 1-­‐1
case
(mulFcast
not
ready)
• H.264
and
video
in
general
(audio
is
no
issue)
• Several
video
interop
tests
• Downgrade
A/V
to
audio
only
and
back.
• AutomaFon
of
different
browsers,
different
OSes
cases

22. Interop Tests (Win10)
Dev Nightly
IMTC
IMTC
IMTC
Dr.
Alex
Gouaillard
@
Citrix
Systems,
2016.
Document
provided
under
CC
BY-­‐NC
4.0

23. ©
Dr.
Alex
Gouaillard
@
Citrix
Systems,
2016.
Document
provided
under
CC
BY-­‐NC
4.0
What we ACTUALLY test
today
6
5%
21
18%
88
77%
Tested
WIP
Not
tested

24. Microsoft Edge Interoperability
• Global
status
• AutomaFon
works
–
not
fully
stable
• Interop
almost
there
(80%+)
• The
effort
found
mulFple
bugs
that
are
being
worked
on
• H.264
bistream
issues
on
Edge
side
(Cr
ffmpeg)
• Logging
too
limited
in
current
tests

25. Microsoft Edge Interoperability
• What’s
next
(once
1-­‐1
is
stable)
• WaiFng
for
simulcast
to
be
ready
to
test
it
• Bandwidth
congesFon
and
ramping
spec
issue
• Signaling
issue
• Unified
plan
in
Cr
• Improve
logging
or
port
appRTC
to
Edge
• Add
browser
support
–
IE
• Add
a
SIP
interop
test
case.

26. ?

27. Save The Date: August 17
Register Now: http://ccst.io/e/webrtcstandards7
Next Session

28. Session sponsored by
WebRTC.ventures
is
a
custom
design
and
development
shop
dedicated
to
building
WebRTC
based
applicaFons
for
web
and
mobile.
We
have
built
end-­‐to-­‐end
broadcast
soluFons
for
events
and
entertainment
clients,
telehealth
soluFons
for
mulFple
clients,
live
support
tools,
as
well
as
communicaFon
tools
for
a
variety
of
other
applicaFons.
WebRTC.ventures
is
a
recognized
development
partner
of
TokBox
and
has
also
built
naFve
WebRTC
soluFons

29. Session sponsored by
Blacc
Spot
Media
is
comprised
of
a
collaboraFve
team
of
designers,
developers
and
thought
leaders
specializing
in
Web-­‐Real
Time
CommunicaFons
(WebRTC).
Blacc
Spot
Media
was
founded
in
April
2011
with
the
goal
of
creaFng
innovaFve
soluFons
using
new
technologies
such
as
WebRTC.
Our
team
works
on
strategic
projects
developing
custom
applicaFons,
enterprise
plaTorms
and
mobile
applicaFons
for
a
wide
array
of
clients.

30. Thank You
Amir
Zmora
TheNewDialTone
Dan
Burne3
StandardsPlay
Alex
Gouaillard
WebRTC
by
Dr
Alex