Re: Obtaining Client IP Address using *JavaScript ONLY* (was: So TOR is NOT really anonoymous!)

In article <43068204$0$83586$892e7fe2 (AT) authen (DOT) white.readfreenews.net>, Privacy Advocate wrote:

//crossposted to: comp.lang.javascript, alt.comp.lang.javascript in an
effort to get factual answers from JavaScript experts//

Simply put; Is it possible to obtain the real (actual) IP address of
someone (client) that visits a web site through an anonymous proxy if
this person ONLY has JavaScript enabled in their browser? This is NOT
a question about PHP, perl, VBScript, Java(.class), or ActiveX. Let us
_only_ deal with JavaScript for the sake of this post. Can someone
provide us (we, non-coders) with a definitive answer to this
perplexing question?

none of the above alone are capable of determining the real world IP of the
client... to do that (and be guaranteed success) you'd need to run traceroute
or similar on their machine.

As an example, most are aware Hotmail, Yahoo mail, Google 'gmail' -
all require JavaScript enabled in order to sign up for a free email
account. It has been the general consensus of many over the years that
the providers of these free email accounts are able to obtain the true
IP of the person applying, through the use of JavaScript.

I can access my yahoo mail using links (with ssl enabled) links doesn't do
javascipt.

If it is indeed possible to obtain one's real IP through JavaScript
only,

It's not. in many cases the browser doesn't have access to that information
(eg when it's on a lan behind a gateway....)


Bye.
Jasen

-----BEGIN PGP SIGNED MESSAGE-----

Jasen Betts wrote:
<s>

none of the above alone are capable of determining the real world IP of the
client... to do that (and be guaranteed success) you'd need to run traceroute
or similar on their machine.

Beware of cookies though. I registered Realplayer (yep with the critical
bug a short while ago
<http://www.eeye.com/html/research/upcoming/index.html>) and Ad-Aware
found a cookie on my computer with my name details! Three other sites
also had it (including doubleclick).

Better trash all cookies between real sessions and anonymous sessions..

Thomas
- --
Life is like a videogame with no chance to win - ATR
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iQB5AwUBQw+VigEP2l8iXKAJAQEzlQMgrbRLXxY/ke42Gv4+ptUqn6NjO80pP15y
DkaOR0e/nhqTb9ur3XlG9Mcs7dY39WIBJVsQE4z4uHo1lVCehGl9UfrXmY zHnnX1
cRLMRd4h29z/PqjEy6gfiEadtGmQD/dFZOPwRg==
=psck
-----END PGP SIGNATURE-----