4 ms·

I'm interested in the security of WebRTC. Is it end to end? Can it be easily MITMed? What are its main flaws from a security design point of view?

alexfreska 13y ago
Some of the security is explained in an overview at Google IO. Here is a video: http://youtu.be/p2HzZkd2A40?t=22m18s http://youtu.be/p2HzZkd2A40?t=22m18s
lallysingh 13y ago
It's end-to-end, but you need a way to validate that you're talking to the peer that you think that you are - there's no certificate authority verifying client certs (in the normal case, I haven't explored traditional client-side certs for webrtc).
jmspring 13y ago
Eric Rescorla does a good job of describing the security architecture and concerns around webrtc here: http://tools.ietf.org/id/draft-ietf-rtcweb-security-arch-09.txt http://tools.ietf.org/id/draft-ietf-rtcweb-security-arch-09.... and http://tools.ietf.org/id/draft-ietf-rtcweb-security-06.txt http://tools.ietf.org/id/draft-ietf-rtcweb-security-06.txt
wbl 13y ago
It's still a work in progress. Right now if you trust the service to connect you to the right person, everything works out. However, they aim to make things work even if you don't, and the jury is still out about whether or not they can make a UI that reflects this safely. Furthermore, there are some anonymity issues related to the use of RSA to secure the SRTP connections. The identity provider portion involves trying to sandbox javascript in new and interesting ways. However, most of the pieces are fairly well understood, and the breaks will happen because identity providers mess up.
ryanseys 13y ago
I worked as an intern with Mozilla last summer on helping to improve the issues around security in WebRTC specifically related to authentication and the possibility of MITM attacks. You can watch my intern presentation at [1] which goes through a very high level overview of the state of authentication in WebRTC and an example implementation of how WebRTC could be built into the browser to include authentication: [1]: https://air.mozilla.org/intern-presentation-seys/ https://air.mozilla.org/intern-presentation-seys/ TLDR: E2E encryption is included, but authentication is currently non-existent, allowing for pretty easy MITM attacks if you have control of the relaying website.

alexfreska 13y ago

Some of the security is explained in an overview at Google IO. Here is a video: http://youtu.be/p2HzZkd2A40?t=22m18s http://youtu.be/p2HzZkd2A40?t=22m18s

lallysingh 13y ago

It's end-to-end, but you need a way to validate that you're talking to the peer that you think that you are - there's no certificate authority verifying client certs (in the normal case, I haven't explored traditional client-side certs for webrtc).

jmspring 13y ago

Eric Rescorla does a good job of describing the security architecture and concerns around webrtc here: http://tools.ietf.org/id/draft-ietf-rtcweb-security-arch-09.txt http://tools.ietf.org/id/draft-ietf-rtcweb-security-arch-09.... and http://tools.ietf.org/id/draft-ietf-rtcweb-security-06.txt http://tools.ietf.org/id/draft-ietf-rtcweb-security-06.txt

wbl 13y ago

It's still a work in progress. Right now if you trust the service to connect you to the right person, everything works out. However, they aim to make things work even if you don't, and the jury is still out about whether or not they can make a UI that reflects this safely. Furthermore, there are some anonymity issues related to the use of RSA to secure the SRTP connections. The identity provider portion involves trying to sandbox javascript in new and interesting ways. However, most of the pieces are fairly well understood, and the breaks will happen because identity providers mess up.

ryanseys 13y ago

I worked as an intern with Mozilla last summer on helping to improve the issues around security in WebRTC specifically related to authentication and the possibility of MITM attacks. You can watch my intern presentation at [1] which goes through a very high level overview of the state of authentication in WebRTC and an example implementation of how WebRTC could be built into the browser to include authentication: [1]: https://air.mozilla.org/intern-presentation-seys/ https://air.mozilla.org/intern-presentation-seys/ TLDR: E2E encryption is included, but authentication is currently non-existent, allowing for pretty easy MITM attacks if you have control of the relaying website.