Re: [rtcweb] Security implications of host candidates

[Justin Uberti <[e-mail]>]

I wasn't able to get that example to work (tried with 2 Chrome and 2 Safari
instances, got a setRemoteDescription error both times), but I was able to
make a JSFiddle <https://jsfiddle.net/juberti/x7a8ut0q/25/> which does
something similar in a single page. At present, even host-host connections
were seeing a 2 ms RTT, possibly because of the clamping
<https://developer.mozilla.org/en-US/docs/Web/API/Performance/now> that has
been applied to performance.now() to deal with Spectre et al.





On Tue, Jul 3, 2018 at 9:21 AM youenn fablet <[e-mail]> wrote:

> Maybe I don't understand the attack well enough, but if a page running in
>> a private browsing context tried to communicate with a page not running in
>> a private browsing context, they would probably see < 1ms RTTs for both
>> host-host and srflx-srflx candidates in many cases (including cases where
>> the contexts are on different machines).
>>
>
> This is probably true for good ethernet connections.
> Connections over wifi have usually a bigger/less stable latency than local
> loop connections.
> I uploaded a small example (
> https://evening-thicket-98446.herokuapp.com/src/content/peerconnection/datachannel-b2b/)
> that computes ping-pong host-host latency through data channel.
>