Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebRTC Copy – OTR and fast file transfers over WebRTC

rtccopy.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#21

Post by bemmu »

shmerl wrote: post #15

Can anyone explain please, whether WebRTC is a protocol or not? After reading this: http://www.webrtc.org/faq#TOC-Why-should-I-use-WebRTC- I thought it's just an API to enable other protocols (XMPP/Jingle, SIP etc.) to be built through JavaScript. Or is it a protocol after all?

I'm also a bit curious about the protocol part, found this tidbit on their site "The session components are built by re-using components from libjingle, without using or requiring the xmpp/jingle protocol." (http://www.webrtc.org/reference/architecture#TOC-Transport-S...)

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#22

Post by Gnewt »

erbbysam wrote: post #10
erbbysam wrote: post #8

Earlier quoted context omitted.

It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.

removed - https://github.com/erbbysam/webRTCCopy/commit/c1f35404414d63...

Are you hosting the site through Github Pages?

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#23

Post by pigubrco »

shmerl wrote: post #15

Can anyone explain please, whether WebRTC is a protocol or not? After reading this: http://www.webrtc.org/faq#TOC-Why-should-I-use-WebRTC- I thought it's just an API to enable other protocols (XMPP/Jingle, SIP etc.) to be built through JavaScript. Or is it a protocol after all?

I think this is a really nice overview for WebRTC: http://www.html5rocks.com/en/tutorials/webrtc/basics/ There is a section around standards and protocols.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#24

Post by erbbysam »

Gnewt wrote: post #22
erbbysam wrote: post #10

Earlier quoted context omitted.

removed - https://github.com/erbbysam/webRTCCopy/commit/c1f35404414d63...

Are you hosting the site through Github Pages?

No, I currently just manually keep the site in sync with the repository. Not exactly the most professional system but it got the job done. I'm going to look into that(not sure exactly how it works, but I do need to keep a node.js server running as well for webrtc negotiation) , as well as potentially just installing git on the server and have it sync up to the repository.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#25

Post by mike-cardwell »

erbbysam wrote: post #8
mike-cardwell wrote: post #7

Earlier quoted context omitted.

Does Google now have a log that I visited: https://rtccopy.com/#csFXmvXW And if somebody else had visited that same room, would they have a log of that too?

It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.

Even if Google weren't currently sucking up this information, it would still have been a wise decision to remove it. They can change their JavaScript at any point without you noticing and start logging it. Malicious intent not required.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#26

Post by mike-cardwell »

dmix wrote: post #9
mike-cardwell wrote: post #5

The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.

If your concern is the security of 3rd party JS you should already be using NoSript/ScriptSafe [1]. Keep same-domain policy as safe and 3rd party domains blocked and opt-in only by default. The day-to-day UX experience of browsing the web is only minimally affected and significantly safer. Better than adblock. If your concern is the host operator, well obv can't circumvent that. Unless you use OSS chrome plugins and…

I already use RequestPolicy and NoScript.

My concern was that he made the security/privacy worse than it needed to be, for other people, by including Google Analytics on the page.

He has now stated that he's seen that the room name is in fact being leaked to Google Analytics, and so has removed it. But even if he hadn't seen this, you still shouldn't include any third party hosted scripts on pages like these because you've no idea if/when they'll change in a manner which compromises security/privacy in future. No malicious intent required.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#27

Post by mike-cardwell »

voltagex_ wrote: post #16
sillysaurus2 wrote: post #14

Earlier quoted context omitted.

If your concern is the host operator, well obv can't circumvent that. Of course we can circumvent that. Make a plugin to alert the user whenever the JS changes.

What do you base your initial known good JS on though? What is the user supposed to do with the information that the JS has changed? A diff of minified JS isn't that helpful.

Script on a site like this should not be minified. It should be easily readable and well commented, so that people can audit it properly.

Re: WebRTC Copy – OTR and fast file transfers over WebRTC

#28

Post by mike-cardwell »

rektide wrote: post #12
mike-cardwell wrote: post #5

The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.

The problem with sites like this is that readers such as mike-cardwell are not cool enough to download the sources themselves and host it where they trust it.

I run my own federated XMPP server from my own trusted hardware in my own trusted building, with mandatory TLS and OTR.

I wont be interested in running web based mail/chat clients until we get to a point where browsers have built in APIs that allow people to write trustable apps.

Post reply on HN