Daniel Ferreira Gyfi

> Except that over 20% of the United States has IPv6 connectivity.

The entire rest of the world has near-zero, just look at your own link. I'm in Canada and we have 0.55% here. No local ISP will offer it to me, and the one that did withdrew it completely last year. So perhaps I'm just slighted. There are a few other countries with 5%+ but it still makes up only a very small percentage of internet users. To top it off, while there has been some IPv6 adoption in the US, CGN has also caught on pretty heavily all over the world and seems to be, sadly, the solution most ISPs will actually go with for the near term at least.

> Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem.

https://diafygi.github.io/webrtc-ips/ is able to immediately reveal all the VM interfaces on my system even with no VMs using them. I suspect this is done so that faster routes may be established, but it is indeed a major problem for anyone who doesn't like fingerprinting.

It's hard to determine meaning from two words, a number, and some scare quotes, but I'll take a wild guess at what you meant anyway. IPv6 privacy addresses are a mechanism to restore the privacy previously provided by NAT on IPv4, i.e., masking which actual device behind the same ISP customer (home or business) is opening a connection. Windows 10 breaking this functionality does not make sense under any reasonable threat model of Microsoft attacking your privacy: privacy addresses do basically nothing for the average home (just like NAT does basically nothing to privacy of outbound connections for the average home), MS has no access to the traffic that would contain a private address unless something else has already gone wrong, and it's easy enough to find your private IP address anyway: https://diafygi.github.io/webrtc-ips/ (which works for me in Debian stable, using the packaged version of Firefox and no non-free software).

This is cool! One suggestion: I currently can't bookmark a URL that just contains my email with public key in the querystring, because the app complains that some parameters are missing. So for example https://diafygi.github.io/emailpk/?from=<myusername+publickey>@gmail.com will fail. If this worked, and automatically told the app the "from" address, that would make it easier to just hit a saved link or bookmark containing that info so I could get right down to business.

Other than that, a bit of polish and this would be fantastic. One problem might be running into the maximum URL length allowed by browsers (2083, limited by IE, if I am correct), if you store the ciphertext on the URL, but I don't see another way to get around that short of a very clever HTML email that performs a form post... which may be possible, not sure.

[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.]

I may write a blog post later about this, but here are a few that come to mind (only counting things that have demos or have been observed in the wild):

* css-visited browser history sniffing (fixed several years ago): http://dbaron.org/mozilla/visited-privacy
* HSTS unique-subdomain combination supercookies: http://www.radicalresearch.co.uk/lab/hstssupercookies
* lcamtuf's cache timing attack: http://lcamtuf.coredump.cx/cachetime/
* webrtc local ip leak: https://diafygi.github.io/webrtc-ips/
* panopticlick: https://panopticlick.eff.org/
* evercookie: http://samy.pl/evercookie

The problem with that table is that this only lists the entry methods, which are supported in all browsers. However, the actual work is hidden behind parameters, not all of which are supported by all browsers, and some have to be in weird combinations. One example is that Edge does not support PBKDF2 in any form, which makes many of their further support a bit weird to use.

Here's a site where you can test your browser's compatibility with many combinations: https://diafygi.github.io/webcrypto-examples/

there's really no way in chrome to disable webrtc? That's amazing.

edit: from the horse's mouths https://code.google.com/p/chromium/issues/detail?id=457492

edit2: you can install this

https://chrome.google.com/webstore/detail/webrtc-leak-prevent/eiadekoaikejlgdbkbdfeijglgfdalml

and test here:

https://diafygi.github.io/webrtc-ips/

though google sure seems to be dragging their feet on this so I'm sure they'll break this workaround soon