Focus-android: WebRTC IP Leak Switch

[mikeV02]

I noticed that the browser leaks the true IP through WebRTC when using a VPN. It does not have about:config menu as Firefox, so I thought it would be nice to have a switch in the settings to enable or disable WebRTC.

[pocmo]

As long as our builds are based on WebView we can't really prevent that. This was one of the reasons why Tor's browser is based on Firefox and not using WebView anymore.

[eolme]

I think you can try webview.evaluateJavascript or inject script tag before other scripts in page and set RTCPeerConnection and/or webkitRTCPeerConnection to undefined

[lcanali]

what about recompiling webview disabling WebRTC and including in the apk?

I had suggested crosswalk in this comment earlier, but it appears that they aren't updating that any longer https://crosswalk-project.org/blog/crosswalk-final-release.html

This is a pretty big hole for a privacy-focused browser.

[pocmo]

Crosswalk is no longer in development. It's more likely that we are going to switch to GeckoView in case we are deciding to abandon the WebView based build.

[lcanali]

if google hasn't allowed the ability to turn off webrtc by now, I would guess they won't for whatever data collection reasons they may have...

[lcanali]

there's also the option of using Chromium webkit in addition to GeckoView.

I do think an IP leak is a big problem. Is there any workaround on the mean time that would work?

thanks

[pocmo]

Unfortunately there's no workaround for Focus currently. For this you'd have to either use regular Firefox (and flip the preferences for this) or OrFox.

[rancidfrog]

How can you label project

Firefox Focus: The privacy browser - Browse like no one’s watching.

When IP is being leaked. Kind of pathetic false information.
Can't you be sued?

[lcanali]

I really think you guys need to figure this one out if you want to be a privacy-focused browser.

[RootUp]

Indeed, I believe this is more of a privacy issue here is the live demo for same,

1. Navigate to www.ch3114.com/getip.html
2. You would be able to private IP address of user.

[Sdaswani]

Thanks for your input folks - we will re-triage this soon.

[lcanali]

please do! thank you!

[qertoip]

This is really critical.

[pocmo]

Focus has replaced WebView with GeckoView a long time ago. Closing.