3 ms·
You can pass configuration to disable ICE entirely. Looks like it's using PeerJS, which defaults to a config of using a Google STUN server and no TURN servers.
by strbean 2y ago
You can pass configuration to disable ICE entirely.
Looks like it's using PeerJS, which defaults to a config of using a Google STUN server and no TURN servers. Not sure if using a STUN server compromises the E2E in some way?
- server_man3000 2y agoWhy would STUN compromise e2e? STUN just returns your IP
- strbean 2y agoI just didn't want to speculate, as I'm not familiar with the security considerations here. But, thinking about it a bit, couldn't a compromised STUN server establish a MITM by lying to you about your IP, and then relaying to you? This old HN comment describes it: https://news.ycombinator.com/item?id=11192610 https://news.ycombinator.com/item?id=11192610 I don't know if this would break the E2EE here (although if it wouldn't, I'm not sure how a TURN server would either, as that's just a baked in MITM).