TURN/STUN/Signalling server question

[rugk]

As you advertise the Twilio's STUN/TURN service I am a bit unsure what happens when you do not use it: Because usually browsers have "baked in" their own TURN/STUN and signalling servers, so when WebRTC is e.g. used in Firefox Mozilla's servers are used for that.

This is especially important for the security of WebRTC as the signalling server could MITM the connection.

To prevent MITM attacks is there any additional encryption used - besides WebRTCs default one - such as SaltyRTC? If not you may consider this to improve the security.

[kern]

STUN servers are free, don't know of a free TURN server, though. Correct me if I'm wrong but aren't WebRTC connections end-to-end encrypted? If not, happy to merge a PR that adds the ability to set a password on the uploaded file.

[rugk]

aren't WebRTC connections end-to-end encrypted

Yes, they are, but the signalling server can MITM them.

[rugk]

So I just saw this is more or less already tracked in #22.