Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

brie.fi

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#41

Post by lioeters »

perenzo wrote: post #27
waynenilsen wrote: post #26

How can we further decentralize this such that the entire app runs "without any servers"? Sadly it is so close but the realities of ipv4 and local subnets definitely makes this more difficult. I always thought that this is part of what webrtc was trying to solve

Well technically it is possible to avoid the signaling server, but you'll need some other channel to exchange the peers connection data. This is pretty inconvenient though. But a signal server is a rather light thing and easy to install on a location you trust: https://github.com/holtwick/briefing/tree/master/signal

Thank you for making both the client and server sides of this video chat application open source.

The only missing piece it seems is the STUN/TURN server. Would you have a plan to also release it?

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#42

Post by perenzo »

lioeters wrote: post #41
perenzo wrote: post #27

Earlier quoted context omitted.

Well technically it is possible to avoid the signaling server, but you'll need some other channel to exchange the peers connection data. This is pretty inconvenient though. But a signal server is a rather light thing and easy to install on a location you trust: https://github.com/holtwick/briefing/tree/master/signal

Thank you for making both the client and server sides of this video chat application open source. The only missing piece it seems is the STUN/TURN server. Would you have a plan to also release it?

I use coturn. Find installation details here https://github.com/holtwick/briefing/blob/master/app/INSTALL...

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#43

Post by waynenilsen »

saurik wrote: post #37
waynenilsen wrote: post #35

Earlier quoted context omitted.

> you'll need some other channel to exchange the peers connection data Perhaps using IPFS to pin the data temporarily and share that hash between the peers?

If you can figure out how to share that hash, you may as well just share the offer.

Yes, serialization is the issue. URL length is technically unlimited but in practice very long urls don't work out so well

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#44

Post by lioeters »

perenzo wrote: post #42
lioeters wrote: post #41

Earlier quoted context omitted.

Thank you for making both the client and server sides of this video chat application open source. The only missing piece it seems is the STUN/TURN server. Would you have a plan to also release it?

I use coturn. Find installation details here https://github.com/holtwick/briefing/blob/master/app/INSTALL...

Oh, I didn't see that. Thanks so much for sharing!

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#45

Post by Andrew_nenakhov »

> Anonymous end-to-end encrypted

End to end encryption implies that you have established an encrypted connection with a known participant and secured it by verifying your keys either off-band or via some CA provider to prevent MitM attack.

If your chat partner is anonymous, and your only connection is via offered service, there is no way to determine if you are being spoofed.

So anonymous end-to-end encryption is an oxymoron. I wish people would drop this e2ee fetish, insisting it everywhere, and would learn how it works, so they would be using the real thing where it makes sense, instead of opting for readily supplied snake oil.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#46

Post by sci_prog »

Do you maybe have instructions on how to set this up on my own server/domain? I've looked at the code but I'm not familiar with Vue. I have an online webgl multiplayer game where I create random room names to connect players. It would be amazing if I could use my domain and the same random room to enable video chat among the players.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#47

Post by cryo »

perenzo wrote: post #13
cryo wrote: post #10

I don't understand the anonymous claim. Since in WebRTC peers connect directly to each other they'll see the IP of the other peer and can determine their locations. Further there is the signalling server which may also see these connection details if it isn't end to end encrypted (I haven't checked the code). IMHO private might be a better word than anonymous here.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

Thanks for the clarification, imo and as you already see in this discussion different people understand different meanings into the word.

Maybe it's safer to use a clear description rather than "anonymous". The "no user account is required" is a good statement which can be hardly misunderstood.

There are many people out there (including me) which think anonymous means nobody can trace or identify me. Anonymity even with Tor is very hard to achieve on the Internet, I would even say it's impossible.

On my software I'm using the word "private" instead of anonymous to describe such communication; which was inspired by Tor tech talks. I've written about it here https://cryonet.io/technology.html

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#48

Post by perenzo »

cryo wrote: post #47
perenzo wrote: post #13

Earlier quoted context omitted.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

Thanks for the clarification, imo and as you already see in this discussion different people understand different meanings into the word. Maybe it's safer to use a clear description rather than "anonymous". The "no user account is required" is a good statement which can be hardly misunderstood. There are many people out there (including me) which think anonymous means nobody can trace or identify me. Anonymity even w…

Ok, I get the point. I opened a ticket to use a clearer wording: https://github.com/holtwick/briefing/issues/51 Thanks clarifying the ambiguity.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#49

Post by DavidPP »

cryo wrote: post #10

I don't understand the anonymous claim. Since in WebRTC peers connect directly to each other they'll see the IP of the other peer and can determine their locations. Further there is the signalling server which may also see these connection details if it isn't end to end encrypted (I haven't checked the code). IMHO private might be a better word than anonymous here.

I think OP meant Anonymous as it was used when FTP was still a thing where it simply meant "without being authenticated as a named" user.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#50

Post by yencabulator »

perenzo wrote: post #33
seesawtron wrote: post #32

Looks really cool. One key element is that anyone can spy on your call if they guess the random name that you generate to create the link. I am curious what randomizations you have used to generate those? (perhaps you don't want to share to avoid exactly the spying, I can understand if you feel that way). Thanks for your insights. Cheers

Indeed, it is a rather simple algorithm [1] But you can set any name you like, either in the input field or directly in the URL. Protected rooms, where the participants need to know a common secret, are planned to be added to the project, see [2] [1] https://github.com/holtwick/briefing/blob/master/app/src/com... [2] https://github.com/holtwick/briefing/issues/1

So it's just javascript Math.random.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

> Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.

Also, even if you had a CSPRNG there, your URL format seems to encode only about 27 bits of data.

Post reply on HN