From: Juliusz Chroboczek <jch@irif.fr> To: "Cell" <galene.org@kn1ght.org> Cc: galene@lists.galene.org Subject: [Galene] Re: coturn config Date: Sun, 27 Dec 2020 20:27:46 +0100 [thread overview] Message-ID: <87y2hjt5fx.wl-jch@irif.fr> (raw) In-Reply-To: <87zh1zt6ip.wl-jch@irif.fr> >> More about my context: I just put a coturn in place for my synapse >> server and it's working. I would like to use the same one in place for >> a future galene but I don't know if the secret for the API is in >> conflict with the user/password needed for galene. > According to what Toke explained to me, Cell is referring to this protocol: > https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00 I've now read this document a second time, and I still don't get it. Could somebody please explain the purpose of this protocol? In normal TURN, there is a username/password key that must be known by the WebRTC peers. That's well known to be insecure, but it only protects access to the TURN server, so the only bad thing that could happen is that the TURN server will be used by other services. With the REST API, we introduce an extra web server. The web server and the TURN server somehow coordinate to generate ephemeral passwords (for a very lax notion of ephemeral -- the draft recommends 86400 seconds) which are communicated over HTTP to the WebRTC peers. The TURN credentials are now being rotated periodically, granted, but an attacker can simply contact the web server to find out what they are. We're adding an extra point of failure, but I don't see what we are gaining. What am I missing? -- Juliusz
next prev parent reply other threads:[~2020-12-27 19:28 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-12-27 16:57 [Galene] " Cell 2020-12-27 17:55 ` [Galene] " Toke Høiland-Jørgensen 2020-12-27 18:02 ` Cell 2020-12-27 18:06 ` Cell 2020-12-27 18:16 ` Toke Høiland-Jørgensen 2020-12-27 19:04 ` Juliusz Chroboczek 2020-12-27 19:27 ` Juliusz Chroboczek [this message] 2020-12-27 20:32 ` Toke Høiland-Jørgensen 2020-12-27 23:28 ` Juliusz Chroboczek 2020-12-28 1:38 ` Toke Høiland-Jørgensen 2020-12-28 18:49 ` Juliusz Chroboczek 2020-12-28 19:59 ` Toke Høiland-Jørgensen 2020-12-29 1:56 ` Juliusz Chroboczek 2020-12-29 2:09 ` Toke Høiland-Jørgensen 2020-12-29 8:35 ` Michael Ströder 2021-01-01 22:55 ` Juliusz Chroboczek 2021-01-01 23:43 ` Gabriel Kerneis 2021-01-02 0:02 ` Juliusz Chroboczek 2021-01-07 12:07 ` Michael Ströder 2021-01-07 12:14 ` Toke Høiland-Jørgensen 2021-01-07 12:31 ` [Galene] logging (was: coturn config) Michael Ströder 2021-01-07 13:27 ` [Galene] Re: coturn config Juliusz Chroboczek
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style List information: https://lists.galene.org/postorius/lists/galene.lists.galene.org/ * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=87y2hjt5fx.wl-jch@irif.fr \ --to=jch@irif.fr \ --cc=galene.org@kn1ght.org \ --cc=galene@lists.galene.org \ --subject='[Galene] Re: coturn config' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox