Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

brie.fi

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#21

Post by walterbell »

perenzo wrote: post #19
walterbell wrote: post #18

Earlier quoted context omitted.

How about the term "unauthenticated", which is well understood for HTTP requests?

Well, IMO the definition of the word "anonymous" still fits how personal information is handled in Briefing: "Anonymity describes situations where the acting person's name is unknown" [1] And this is true regarding the Briefing service. [1] https://en.wikipedia.org/wiki/Anonymity

For online transactions, "name" has been generalized to PII (Personally Identifiable Information) from which name can often be derived.

https://en.wikipedia.org/wiki/Personal_data

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#23

Post by perenzo »

nannal wrote: post #22

"No camera or microphone has been found!" Using firefox 79, the usual prompts to allow permissions were not issued.

This is a Firefox Nightly release, correct? Current stable release is 77.0.1 Do you experience those issues with the stable release as well? If so I would like to ask you to file a bug here and add the OS version. Thanks for letting me know! https://github.com/holtwick/briefing/issues/new

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#24

Post by asjw »

walterbell wrote: post #18
perenzo wrote: post #13

Earlier quoted context omitted.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

How about the term "unauthenticated", which is well understood for HTTP requests?

An anonymous user is precisely the one who hasn't provided authentication credentials

> Anonymous User is any user who accesses network resources without providing a username or password.

Se anonymous is correct in this context

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#25

Post by a1a1a1a1a1a1 »

perenzo wrote: post #17
clawoo wrote: post #16

Earlier quoted context omitted.

> This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge What this means is that the packets are encrypted between you and the video bridge and the packets travel unencrypted within the videobridge infrastructure, but at no point does the outside world see the unencrypted stream. Talking to the Jitsi video bridge is just a regular WebRTC session as far as clients are concer…

Thanks for the feedback, I'll take Olm/Matrix and Signal into consideration, although I believe for the described purpose of Briefing the current implementation is sufficient and secure.

Not sure if this is possible with the current WebRTC api, but if you could expose the dtls public keys for the current and remote sessions somewhere, that would help to reduce the risk of MITM attacks. Users would at least have the option of manually verifying keys through another channel.

edit: it looks like you can find info in the RTCSessionDescription.sdp property. The remoteDescription and localDescription should each have key fingerprints in lines with "a=fingerprint:..."

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#26

Post by waynenilsen »

How can we further decentralize this such that the entire app runs "without any servers"? Sadly it is so close but the realities of ipv4 and local subnets definitely makes this more difficult. I always thought that this is part of what webrtc was trying to solve

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#27

Post by perenzo »

waynenilsen wrote: post #26

How can we further decentralize this such that the entire app runs "without any servers"? Sadly it is so close but the realities of ipv4 and local subnets definitely makes this more difficult. I always thought that this is part of what webrtc was trying to solve

Well technically it is possible to avoid the signaling server, but you'll need some other channel to exchange the peers connection data. This is pretty inconvenient though. But a signal server is a rather light thing and easy to install on a location you trust: https://github.com/holtwick/briefing/tree/master/signal

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#29

Post by zumachase »

waynenilsen wrote: post #26

How can we further decentralize this such that the entire app runs "without any servers"? Sadly it is so close but the realities of ipv4 and local subnets definitely makes this more difficult. I always thought that this is part of what webrtc was trying to solve

Bootstrapping a distributed swarm is always a tricky proposition. Bittorrent clients use a few endpoints to bootstrap their dht, and then upgrade to p2p after that. I think that's a good compromise, especially if you can have a number of highly-available options to cycle through.

With Squawk[1] we do the initial signaling through our own servers via websocket, and a key registry for authing peers to each other, but after that, all the fun stuff happens p2p. The protocol level data (who's speaking, which group they're speaking to, whether they are muted, etc) flows entirely p2p over data channels, and since we're audio only we made the decision not to use SFUs but rather do a full mesh architecture (massive PITA but it does scale well to 20-30 peers) with geo-optimized TURN servers when people need to punch through NAT (but TURN does not terminate ssl).

[1] https://www.squawk.to

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#30

Post by seesawtron »

perenzo wrote: post #13
cryo wrote: post #10

I don't understand the anonymous claim. Since in WebRTC peers connect directly to each other they'll see the IP of the other peer and can determine their locations. Further there is the signalling server which may also see these connection details if it isn't end to end encrypted (I haven't checked the code). IMHO private might be a better word than anonymous here.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

You can create a user account with a random name almost every chat/video application.

A more descriptive term would be "account-free".

Post reply on HN