7 ms·

I'm very glad to see this. It's embarrassing to think that, just a few years ago, many major websites used HTTP for all but their login pages, and it took Fires

I'm very glad to see this. It's embarrassing to think that, just a few years ago, many major websites used HTTP for all but their login pages, and it took Firesheep to get them into gear. > For the first of these steps, the community will need to agree on a date, and a definition for what features are considered “new”. For example, one definition of “new” could be “features that cannot be polyfilled”. I hope that includes WebRTC, since WebRTC can be used to figure out your local IP address, which (when combined with your public IP address) is essentially a unique identifier[0]. WebRTC is a technology that enables some great things (like Firefox Hello!), but it's a MASSIVE privacy hole[1], and one that I can't imagine justifying for non-secure endpoints. EDIT: Added link to proof-of-concept attack [0] https://www.browserleaks.com/webrtc https://www.browserleaks.com/webrtc [1] https://github.com/diafygi/webrtc-ips/blob/master/index.html https://github.com/diafygi/webrtc-ips/blob/master/index.html

tootie 11y ago
WebRTC uses DTLS as it's protocol which is encrypted.
- undefined0 11y ago
  That's correct but that doesn't invalidate chimeracoder's point. His/her point was to disable the ability to use WebRTC with Javascript served from an unencrypted website. Currently, https://github.com/diafygi/webrtc-ips/blob/master/index.html https://github.com/diafygi/webrtc-ips/blob/master/index.html can work on unencrypted websites. The fact that WebRTC has an encrypted connection is irrelevant.
tracker1 11y ago
It's worth bearing in mind that in the beginning, https was a significant CPU overhead... Since 2004 or so, much less of one. And since around 2010 CPU is rarely the bottleneck for web applications. I do find it interesting that someone starting out as a significant effort after 2010 would bother having a partially https site, with back and forth jumps for login. It seems to me like it's actually more work than just having it all https and flat.
- manigandham 11y ago
  Amazon does this today, browsing is http.

tootie 11y ago

WebRTC uses DTLS as it's protocol which is encrypted.

undefined0 11y ago
That's correct but that doesn't invalidate chimeracoder's point. His/her point was to disable the ability to use WebRTC with Javascript served from an unencrypted website. Currently, https://github.com/diafygi/webrtc-ips/blob/master/index.html https://github.com/diafygi/webrtc-ips/blob/master/index.html can work on unencrypted websites. The fact that WebRTC has an encrypted connection is irrelevant.

tracker1 11y ago

It's worth bearing in mind that in the beginning, https was a significant CPU overhead... Since 2004 or so, much less of one. And since around 2010 CPU is rarely the bottleneck for web applications. I do find it interesting that someone starting out as a significant effort after 2010 would bother having a partially https site, with back and forth jumps for login. It seems to me like it's actually more work than just having it all https and flat.

manigandham 11y ago
Amazon does this today, browsing is http.