search

VoluntaryLabs / Bitmarkets

OSX app for Bitmarkets decentralized marketplace
MIT License
111 stars 24 forks source link

Privacy issue in proposed browser-based WebRTC version of Bitmarkets #35

Open ABISprotocol opened 7 years ago

ABISprotocol commented 7 years ago

Due to WebRTC security vulnerability which unnecessarily exposes user information in a proposed browser-based WebRTC version of Bitmarkets, it is suggested that exploration of onion routing be discussed with the objective of eliminating said vulnerability.

WebRTC current working draft attempts to dismiss this by stating that "Even without WebRTC, the Web server providing a Web application will know the public IP address to which the application is delivered... The application can limit this exposure by choosing not to use certain addresses using the settings exposed by the RTCIceTransportPolicy dictionary, and by using relays (for instance TURN servers) rather than direct connections between participants. One will normally assume that the IP address of TURN servers is not sensitive information."

This posture in the WebRTC draft is dismissive of user attempts to be able to be able to make reasonable efforts to have privacy without systems that directly disrupt said attempt. Any application which might use WebRTC should either mitigate this harm or if the harm to users cannot be mitigated / prevented, then WebRTC should be discarded.

This issue is proposed for discussion of this matter and perhaps for code proposals pertaining to any mitigations relating to it.

stevedekorte commented 7 years ago

This is a good point. The long term plan with WebRTC is to onion route messages among peers (within our own network, not Tor) and to use bitmessage-like recipient hiding so the source and destination IPs of a message are sufficiently hidden regardless of whether one has knowledge of the IPs of all peers.

ABISprotocol commented 7 years ago

Is there a development schedule or plan posted for Bitmarkets that indicates target dates (for example, for when onion routing would be accomplished for the WebRTC version) and how to support this effort?

stevedekorte commented 7 years ago

No schedule atm. What kind of contribution would you like to make?

ABISprotocol commented 7 years ago

I've been thinking about setting up a page (something like supportdecentralizedexchanges.org or something of that nature) where various decentralized exchanges and perhaps markets (although right now it's more like market, singular..) would be listed with methods on how to support them financially or in terms of how to contribute code. If there were a development schedule for Bitmarkets this would definitely make background information about the project transparent and it would make it easier for people to support the project (e.g. if they saw there was a document which includes development of onion routing among peers for example as part of the privacy model and maybe even some tentative dates, that would likely make it easier for people to support the project). Example here (doesn't have dates, but does have a general roadmap) https://bitsquare.io/roadmap/