WebRTC is a browser plugin that facilitates audio and video communication inside a web page by allowing a direct peer-to-peer connection to happen, excluding the need to install additional plugins or other native applications. In order for the plugin to work, WebRTC gives access to your media devices, such as your microphones, cameras, and headphones. Websites can exploit this mechanism in two possible ways:
- Devices enumeration
- Media devices ID tracking
These two methods of identification can be observed on the Browser leaks test website.
Devices enumeration #
This method relies on retrieving the full list of microphones, cameras, and headphones you have installed. Although just this number is not enough to specifically identify you, it can still play a role.
In Incogniton, you are able to control the number of different devices you want your browser profiles to have.
You are able to change these parameters within the following boundaries:
- Video inputs (amount of web cameras): 0-1
- Audio inputs (amount of microphones): 0-4
- Audio outputs (amount of speakers): 0-4
Theoretically, any given user can have more than the limited amount of devices we allow to change. However, since it’s not common, the numbers have been purposefully limited to what typically online users have.
Media device IDs #
For WebRTC to work, a website not only needs to know the amount and type of devices you have. In order to establish a proper real-time communication, unique devices identifiers are also needed. Think of addresses for your devices. Of course, browsers do not allow websites to see the full model name of your hardware devices, instead, they provide hashes – these are called Device IDs. But at the same time, any website can use these values for user identification purposes.
Since media device IDs are unique to every user, it can be an exceptionally effective technique in browser fingerprinting.
In Incogniton, Device IDs are masked for every device you add, when the feature is enabled. If you set Media devices masking OFF, your real devices IDs will be revealed to the website. This will happen even if you had WebRTC IP masking enabled.