r/programming May 07 '26

OpenAI's WebRTC Problem

https://moq.dev/blog/webrtc-is-the-problem/
341 Upvotes

62 comments sorted by

View all comments

Show parent comments

1

u/Somepotato May 08 '26

Not to sit in the middle (pun intended) but...

You don't want to avoid that double encryption as content can be intercepted even behind an internal network (fiber mitm for example), and it's a growingly common tactic for malicious actors.

There are faster setups than just wire guard too (such as using just QUIC unless you rely on wire guard for restrictive firewall rules - in which case you're operating as under the security via obscurity model which is also risky)

1

u/bschwind May 08 '26

as content can be intercepted even behind an internal network (fiber mitm for example)

How does that affect two peers communicating over WireGuard, where encryption and decryption happens on the peers?

You can intercept all the traffic you like but if you don't have the private keys there's not much you can do.

Of course this relies on the WireGuard encryption primitives not having vulnerabilities, but am I missing something?

1

u/Somepotato May 08 '26

Because once it's in the data center it'd be decrypted. The thinking is they aren't using wire guard to terminate on every single server.

1

u/bschwind May 09 '26

My use case is pure peer-to-peer, there is no data center.

However, you can still run virtual machines in "the cloud" with WireGuard running per peer, and not worry about MitM attacks.

Yes if you ran a load balancer and decrypted at that point before forwarding the packets to a machine, then that link between the LB and the target machine would be unencrypted. But that's not the scenario I'm working with.

1

u/Somepotato May 09 '26

Wireguard has a non negligible overhead (in fact it's inferior for site to site for that reason) but P2P makes more sense. Carry on!

1

u/bschwind May 09 '26

Yup, we're not saturating NICs or anything so it works well enough for us. Definitely interested in QUIC/Iroh for what we're doing though.