News for hackers. Stuff that matters.

A comment on Peerfetch – Peer-to-Peer HTTP over WebRTC. Parent comment

Re:Peerfetch – Peer-to-Peer HTTP over WebRTC by strbean on Friday August 02, 2024 @02:48AM (#41136671)
You can pass configuration to disable ICE entirely.

Looks like it's using PeerJS, which defaults to a config of using a Google STUN server and no TURN servers. Not sure if using a STUN server compromises the E2E in some way?

[ Parent | on HN ]
Re:Peerfetch – Peer-to-Peer HTTP over WebRTC by server_man3000 on Friday August 02, 2024 @02:53AM (#41136690)
Why would STUN compromise e2e? STUN just returns your IP
[ Parent | on HN ]
Re:Peerfetch – Peer-to-Peer HTTP over WebRTC by strbean on Friday August 02, 2024 @03:39AM (#41136882)
I just didn't want to speculate, as I'm not familiar with the security considerations here.

But, thinking about it a bit, couldn't a compromised STUN server establish a MITM by lying to you about your IP, and then relaying to you? This old HN comment describes it: https://news.ycombinator.com/item?id=11192610

I don't know if this would break the E2EE here (although if it wouldn't, I'm not sure how a TURN server would either, as that's just a baked in MITM).

[ Parent | on HN ]