5 ms·
Excellent idea, brilliantly executed. But as a CTO, I would be concerned about the security implications. It makes sense to route traffic via a central server
by lima 7y ago
Excellent idea, brilliantly executed.
But as a CTO, I would be concerned about the security implications.
It makes sense to route traffic via a central server because P2P does not scale to large numbers of participants (which is why things like the Jitsi Videobridge exist despite WebRTC P2P being a thing), but it means your customers have to trust you not to get hacked, be compelled to, or otherwise misplace/record sessions.
Since peers can interact with the remote windows, this is basically a remote control tool, and getting hacked also means being able to inject keystrokes or otherwise compromise clients (as recently demonstrated by TeamViewer). For security-critical things like SRE work this is a particularly big concern.
Adding end-to-end encryption would alleviate some of these concerns and reduce the attack surface to implementation mistakes or compromised software updates, which is far easier to reason about.
Perhaps it's not a concern for a small startup, but it's definitely something larger companies worry about.
Please add support for other platforms and add end-to-end encryption, because I really want to use this!
As suggested by someone else, we would definitely pre-order licenses for Linux and Windows.
- gfodor 7y agoI am pretty sure that E2E encryption is impossible today if you are using a WebRTC SFU since there's no spec for it. The closest thing is PERC Lite [1] which no browsers support, though maybe you could cobble something together native. Is there some path I didn't know about? 1. https://www.meetecho.com/blog/meetecho-and-cosmo-strike-again-perc-lite-integration-in-janus/ https://www.meetecho.com/blog/meetecho-and-cosmo-strike-agai...
- lima 7y agoI don't know about browsers, but I know that Signal implements E2E-encrypted phone calls using WebRTC for signalling.
- wichert 7y agoWebRTC does not do signalling - that is the one part that you always have to provide yourself. WebRTC provides the peer descriptions and ICE candidates that you need to transport to the other party/parties.
- coscreen 7y agoThank you for the in-depth feedback. We're actually using Jitsi as videobridge which comes with encryption built-in but we hear your concerns and security remains a priority for us despite our early stage and we're also working on various OSes.
- imglorp 7y ago> P2P does not scale to large numbers of participants I'm curious about this statement. Intuitively it seems there is already an algorithm to near-optimally distribute updates to a sparsely connected mesh network. You'd want two or three connections from each peer to another, not N:N. Optimal is not necessary as long as you have at-least-once semantics on message delivery; a node can just ignore messages it's seen already, as long as it's not too often. Is there a name for this existing algorithm? On top of that you could overlay a symmetric session key and you'd have full E2E. Then central server would be session initiation only--which could still do authn/z to hand out session keys--and billing/metrics.
- roughfalls 7y agoMy concern about security is that this would be used like Slack, but for apps -- always on, sitting in the background, occasionally has my attention. If I drag an app that has an integrated terminal (e.g., VS Code), could one of my teammates start rooting around in my filesystem? It wouldn't be too hard to use Slack status to determine a time to do this when the other people sharing are not online/not watching.
- coscreen 7y agoThis could theoretically happen but you can also choose to stay passive/appear offline with a touch a button and if you are online/sharing you can see a faint glowing border & hint around the specific display. We've already considered to use other clues to help and will look into this, great feedback!
- coscreen 7y agoWe'd love to chat more on this, please reach out via hello [ at ] coscreen.co and also fill out this form to help us prioritize support for Linux and Windows: https://teamcoscreen.typeform.com/to/IOJ8ql https://teamcoscreen.typeform.com/to/IOJ8ql