WebRTC is designed to support direct peer-to-peer connections so the privacy leak is required.

Maybe it would have made more sense to make peer-to-peer opt-in explicit?

I liked that idea also.

The concern was dialog fatigue. If a web site prompts permission to ‘gather local candidates’ most users are just going to hit OK. So this wouldn’t stop abusive uses of WebRTC as hoped.

Glad you liked it! Anyway we could make it better?