To the security people here.
I like the idea of P2P and UDP for better latency.
But how dangerous is this?
I like the idea of P2P and UDP for better latency.
But how dangerous is this?
Check your ones at https://www.privacytools.io/webrtc.html
I really don't know why the local IP addresses must be known to the server, maybe there are good technical reasons, but it's not OK.
So they can pair you with other clients sharing a local network with you? This allows the client to talk peer to peer over their LAN which is extremely valuable.
I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works.
And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked.
> I'm not really sure that it is practical with large LANs (a /16) but it doesn't look impossible. If they design for privacy they could develop an algorithm that works.
Not even a little bit practical. Most big lans disallow broadcasts, or limit them in various ways. The only way for peers to find each other is to know each other's private IP address. And private IP addresses contain nothing of value.
Now if you're using a VPN which you intend to use to protect your privacy, well... There are countless of other problems with that if you just turn that on, use the same software as always, and think you are now 'anonymous'.
> And if I connect with a VPN I probably don't want to bypass it. I've got customers that accept unconveniences to protect their network with VPNs. Should browsers break it with WebRTC? I didn't think so. It's a vulnerability that I keep blocked.
It's not a vulnerability. It is a very, very useful feature. You just happen to think that enabling a VPN will magically give you a privacy shield, which is misguided at best.
A great series for you to read.
tl;dr
Udp is good. client to client sessions are terrible over the internet.
Didn't know that. But makes sense.
In the WebRTC case, the server could simply be a "peer" too :)
(it's called peer-to-peer instead of client-to-client, because there is no client role in such a system).
In terms of plain and direct security holes in WebRTC, there is an extended attack surface. But your browser has this enabled anyway, no matter what you as an application developer or end user do.
In terms of security properties delivered to the application/end user, there are security and privacy advantages in end-to-end communication instead of involving servers. But it all depends on your use case and threat model.
But having random sites doing this, didn't feel right to me.
Also there's no reason to allow silent P2P connections.
https://chrome.google.com/webstore/detail/webrtc-network-lim...