WebRTC Copy – OTR and fast file transfers over WebRTC
1–10 of 28 posts
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#2You know what they say about javascript browser crypto, but for what it's worth, it worked fine for transferring a file from my desktop to my phone (Firefox on both ends).
I wonder: when using WebRTC between two devices on a single LAN, is my ISP involved (possibly: beyond bootstrapping the process)?
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#3You know what they say about javascript browser crypto, but for what it's worth, it worked fine for transferring a file from my desktop to my phone (Firefox on both ends). I wonder: when using WebRTC between two devices on a single LAN, is my ISP involved (possibly: beyond bootstrapping the process)?
1. WebRTC is natively compiled into browsers. This app uses WebRTC's data channel to transfer files and WebRTC guarantees that the data channel is encrypted (via DTLS). So - tehcnically the crypto is not javascript based - it's native code similar to crypto over HTTPS.
2. WebRTC tries to create a P2P connection between the devices. The ISP is only involved in the initial bootstrapping of the P2P connection - the actual data packets travel over the LAN and not through your ISP. In the rare case a P2P connection can't be established, a relay might be used (though this is optional).
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#4You know what they say about javascript browser crypto, but for what it's worth, it worked fine for transferring a file from my desktop to my phone (Firefox on both ends). I wonder: when using WebRTC between two devices on a single LAN, is my ISP involved (possibly: beyond bootstrapping the process)?
1. WebRTC is natively compiled into browsers. This app uses WebRTC's data channel to transfer files and WebRTC guarantees that the data channel is encrypted (via DTLS). So - tehcnically the crypto is not javascript based - it's native code similar to crypto over HTTPS. 2. WebRTC tries to create a P2P connection between the devices. The ISP is only involved in the initial bootstrapping of the P2P connection - the actu…
A minor note on 1. - rtccopy.com does use (optionally) OTR in javascript on top of the DTLS channel in order guarantee identity (something not currently guaranteed with the DTLS channel).
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#5The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation.
Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too.
Nice as a demo of technology though.
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#6The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.
Thanks for the feedback.
In defense of this implementation -
- The only external JS loaded on this site is google analytics. Feel free to block this using something like noscript :)
- WebRTC datachannel connections on this site don't use just (optionally) OTR. They have DTLS enabled within the browser. OTR just adds an authentication layer that DLTS currently lacks. So that even if the OTR implementation here was completely compromised, the only possible attack would still be a MiTM on the DTLS channel.
- It's open source (https://github.com/erbbysam/webRTCCopy), so it's available to be hosted elsewhere and all of the libraries used could be re-downloaded.
-Sam
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#7The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.
Thanks for the feedback. In defense of this implementation - - The only external JS loaded on this site is google analytics. Feel free to block this using something like noscript :) - WebRTC datachannel connections on this site don't use just (optionally) OTR. They have DTLS enabled within the browser. OTR just adds an authentication layer that DLTS currently lacks. So that even if the OTR implementation here was com…
Does Google now have a log that I visited:
And if somebody else had visited that same room, would they have a log of that too?
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#8Earlier quoted context omitted.
Thanks for the feedback. In defense of this implementation - - The only external JS loaded on this site is google analytics. Feel free to block this using something like noscript :) - WebRTC datachannel connections on this site don't use just (optionally) OTR. They have DTLS enabled within the browser. OTR just adds an authentication layer that DLTS currently lacks. So that even if the OTR implementation here was com…
Does Google now have a log that I visited: https://rtccopy.com/#csFXmvXW And if somebody else had visited that same room, would they have a log of that too?
It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#9The problem with sites like these are that you have to trust the site owner to not just add some javascript to the page which breaks the security of your conversation. Except this site is worse, because they also let their third party user tracking provider run arbitrary script on every page too. Nice as a demo of technology though.
If your concern is the security of 3rd party JS you should already be using NoSript/ScriptSafe [1]. Keep same-domain policy as safe and 3rd party domains blocked and opt-in only by default.
The day-to-day UX experience of browsing the web is only minimally affected and significantly safer.
Better than adblock.
If your concern is the host operator, well obv can't circumvent that. Unless you use OSS chrome plugins and client code verifications (ala CryptoCat). But that's also an imperfect solution (cue tptacek).
[1] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...
Re: WebRTC Copy – OTR and fast file transfers over WebRTC
#10Earlier quoted context omitted.
Does Google now have a log that I visited: https://rtccopy.com/#csFXmvXW And if somebody else had visited that same room, would they have a log of that too?
It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.