3 ms·
Don't make the mistake of thinking that because the communication channel is "encrypted", it is secure. SSL can already be compromised (so much for trusting enc
by msutherl 14y ago
Don't make the mistake of thinking that because the communication channel is "encrypted", it is secure. SSL can already be compromised (so much for trusting encrypted transport) and the WebRTC client code could be compromised (always a problem).
- Egregore 14y agoCan you please provide links on how SSL can be compromised?
- rmc 14y agoIt's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for any domain name.
- Egregore 14y agoIt's correct that if root CA is compromised you can make fakes. To protect against this attack browsers should warn when certificate changes, there even is a long standing bug for firefox in mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=471798 https://bugzilla.mozilla.org/show_bug.cgi?id=471798
- nuje 14y agoThe fact that you can bungle WebRTC or SSL/TLS implementation doesn't make it useless for transport security. But of course security building blocks never guarantee properties of the entire system alone. Just like using AES doesn't make or break your security.