Comments on: Stop Whining about WebRTC Security Threats https://bloggeek.me/webrtc-security-threats/ The leading authority on WebRTC Mon, 06 Apr 2020 05:44:33 +0000 hourly 1 By: Tsahi Levent-Levi https://bloggeek.me/webrtc-security-threats/#comment-118450 Thu, 21 Jul 2016 06:08:20 +0000 https://bloggeek.me/?p=10260#comment-118450 In reply to keeggolb.

Thanks. The idea is that WebRTC enables you to write secure systems – and in that, it is far more advanced than anything out there that is available to developers.

]]>
By: keeggolb https://bloggeek.me/webrtc-security-threats/#comment-118449 Thu, 21 Jul 2016 02:48:00 +0000 https://bloggeek.me/?p=10260#comment-118449 We know that without end-to-end authentication, man-in-the-middle attacks on WebRTC are trivially easy to perform wholesale, for mass collection of data. It’s designed that way.

You seem to be saying “Yes, this protocol is insecure, but it doesn’t matter because so are many others.” That could be said of each and every one of them and nothing would improve. “Hey, it doesn’t matter that the lock on your front door is no good, because someone can climb over your back fence and force open my kitchen window.”

Your list of good things about WebRTC boils down to:
Encryption (but authentication is missing)
Security-updates
Permissions-system

Those are essential in any communications software.

For secure audio conversations over the net, I’d look at Signal, from Open Whisper Systems: Moxie Marlinspike etc. (it doesn’t handle video at present).

WebRTC enhanced with ZRTP (or other user-to-user authentication) might be good.

For audio/video/text, another option might be the Tox protocol, but I’ve not yet looked into how well it lives up to its goals, or how well written (and maintained) the implementations are.

]]>
By: Jeff - VoipDIY https://bloggeek.me/webrtc-security-threats/#comment-118448 Thu, 03 Mar 2016 18:48:45 +0000 https://bloggeek.me/?p=10260#comment-118448 Hello Tsahi – your points are well founded and I’m certainly in alignment with your perspective. You were clearly fired-up when you wrote this article… 🙂

We live in such a complicated technological world these days. We are all users of technologies that on one hand we may claim to be power users of, and on the other hand we clearly have only scratched the surface in truly understanding the science behind the technologies we use. The difference between those who know what they are talking about and those who only think they do, is often just a short distance in the learning curve.

I recently purchase a new 2016 Subaru Forester after 23 years of driving a 1992 Honda Civic VX Hatchback. That old car was so reliable – we hated to get rid of it. Everything was mostly mechanical. We totally trusted it. I used to do most of the minor maintenance myself. The thought of driving a brand new car scares the $xxx out of me. Cars are now all so highly computerized from front to back, top to bottom. I’ve been using computers for over 20 years. Computers are always buggy in some way or other. Not only are they buggy, but their are always requiring security patches. If it wasn’t for may PC background, perhaps I wouldn’t be so distrustful and apprehensive of the new computerized cars potential for bugs and security risks. Perhaps my new car fears are unfounded, but perhaps that is just my lack of knowledge of how they really function these days.

I expect those people on Quora who express their security fears of WebRTC are in the camp of those who know just enough to be fearful of the unknown. And, those who advise on disabling or not using WebRTC know just enough to encourage the spread unfounded fears.

You are doing your part in helping dispel those fears…
Keep up the good work!

]]>