Re: [rtcweb] Security implications of host candidates

youenn fablet <youennf@gmail.com> Tue, 03 July 2018 16:29 UTC

MIME-Version: 1.0
References: <CAOJ7v-1t_BDEEHmA4eqiS9ksYOOyHUz9LFLhQxs8FhjTdswP5w@mail.gmail.com> <CANN+akZLRdZdexjU44zPCA6vdQR0hVYT17_4P8DefC0JbRL5mA@mail.gmail.com> <CAOJ7v-2JdiMJ9iWE_cL8G7xDM6iekexJL8KLEbz0jD=p7hiGZg@mail.gmail.com>
In-Reply-To: <CAOJ7v-2JdiMJ9iWE_cL8G7xDM6iekexJL8KLEbz0jD=p7hiGZg@mail.gmail.com>
From: youenn fablet <youennf@gmail.com>
Date: Tue, 03 Jul 2018 09:21:22 -0700
Message-ID: <CANN+akbv2mpyhgV5vxDHKcsA8UPsSEr0bEjJK4xYxtvbkXNA7w@mail.gmail.com>
To: Justin Uberti <juberti@google.com>
Cc: youenn fablet <yfablet@apple.com>, RTCWeb IETF <rtcweb@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000026d6f905701ab55b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtcweb/PI4MJmOx-ZEPUQKNeHO_LNLwXXU>
Subject: Re: [rtcweb] Security implications of host candidates
Precedence: list

>
> Maybe I don't understand the attack well enough, but if a page running in
> a private browsing context tried to communicate with a page not running in
> a private browsing context, they would probably see < 1ms RTTs for both
> host-host and srflx-srflx candidates in many cases (including cases where
> the contexts are on different machines).
>

This is probably true for good ethernet connections.
Connections over wifi have usually a bigger/less stable latency than local
loop connections.
I uploaded a small example (
https://evening-thicket-98446.herokuapp.com/src/content/peerconnection/datachannel-b2b/)
that computes ping-pong host-host latency through data channel.

Re: [rtcweb] Security implications of host candid… westhawk
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Feross Aboukhadijeh
[rtcweb] Security implications of host candidates Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Lennart Grahl
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Manuel Kasper
Re: [rtcweb] Security implications of host candid… Nils Ohlmeier
Re: [rtcweb] Security implications of host candid… Justin Uberti