Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For reference: WebRTC Homepage

I've been really interested in these new RTC technologies that are coming out, specifically the fact that use the PeerConnection API to establish a connection between two browsers and receive media via P2P. So I have a few questions.

  • What security measures can peers take to ensure their privacy and security when using technologies like this?
  • Is there anything that a webmaster can do (programmatically or practically) to ensure peers are safe(r)?
  • What risks are posed to peers in general?
share|improve this question
add comment

1 Answer 1

To state the obvious, you can serve your code over HTTPS.

The architecture diagram shows that it uses SRTP, the secure version of RTP. It uses AES and HMAC-SHA1.

That leaves the question of key establishment for the SRTP session. A quick search suggests this has been a sticky issue to standardize. Clearly this is a goal of the project, but I don't know whether it's been settled yet, and whether there might be tradeoffs that you need to be aware of. http://www.ietf.org/mail-archive/web/rtcweb/current/msg04050.html


Also see (seems to be focused on issues about UI and granting permission) https://wiki.mozilla.org/Security/Discussions/WebRTC

Security for WebRTC is (with no surprise) becoming a real rats-nest for some of the use-cases, such as screensharing ala WebEx, remote assistance ala Windows or VNC, ongoing permission ala Skype, etc.


The general impression is that, since WebRTC is an incomplete draft spec, information about its security is incomplete and drafty.

share|improve this answer
    
I'd add that from a design point of view, WebRTC is probably the most secure choice if you look at other VoIP options out there: bloggeek.me/webrtc-security –  Tsahi Levent-Levi Jan 22 '13 at 10:23
    
@Tsahi I would make a comment on your blog (which is off-topic here), but it seems to think I'm a bot. alan.christopher.jenkins@gmail.com –  sourcejedi Jan 22 '13 at 14:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.