Protecting peers communicating with WebRTC

Question

For reference: WebRTC Homepage

I've been really interested in these new RTC technologies that are coming out, specifically the fact that use the PeerConnection API to establish a connection between two browsers and receive media via P2P. So I have a few questions.

• What security measures can peers take to ensure their privacy and security when using technologies like this?
• Is there anything that a webmaster can do (programmatically or practically) to ensure peers are safe(r)?
• What risks are posed to peers in general?

Answer 1

To state the obvious, you can serve your code over HTTPS.

The architecture diagram shows that it uses SRTP, the secure version of RTP. It uses AES and HMAC-SHA1.

That leaves the question of key establishment for the SRTP session. A quick search suggests this has been a sticky issue to standardize. Clearly this is a goal of the project, but I don't know whether it's been settled yet, and whether there might be tradeoffs that you need to be aware of. http://www.ietf.org/mail-archive/web/rtcweb/current/msg04050.html

---

Also see (seems to be focused on issues about UI and granting permission) https://wiki.mozilla.org/Security/Discussions/WebRTC

Security for WebRTC is (with no surprise) becoming a real rats-nest for some of the use-cases, such as screensharing ala WebEx, remote assistance ala Windows or VNC, ongoing permission ala Skype, etc.

---

The general impression is that, since WebRTC is an incomplete draft spec, information about its security is incomplete and drafty.