WebRTC is almost here, and it will change the web • Hacker News Board

Re: WebRTC is almost here, and it will change the web

#71

Post by sp332 » Tue, Aug 14, 2012, 10:48 AM UTC

novalis wrote: post #68

sp332 wrote: post #28

Earlier quoted context omitted.

Reliability, security, performance. Don't take my word for it http://www.apple.com/hotnews/thoughts-on-flash/

That is the sort of PR that doesn't get held back by facts. Also, to pretend that Steve Jobs was some sort of unilateral source of fair reasoning on the matter is either disingenuous or very short sighted. I hope it isn't both. But please, do not take my word for it: http://truegryc.blogspot.pt/2010/05/response-to-thoughts-on-...

Look I'm not claiming Steve Jobs is exactly unbiased :) But the "real" reason given in that article can't be right: Apple's stance appears driven by their business need to protect the iPhone platform against the threat of a cross-platform competitor.

Remember the first iPhone didn't have an app store! It had a full(ish)-featured web browser that people were expected to write "apps" for. Apple continues to encourage developers to write web apps for the iPhone. They can hardly be threatened by a feature they actively promote and enable.

Re: WebRTC is almost here, and it will change the web

#72

Post by nuje » Tue, Aug 14, 2012, 11:51 AM UTC

rorrr wrote: post #62

spindritf wrote: post #41

Earlier quoted context omitted.

> Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Pidgin with OTR -- configure and verify keys once, use whatever protocol you want. It is doable and not very difficult right now, the problem really is that no one cares.

That's assuming the clients are not compromised, hardware is not compromized, and "whatever protocol" is not susceptible to man-in-the-middle attacks.

Not really, you can have good enough security without perfect technology.

Cost to acquire or develop and reliably productize (and risk divulging) targeted attacks for OTR would likely exceed the value your adversaries could extract from your chat with your mom.

Re: WebRTC is almost here, and it will change the web

#73

Post by nuje » Tue, Aug 14, 2012, 11:59 AM UTC

msutherl wrote: post #48

mtgx wrote: post #12

Since Skype is moving to fully centralized service that can be even more easily wiretapped by Governments around the world (not just US), I'm very excited about the "revolutionary" (literally) capabilities of this protocol, as people will be able to speak 1-on-1 without interference, if the communication is also encrypted. Does being encrypted or not depend on that specific WebRTC client, or does it come encrypted by…

Don't make the mistake of thinking that because the communication channel is "encrypted", it is secure. SSL can already be compromised (so much for trusting encrypted transport) and the WebRTC client code could be compromised (always a problem).

The fact that you can bungle WebRTC or SSL/TLS implementation doesn't make it useless for transport security. But of course security building blocks never guarantee properties of the entire system alone. Just like using AES doesn't make or break your security.

Re: WebRTC is almost here, and it will change the web

#74

Post by Egregore » Tue, Aug 14, 2012, 12:03 PM UTC

rmc wrote: post #65

Egregore wrote: post #64

Earlier quoted context omitted.

Can you please provide links on how SSL can be compromised?

It's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for any domain name.

It's correct that if root CA is compromised you can make fakes.

To protect against this attack browsers should warn when certificate changes, there even is a long standing bug for firefox in mozilla:

https://bugzilla.mozilla.org/show_bug.cgi?id=471798

Re: WebRTC is almost here, and it will change the web

#75

Post by BitMastro » Tue, Aug 14, 2012, 12:13 PM UTC

jeffehobbs wrote: post #70

thebigshane wrote: post #35

Earlier quoted context omitted.

Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Is it going to involve setting up my own trusted server somewhere? Is it going to involve downloading some large undocumented project and have to build myself (on my box and her box)? Is it going to require troubleshooting arcane protocols, firewalls, and xml files? I haven't seen an easy way to have secure…

Apple's FaceTime is end-to-end encrypted, "the FaceTime conversation stream is encrypted from end to end, and each FaceTime session has unique session keys for each user".

Source? According to wikipedia "As of June 2011, it is not yet known to have been ratified by any standards body, and the extent of work by Apple with regard to this promise is unclear as Apple has not released technical specifications for the service. FaceTime is not currently supported on any non-Apple devices. While FaceTime is based on open standards, Apple's FaceTime service requires a client-side certificate. In other words, while the protocol might become an "open standard", access to Apple's FaceTime service is controlled by Apple.". This means that encryption keys are owned by Apple, and not by users.

Re: WebRTC is almost here, and it will change the web

#76

Post by rdtsc » Tue, Aug 14, 2012, 12:27 PM UTC

jeffehobbs wrote: post #70

thebigshane wrote: post #35

Earlier quoted context omitted.

Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Is it going to involve setting up my own trusted server somewhere? Is it going to involve downloading some large undocumented project and have to build myself (on my box and her box)? Is it going to require troubleshooting arcane protocols, firewalls, and xml files? I haven't seen an easy way to have secure…

Apple's FaceTime is end-to-end encrypted, "the FaceTime conversation stream is encrypted from end to end, and each FaceTime session has unique session keys for each user".

> Apple's FaceTime is end-to-end encrypted

And one should trust Apple's or your word because...?

Re: WebRTC is almost here, and it will change the web

#77

Post by JoshTriplett » Tue, Aug 14, 2012, 12:49 PM UTC

ZoFreX wrote: post #69

While this tech is exciting for a wide variety of reasons, this blog post completely misses the point for me in its efforts to hype this. > imagine it amplified by secure, real-time transmissions of audio and video Ok, I'm imagining it. And I'll still be imagining it in 12 months time, because WebRTC does nothing to fix the outstanding issues in setting up secure communications. > Skype, Cisco, and Polycom will all s…

> Why would in-browser conferencing, which will almost certainly be a worse experience than Skype

What would give you that impression?

A site that lets you automatically join a conference call just by visiting a page seems far more usable than Skype.

Re: WebRTC is almost here, and it will change the web

#78

Post by vidarh » Tue, Aug 14, 2012, 12:53 PM UTC

taligent wrote: post #40

thebigshane wrote: post #35

Earlier quoted context omitted.

Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Is it going to involve setting up my own trusted server somewhere? Is it going to involve downloading some large undocumented project and have to build myself (on my box and her box)? Is it going to require troubleshooting arcane protocols, firewalls, and xml files? I haven't seen an easy way to have secure…

No offence but I don't think the government could possibly care less about you or the conversation with your mother. There is a long list of far more important and interesting people for them to worry about. How about using whatever is the easiest, most enjoyable and trouble free setup for her to use.

For my part, I used to be an active member of a political party that while completely legal and not advocating anything illegal, due to its position on the far left meant that a lot of people I associated with used to be under surveillance by the Norwegian security services, and many of them were denied entry into the US for years and years.

At the time I was involved, it was less controversial, and so I might have "escaped" surveillance, but I regularly met people who were more than once taunted on open streets by high level people in the security service who'd joke about personal details of their life that they had obtained through surveillance that in no way were relevant to the security services (e.g. asking about the fight some guy had with his wife the previous night).

There are plenty of people today that are in close enough proximity to the types of people and groups who are the subject of security services interests these days that would have every reason to assume that their conversations with their mothers would be monitored just because of either who they are, or who their friends are, or even because of the groups their friend peripherially belongs to.

It's not a situation that is particularly fun to be in, and I understand very well why third parties in situations like that would prefer not to have to think about whether or not someone is listening in for their own gratification.

Re: WebRTC is almost here, and it will change the web

#79

Post by moe » Tue, Aug 14, 2012, 12:54 PM UTC

And when you screw off the wheel it can double as a mop!

What exactly does it help to have your video-feed drive around on a broomstick?

I can see the entertainment value for a couple days. But when it's time to get work done again I sure as hell don't see people preferring a video broomstick next to their desk over a plain old skype-window...

Re: WebRTC is almost here, and it will change the web

#80

Post by huggyface » Tue, Aug 14, 2012, 1:35 PM UTC

scriptproof wrote: post #60

shawndumas wrote: post #32

"This is the most significant step forward in web browser connectivity since 2004, when Google launched Gmail and AJAX was coined." Microsoft --> AJAX[1]. And yes, I know that they aren't saying that Google --> AJAX but it kinda leaves that impression. ---- http://garrettsmith.net/blog/archives/2006/01/microsoft_inve...

Microsoft invented XMLHTTP, an ActiveX object, not XMLHttpRequest, that is similar but not proprietary, and a part of Ajax. And Ajax is a term invented by Garrett - and not Microsoft - that includes several W3C formats.

"AJAX" the term is a meaningless bit of inaccurate noise (it is wrong in almost every way). No idea what your bit about XMLHttpRequest was, given that was nothing more than a formalizing and cross-platform implementation of Microsoft's COM object (which itself was originally written for Outlook Web Access).

Like the GP that bit about AJAX was just all wrong. Garrett is so astonishingly irrelevant in all of this, as is the AJAX me-too title. Google was very important, but only insofar as they legitimized the technique and made a lot of people realize that this crazy web thing was a lot more powerful than people often thought. And it wasn't gmail -- it was Google Suggests. That was an atomic bomb on webapps that proved that highly dynamic pages were possible and preferable.

Me - using XmlHttp(Request) since 2001.