[core] CoAP-over-WebRTC: Continued interest and use case

[Christian Amsüss <[e-mail]>]

Hello coap-webrtcdc authors, hello CoRE group,

I think that in addition to the described use cases, CoAP-over-WebRTC
can become relevant as a bridging tool for local environments where
browser policies make the use of CoAP-over-WS impractical: Browsers are
unwillingn to open unsecured CoAP-over-WS connections from HTTPS secured
sites. Yet, web applications to control local devices will want to ship
via HTTPS to get access to all of the browser's functionality and for
general safety reasons.

Until someone comes up with[1] and browsers adopt[2] a way to get valid
HTTPS certificates for devices without an Internet uplink (or at least
without any practical way of regularly obtaining valid PKI
certificates), that means that a local gateway (say, something opening a
WiFi access point without Internet connectivity, or a local router) is
unreachable using CoAP-over-WS from a shipped application.
CoAP-over-WebRTC between the browser and the gateway device should, as
far as I can tell, be an option there, as the required DTLS session does
not rely on PKI certificates but just on out-of-band exchanged
fingerprints, which could be transported over XMLHttpRequests to an HTTP
server. (That sounds terribly insecure, but a) those exchanges can be
OSCORE-protected, and b) it's not like the proxy will be in any way
trusted).


There has not been any activity around CoAP-over-WebRTC that I could see
after the release of the 2017 -02 draft. Christian and Weiwei, are you
interested in continuing it, or have any pointers in case I'd like to
continue from there?


Kind Regards
Christian

[1]: https://www.w3.org/community/httpslocal/
[2]: I don't have high hopes for the next years

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom