For reference: WebRTC Homepage

I've been really interested in these new RTC technologies that are coming out, specifically the fact that use the PeerConnection API to establish a connection between two browsers and receive media via P2P. So I have a few questions.

  • What security measures can peers take to ensure their privacy and security when using technologies like this?
  • Is there anything that a webmaster can do (programmatically or practically) to ensure peers are safe(r)?
  • What risks are posed to peers in general?

1 Answer 1


To state the obvious, you can serve your code over HTTPS.

The architecture diagram shows that it uses SRTP, the secure version of RTP. It uses AES and HMAC-SHA1.

That leaves the question of key establishment for the SRTP session. A quick search suggests this has been a sticky issue to standardize. Clearly this is a goal of the project, but I don't know whether it's been settled yet, and whether there might be tradeoffs that you need to be aware of. http://www.ietf.org/mail-archive/web/rtcweb/current/msg04050.html

Also see (seems to be focused on issues about UI and granting permission) https://wiki.mozilla.org/Security/Discussions/WebRTC

Security for WebRTC is (with no surprise) becoming a real rats-nest for some of the use-cases, such as screensharing ala WebEx, remote assistance ala Windows or VNC, ongoing permission ala Skype, etc.

The general impression is that, since WebRTC is an incomplete draft spec, information about its security is incomplete and drafty.

  • I'd add that from a design point of view, WebRTC is probably the most secure choice if you look at other VoIP options out there: bloggeek.me/webrtc-security Commented Jan 22, 2013 at 10:23
  • @Tsahi I would make a comment on your blog (which is off-topic here), but it seems to think I'm a bot. [email protected]
    – sourcejedi
    Commented Jan 22, 2013 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .