From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; spf=pass (mailfrom) smtp.mailfrom=irif.fr (client-ip=2001:660:3301:8000::1:2; helo=korolev.univ-paris7.fr; envelope-from=jch@irif.fr; receiver=) Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) by mail.toke.dk (Postfix) with ESMTPS id C20247BFF6A for ; Sun, 27 Dec 2020 20:28:00 +0100 (CET) Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id 0BRJS0Eb000599; Sun, 27 Dec 2020 20:28:00 +0100 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 7F190A858B; Sun, 27 Dec 2020 20:28:00 +0100 (CET) X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id 0Hm_-5DB_9XA; Sun, 27 Dec 2020 20:27:58 +0100 (CET) Received: from pirx.irif.fr (82-64-141-196.subs.proxad.net [82.64.141.196]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id 23904A8588; Sun, 27 Dec 2020 20:27:58 +0100 (CET) Date: Sun, 27 Dec 2020 20:27:46 +0100 Message-ID: <87y2hjt5fx.wl-jch@irif.fr> From: Juliusz Chroboczek To: "Cell" In-Reply-To: <87zh1zt6ip.wl-jch@irif.fr> References: <1082cfcde178ddb72b51bcd03ee6770a@kn1ght.org> <87zh1zt6ip.wl-jch@irif.fr> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.1 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [194.254.61.138]); Sun, 27 Dec 2020 20:28:00 +0100 (CET) X-Miltered: at korolev with ID 5FE8E040.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 5FE8E040.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 5FE8E040.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham Message-ID-Hash: MPMWPW6EVRVLN3LHIOXXIIUYMMIFRU42 X-Message-ID-Hash: MPMWPW6EVRVLN3LHIOXXIIUYMMIFRU42 X-MailFrom: jch@irif.fr X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header CC: galene@lists.galene.org X-Mailman-Version: 3.3.2 Precedence: list Subject: [Galene] Re: coturn config List-Id: =?utf-8?q?Gal=C3=A8ne_videoconferencing_server_discussion_list?= Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: >> More about my context: I just put a coturn in place for my synapse >> server and it's working. I would like to use the same one in place for >> a future galene but I don't know if the secret for the API is in >> conflict with the user/password needed for galene. > According to what Toke explained to me, Cell is referring to this protocol: > https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00 I've now read this document a second time, and I still don't get it. Could somebody please explain the purpose of this protocol? In normal TURN, there is a username/password key that must be known by the WebRTC peers. That's well known to be insecure, but it only protects access to the TURN server, so the only bad thing that could happen is that the TURN server will be used by other services. With the REST API, we introduce an extra web server. The web server and the TURN server somehow coordinate to generate ephemeral passwords (for a very lax notion of ephemeral -- the draft recommends 86400 seconds) which are communicated over HTTP to the WebRTC peers. The TURN credentials are now being rotated periodically, granted, but an attacker can simply contact the web server to find out what they are. We're adding an extra point of failure, but I don't see what we are gaining. What am I missing? -- Juliusz