Hacker News Reader

I hope Mozilla isn't wasting an opportunity to bring end-to-end videochat encryption to the masses here. I know WebRTC is supposed to be peer-to-peer, but I don't know about how they actually implemented it. So is it end-to-end encrypted? The fact that it's backwards compatible with legacy phone networks already makes me think it's not.

View on HN

It is.

DTLS-SRTP is required for media. The SCTP data channels are also layered on top of DTLS [1].

Now, obviously one "end" might be a conference mixer with unencrypted access to the PSTN, but direct browser-to-browser connections will be encrypted and there is always the DTLS fingerprint to guarantee that you're not being MITM'd. See <https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch> for more information about the security architecture.

[1] DTLS is just TLS with the obvious extensions needed to work over UDP instead of TCP.

Reply on news.ycombinator.com