Hacker News Reader

Comment by userbinator | Hacker News Reader

I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.

View on HN

    ...like JavaScript, should be disabled by default and enabled only
    on sites that you really trust and need it...

I browse the web using Chrome with JavaScript off by default.

It's a royal pain in the ass.

I can't imagine that non-power users would have any tolerance at all for all that hassle.

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

I'm sure someone could do better than this but here is a first try at a suitably informative prompt:

    $site_name wants to use WebRTC.

    WebRTC allows voice calling, video chat, and P2P file
    sharing, but can also be a privacy risk. We recommend
    allowing WebRTC only on sites that you expect to use
    such features on.

    [Link to learn more]

    Allow WebRTC for $site_name?

Something like Flash's audio/video access prompt would also be a good idea:

https://voicethread.com/image/howto/flash_settings_camera_mi...

Security dialogs like this don't work. No one reads them and in this case it isn't even asking users to make a decision they can understand. It's hard enough to have the right UI when a user is on a site with a broken SSL cert which is really straightforward.

The preposition at the end of that sentence is unnecessary. Guessing you're from the midwest? :)

It's not; I think you're parsing 'expect to use' differently than intended.

"sites that you expect to use such features on"

This means "sites on which you expect to use such features"

Not "sites where you expect them to use such features"

The preposition is key to having you be the one using, not the site. It doesn't have to go on the end, perhaps, and you could rewrite the sentence without that preposition, but simply removing it would leave you with an entirely different meaning.

Should one add WebGL to the list?

For access to the mic and camera, that's basically what it does already: prompt for permission.

So what you're really asking for is "can the web app know my non-NATed IP address if I'm behind a NAT and my non-VPN IP address if I'm behind certain kinds of VPNs"?

Reply on news.ycombinator.com