News for hackers. Stuff that matters.

A comment on Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat. Parent comment

Re:Show HN: Briefing – Anonymous, secure, open source WebRTC... by perenzo on Monday June 15, 2020 @10:05AM (#23527422)
Indeed, it is a rather simple algorithm [1] But you can set any name you like, either in the input field or directly in the URL. Protected rooms, where the participants need to know a common secret, are planned to be added to the project, see [2]

[1] https://github.com/holtwick/briefing/blob/master/app/src/com...

[2] https://github.com/holtwick/briefing/issues/1

[ Parent | on HN ]
Re:Show HN: Briefing – Anonymous, secure, open source WebRTC... by seesawtron on Monday June 15, 2020 @10:23AM (#23527631)
Yes password protection would definitely make this more usable.

Have you also seen apprtc [0]? Could you point out if there are any differences you see there to Briefing?

[0] https://appr.tc/

[ Parent | on HN ]
Re:Show HN: Briefing – Anonymous, secure, open source WebRTC... by perenzo on Monday June 15, 2020 @10:41AM (#23527810)
It is basically the same. Briefing is a bit more modern and has a few more features. As I mentioned in the help text on https://brie.fi/ng#help I started the project as a spin off of a virtual classroom project https://peer.school/ Sources https://github.com/holtwick/peer2school
[ Parent | on HN ]
Re:Show HN: Briefing – Anonymous, secure, open source WebRTC... by seesawtron on Monday June 15, 2020 @11:12AM (#23528114)
Cool. Also there is screen share option which is cool. I will pitch it to my peers and see if they catch on ;)
[ Parent | on HN ]
Re:Show HN: Briefing – Anonymous, secure, open source WebRTC... by yencabulator on Monday June 15, 2020 @04:53PM (#23532846)
So it's just javascript Math.random.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

> Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.

Also, even if you had a CSPRNG there, your URL format seems to encode only about 27 bits of data.

[ Parent | on HN ]