Stop modifying WebRTC Web APIs when fingerprinting protection=strict

[pes10k]

Right now, if you set fingerprinting protections to strict, the following JS APIs are removed or rendered useless:

• https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/createOffer
• https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/createAnswer
• https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/setLocalDescription
• https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/setRemoteDescription

These APIs are not fingerprinting related; this implementation is largely because Brave used to use the fingerprinting setting to control a number of non-fp related things too (to avoid jamming up the shields UI).

We should stop modifying these methods based on fingerprinting setting, and rely on the global WebRTC setting to control the privacy properties of these methods

[cjwijtmans]

Are you sure? https://browserleaks.com/webrtc

[pes10k]

@cjwijtmans sorry, im not sure I follow your question. Can you try rephrasing?

[cjwijtmans]

Because its clear webrtc is used in multiple ways to fingerprint. I was actually surprised on android brave browser it was able to pull up wan and lan ip adress which will work even on vpn. At this point i dont even trust brave.

[pes10k]

Sure, understood. I'm not following the connection to this issue though. This issue is specifically not about getting IP information from the WebRTC system (which is already controlled through a global shields setting). This is about whether you can get fingerprinting information through these methods unrelated to ip addresses.

[cjwijtmans]

Predicted your response, anyway. All i said is that currently even the wan and lan information can be used for some basic fingerprinting making VPNs useless. Are you completely ignoring device id enumaration? There is a reason webrtc is rendered useless, its a huge privacy leak. Do you even know what are you talking about? No wonder random privacy filters and fingerprinting plugins are doing a better job than brave currently.

[pes10k]

These comments are not related to the issue here, so I will not respond further.

For anyone else who comes across this, device enumeration fingerprinting is being handled in #8666. WAN and LAN IP information is already handled through other shields settings. This issue is not related to either of those topics.

[pes10k]

For a QA plan, all thats needed is to go to https://browserleaks.com/webrtc and make sure that you see the public (not local) IP when fingerprinting = strict

[LaurenWags]

Verified passed with

Brave | 1.14.67 Chromium: 85.0.4183.83 (Official Build) dev (64-bit)
-- | --
Revision | 94abc2237ae0c9a4cb5f035431c8adfb94324633-refs/branch-heads/4183@{#1658}
OS | macOS Version 10.14.6 (Build 18G3020)

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)

---

Verification passed on

Brave | 1.14.69 Chromium: 85.0.4183.83 (Official Build) dev (64-bit)
-- | --
Revision | 94abc2237ae0c9a4cb5f035431c8adfb94324633-refs/branch-heads/4183@{#1658}
OS | Windows 10 OS Version 1903 (Build 18362.1016)

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)

---

Verification passed on

Brave	1.14.71 Chromium: 85.0.4183.83 (Official Build) dev (64-bit)
Revision	94abc2237ae0c9a4cb5f035431c8adfb94324633-refs/branch-heads/4183@{#1658}
OS	Ubuntu 18.04 LTS

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)

[srirambv]

Verification passed on OnePlus 6T with Android 10 running 1.14.82 x64 RC build

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)

---

Verification passed on Samsung Tab A with Android 10 running 1.14.82 x64 RC build

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)

---

Verification passed on Nexus 6P Emulator with Android 7 running 1.14.82 x86 RC build

• Verified test plan from Stop modifying WebRTC Web APIs when fingerprinting protection=strict #11310 (comment)