How to protect yourself from showing your real IP with WebRTC?
WebRTC allows for video and audio streaming directly inside a web browser with the need for any cumbersome plugins to be installed in the browser.
This is great, however there is an unfortunate side-effect to this and it is the risk of our real IP leaking through your browser and destroying the anonymity you gain with using proxies. Please understand that this is not ActProxy’s proxy servers leaking your real IP, it is your local web browser. We’ve tested many services with our proxies and we have found that the issue is present in Windows and to a lesser extent on Android, Linux, and OS X. We’ve also been able to reproduce the issue on iOS.
To check if you’re leaking your real IP you can go here or here. With the first option, if you have disabled WebRTC or your browser does not support it, no IP addresses should show up under Your local IP addresses: or Your public IP addresses:. The second option should be fairly self explanatory.
Please keep in mind that disabling WebRTC of course will lead to WebRTC applications not working. Therefore you might want to re-enable it when you're not using proxies.
If you find out that your browser is in fact leaking your real IP don’t panic, you have options now. Please continue reading for the fixes.
You can read more about WebRTC here.
Fixes
Andriod Browser
Newer versions seem to implement WebRTC. Use Firefox or Chrome instead.Chrome on Android
To disable
Enter "chrome://flags/#disable-webrtc" in the address bar and press enter
Press "Enable" under that option
Reboot your phone
To enableEnter "chrome://flags/#disable-webrtc" in the address bar and press enter
Press "Disable" under that option
Reboot your phone
Chrome on iOSChrome on iOS does not seem to implement the vulnerable parts of WebRTC yet.
Chrome
1. The uBlock Origin browser extension is also available for Chrome and works for Opera as well (see below).
2. Google offers an official extension which we’ve tested and works quite well. It is the WebRTC Network Limiter browser extension which prevents IP leaks without fully disabling WebRTC so you can still enjoy WebRTC enabled content.
3. In Android you can manually disable WebRTC in Chrome using the following method:
Type chrome://flags/#disable-webrtc into the search bar
Firefox
You have a couple options with this powerful browser.
1. The simplest solution to the problem is to just disable WebRTC. In Firefox can be easily done manually in the advanced settings:
a) Type ‘about:config’ into the URL bar (and click through ‘I’ll be careful I promise!’)
b) Search for ‘media.peerconnection.enabled’
c) Double-click on the entry to change the Value to ‘false’
This method also works in mobile versions of Firefox (Android/iOS)
2. Install the Disable WebRTC add-on. The uBlock Origin browser extension also prevent WebRTC from leaking your local IP address on the desktop (all of these add-ons also on mobile versions of Firefox.)
In uBlock Origin go to Menu -> Add-ons -> uBlock Origin -> Options -> Show Dashboard to disable WebRTC
Note that the Tor Browser (which is based on Firefox) disables WebRTC by default.
Opera
In theory, Opera can use regular Chrome extensions, but these mostly fail to block WebRTC IP leaks. The one method I know of that does work is using the WebRTC Leak Prevent extension, but only if you:
1. Go to Menu -> Extensions -> Manage Extensions WebRTC Leak Prevent -> Options
2. Set “IP handling policy” to: Disable non-proxied UDP (force proxy), and tick both options under “Legacy”.
3. Hit “Apply settings”.
Internet Explorer
Internet explorer does not implement WebRTC yet.
Safari
Safari does not implement WebRTC yet.
Advanced optionsFor advanced users there is the NoScript plugin for Firefox and the ScriptSafe plugin for Chrome. If you install any of these or are already using one of them you are protected for as long as you do not allow javascript on any of the websites you visit.
This allows you to make a tradeoff and allow websites that you're sure do not use WebRTC or that you're not afraid to disclose your real IP to. Be aware that these plugins break many sites if you do not allow javascript on them.
ConclusionThe WebRTC “problem” can be dangerous for proxy users, by possibly revealing your true IP address which certain websites may or may not be setup to detect.
Proxy providers obviously do not want their user’s real IPs to be shown anywhere and ActProxy wanted to take a further step in publishing this tutorial in our FAQ section in order to protect our users, most of whom are are likely unaware of this threat.
In the meantime, at least once you are aware of the problem, it can be easily fixed.
