Apparently this is based on WebRTC [1]. Which is apparently not affected by the same origin policy. Can anyone explain why WebRTC can't be used for DDOS attacks in the obvious way (a script on a page that can open pages to any IP address could cause every visitor to that page send/receive massive data to an unrelated website, taking the target offline and/or massively inflating their bandwidth bills)?
WebRTC cannot connect to arbitrary IP addresses, only to other browsers that have opened the same page and whose user has authorized a WebRTC connection.
Comments
Apparently this is based on WebRTC [1]. Which is apparently not affected by the same origin policy. Can anyone explain why WebRTC can't be used for DDOS attacks in the obvious way (a script on a page that can open pages to any IP address could cause every visitor to that page send/receive massive data to an unrelated website, taking the target offline and/or massively inflating their bandwidth bills)?
[1] http://en.wikipedia.org/wiki/WebRTC
WebRTC cannot connect to arbitrary IP addresses, only to other browsers that have opened the same page and whose user has authorized a WebRTC connection.