Hacker News Reader

Comment by altano | Hacker News Reader

And what should browsers prompt users with? "Would you like to use WebRTC?" What would that do to improve security for users?

View on HN

I'm sure someone could do better than this but here is a first try at a suitably informative prompt:

    $site_name wants to use WebRTC.

    WebRTC allows voice calling, video chat, and P2P file
    sharing, but can also be a privacy risk. We recommend
    allowing WebRTC only on sites that you expect to use
    such features on.

    [Link to learn more]

    Allow WebRTC for $site_name?

Something like Flash's audio/video access prompt would also be a good idea:

https://voicethread.com/image/howto/flash_settings_camera_mi...

Should one add WebGL to the list?

The preposition at the end of that sentence is unnecessary. Guessing you're from the midwest? :)

It's not; I think you're parsing 'expect to use' differently than intended.

"sites that you expect to use such features on"

This means "sites on which you expect to use such features"

Not "sites where you expect them to use such features"

The preposition is key to having you be the one using, not the site. It doesn't have to go on the end, perhaps, and you could rewrite the sentence without that preposition, but simply removing it would leave you with an entirely different meaning.

Security dialogs like this don't work. No one reads them and in this case it isn't even asking users to make a decision they can understand. It's hard enough to have the right UI when a user is on a site with a broken SSL cert which is really straightforward.

For access to the mic and camera, that's basically what it does already: prompt for permission.

So what you're really asking for is "can the web app know my non-NATed IP address if I'm behind a NAT and my non-VPN IP address if I'm behind certain kinds of VPNs"?

Reply on news.ycombinator.com