Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebRTC Copy – OTR and fast file transfers over WebRTC

rtccopy.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#11

Post by StavrosK »

mike-cardwell wrote: post #5

The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.

I've been saying the same thing every time I encounter one of these articles (maybe I'll blog about it and just link people to it):

The best way to do encrypted WebRTC transfers is to have the whole app in a single page, using as little code as possible (so it is easily auditable). NoScript/etc won't do much when you have to trust the author and can't audit it. People should be able to download the page from the GitHub repo (or wherever) and store it wherever they want. The page will generate a random URL that also contains a secret key (e.g. http://www.myservice.com/somerandomid/#98h9g78g2188t7231gy34...), which you can share with the receipient.

Since the URL fragment is never transmitted to the server, it is private. The WebRTC service can encrypt the content appropriately and send it to the recipient, where it will be decrypted. Voila, encrypted p2p file transfers without having to download anything.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#12

Post by rektide »

mike-cardwell wrote: post #5

The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.

The problem with sites like this is that readers such as mike-cardwell are not cool enough to download the sources themselves and host it where they trust it.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#13

Post by comex »

Security issues are one thing, but I've been using this site as a simple way to transfer (nonsensitive) large files without having to wait for the file to go through a third party server, sit through the ads required to pay for the bandwidth for such a server, or require the recipient to download specialized software for a P2P transfer. For this purpose it's very convenient.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#14

Post by sillysaurus2 »

dmix wrote: post #9
mike-cardwell wrote: post #5

The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.

If your concern is the security of 3rd party JS you should already be using NoSript/ScriptSafe [1]. Keep same-domain policy as safe and 3rd party domains blocked and opt-in only by default. The day-to-day UX experience of browsing the web is only minimally affected and significantly safer. Better than adblock. If your concern is the host operator, well obv can't circumvent that. Unless you use OSS chrome plugins and…

If your concern is the host operator, well obv can't circumvent that.

Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#15

Post by shmerl »

Can anyone explain please, whether WebRTC is a protocol or not? After reading this: http://www.webrtc.org/faq#TOC-Why-should-I-use-WebRTC- I thought it's just an API to enable other protocols (XMPP/Jingle, SIP etc.) to be built through JavaScript. Or is it a protocol after all?

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#16

Post by voltagex_ »

sillysaurus2 wrote: post #14
dmix wrote: post #9

Earlier quoted context omitted.

If your concern is the security of 3rd party JS you should already be using NoSript/ScriptSafe [1]. Keep same-domain policy as safe and 3rd party domains blocked and opt-in only by default. The day-to-day UX experience of browsing the web is only minimally affected and significantly safer. Better than adblock. If your concern is the host operator, well obv can't circumvent that. Unless you use OSS chrome plugins and…

If your concern is the host operator, well obv can't circumvent that. Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.

What do you base your initial known good JS on though? What is the user supposed to do with the information that the JS has changed? A diff of minified JS isn't that helpful.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#17

Post by zz1 »

erbbysam wrote: post #10
erbbysam wrote: post #8

Earlier quoted context omitted.

It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.

removed - https://github.com/erbbysam/webRTCCopy/commit/c1f35404414d63...

Great!

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#19

Post by erbbysam »

taralx wrote: post #18

It would be lovely if it would explain what features it needs out of Chrome Canary.

Chrome Canary is the only Chrome version that has working SCTP (reliable) datachannel support at the moment. It's broken(undetectable also) in every version before that (you can try, the website won't stop any version, just display warnings).

I did have unreliable datachannel support initially, but as both Firefox & Chrome now support reliable, I see no reason to keep that overhead/extra code around. Hopefully working reliable datachannels in Chrome will reach the primary version soon!

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#20

Post by sillysaurus2 »

voltagex_ wrote: post #16
sillysaurus2 wrote: post #14

Earlier quoted context omitted.

If your concern is the host operator, well obv can't circumvent that. Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.

What do you base your initial known good JS on though? What is the user supposed to do with the information that the JS has changed? A diff of minified JS isn't that helpful.

The author would say "the current version is 0.6.4 and its JS hashes to this SHA256 hash: xxx"

Open source already does this for binaries. Why not JS?

This assumes it's even possible to get a consistent hash of all javascript executing on a page, though.

Post reply on HN