A short transcripted exchange from a YouTube video (by Tsahi Levent-Levi) where two speakers discuss whether WebRTC is a security risk. They conclude that WebRTC itself (a C library embedded in browsers) has seen few direct security issues recently, though browser integrations have had CVEs; primary concerns are application-level vulnerabilities (e.g., camera access) and privacy exposures like revealing IP addresses.
Is WebRTC a security risk?
Well, it is a C library embedded into the browser, so there are some security concerns there. But what we've seen in the last year or so was no WebRC related security issues. In Chrome, for example, we see some, but all of them that we've seen were in how Chrome is using libreprocess in very weird ways. And that blew up, got a couple of CVEs, but that was nothing in the privacy itself or in the protocols around it.
Okay, and that's from the point of view of the technology stack itself.
Yes. Now from the user perspective, it's less of a security risk because, oh, it's running inside the browser. We know that Google is reasonably on top of issues there. You might consider the privacy risk because, oh, it gives out your IP address, which is something people get upset about a lot.
And then there is a part of the application that is written on top of WebRTC and that's. There are security issues there that relate to the application and not to WebRTC.
Yes, yes, but for example, your application might have a legitimate interest to access a camera. But what if your application code is being exploited? It has access to the camera. Not good.
Exactly. Okay, thank you.
Thank you.
Meta rebuilt AV1 for mobile scale. Should smaller teams follow? | Chats with Arin
