3 ms·

Signal: Multi-device calls with ICE forking

• dbrgn 6y ago
  Interesting technique! Do I understand it correctly that offer and ICE candidates are already exchanged and processed before the callee accepts the call? Isn't it quite risky that data received from the network (an SDP offer that needs to be parsed) is passed directly to a gigantic and complex C++ codebase (WebRTC) without any user interaction? This increases the attack surface enormously and also makes vulnerabilities like CVE-2019-17191 possible. (One option how to avoid this would be to cache offer and candidates for unknown contacts, and only process them once a call is accepted...)
  • fulafel 6y ago
    Huh, interesting problem that WebRTC lib one. Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=1936 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
  • dbrgn 6y ago
    Ah, that was already being discussed here https://news.ycombinator.com/item?id=21162929 https://news.ycombinator.com/item?id=21162929 and here: https://twitter.com/HCornflower/status/1180749842349461504 https://twitter.com/HCornflower/status/1180749842349461504