Re:Why TLS 1.3 isn't in browsers yet
by banachtarski on Wednesday December 27, 2017 @06:45PM
(#16019105)
They essentially can via the WebRTC api, albeit in a more cumbersome way. There's nothing inherently insecure about it and the onus rests on the serving party and the browser itself to ensure no foul play is happening.
[ Parent
| on HN ]
Doesn't WebRTC have a handshake protocol to ensure that the other end expects the WebRTC media stream?
Re:Why TLS 1.3 isn't in browsers yet
by banachtarski on Wednesday December 27, 2017 @09:51PM
(#16019965)
If you allow a browser to open sockets to random places, it's the exact same principle! The onus is on the listener to ensure that the people communicating respect the agreed upon protocol.
Re:Why TLS 1.3 isn't in browsers yet
by tokenizerrr on Wednesday December 27, 2017 @10:53PM
(#16020194)
Then every browser could be used to send spam. It would be horrible. Imagine that every person who visits a compromised page immediately started sending spam emails over smtp. Or spam irc messages.
Flash could do that, and yet I've never heard of it as a problem.
Generally is not a problem, as Flash needs to check a file called "crossdomain.xml" that is served from the destination server, which specifies how Flash can communicate with it.
http://www.adobe.com/devnet/articles/crossdomain_policy_file...
Re:Why TLS 1.3 isn't in browsers yet
by Paul-ish on Wednesday December 27, 2017 @10:14PM
(#16020060)
WebRTC uses DTLS, not TLS, so I don't think it would be useful for determining TLS compatibility.
Re:Why TLS 1.3 isn't in browsers yet
by banachtarski on Wednesday December 27, 2017 @11:52PM
(#16020386)
Yes I'm aware (WebRTC actually uses DTLS, SCTP, RTP, RTCP, ICE, STUN, etc depending on what it's doing). My point is about the objection against being able to "open sockets" in the post I'm responding to...
Re:Why TLS 1.3 isn't in browsers yet
by tialaramex on Thursday December 28, 2017 @01:43AM
(#16020727)
Being able to "open a socket" kind of implies you actually get the socket, not just "Oh, if the far end negotiates the protocol we've pre-agreed then you can also send bytes over it". Web sockets "open a socket" in the sense WebRTC does too, but of course that isn't what you want either.
Only Flash actually has an API like BSD sockets where you can do make TCP connection and send an arbitrary protocol over it. Hence, since they want to test protocol compatibility, they used Flash. Doubtless if Flash didn't exist they would provide a handy Python program or something, and 99% of visitors would never run it.