Skip to main content
Notice removed Draw attention by John
Bounty Ended with Ubaidah's answer chosen by John
Notice added Draw attention by John
Bounty Started worth 100 reputation by John
added 77 characters in body
Source Link
John
  • 2.3k
  • 4
  • 29
  • 47

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

SpecificallyAlso, assuming that the JavaScript delivered to their browsers is not already siphoning off their data, I'd like to know if it's possible for the original uniting web server has enough information (keys, etc) to eavesdrop on the united peers encrypted communications, assuming thatif the JavaScript delivered to their browsers is not already siphoning off their datatraffic was recorded, for instance.

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

Specifically, I'd like to know if it's possible for the original uniting web server to eavesdrop on the united peers, assuming that the JavaScript delivered to their browsers is not already siphoning off their data.

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

Also, assuming that the JavaScript delivered to their browsers is not already siphoning off their data, I'd like to know if the original uniting web server has enough information (keys, etc) to eavesdrop on the united peers encrypted communications, if the traffic was recorded, for instance.

added 234 characters in body
Source Link
John
  • 2.3k
  • 4
  • 29
  • 47

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

Specifically, I'd like to know if it's possible for the original uniting web server to eavesdrop on the united peers, assuming that the JavaScript delivered to their browsers is not already siphoning off their data.

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?

Update:

Specifically, I'd like to know if it's possible for the original uniting web server to eavesdrop on the united peers, assuming that the JavaScript delivered to their browsers is not already siphoning off their data.

Tweeted twitter.com/#!/StackSecurity/status/450724133048168448
Source Link
John
  • 2.3k
  • 4
  • 29
  • 47

WebRTC P2P SSL - Where are the keys generated?

My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?