Re: [dispatch] [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

[Ben Campbell <[e-mail]>]

On Jan 29, 2014, at 11:30 AM, Peter Dunkley <[e-mail]> wrote:

> Point 1) is terribly important IMHO. Note that for WebRTC applications
> to be "friendly" HTTPS is required (so the user is not prompted by the
> browser for permission every time a WebRTC session is requested via
> getUserMedia). So let's assume that WebRTC, in fact, requires HTTPS.
> Taking into account point 1) above, we also need Secure WebSocket
> ("wss") for MSRP or for anything.
> 
> 
> Which is great on the Internet but a real pain on an internal network where you don't want to pay for a certificate or import something into every single device/computer on your network.  That's the same reason people usually don't use HTTPS on internal networks!

I assumed MSRP/WebSocket was intended for the Internet. If not, perhaps an applicability statement would be in order, even if just for this particular requirement--although I tend to be skeptical of or "MUST use unless you are on a private network" constructs. But I can see situations where, for example, you've got protection at a lower layer (e.g. IPSec, VPNs, etc.) where it might make sense.

(BTW, more and more enterprise networks are moving to use HTTPS internally.)

> 
> Hence my belief that SHOULD was the right thing here.  People SHOULD use TLS security, but saying MUST will just mean that this is a MUST people ignore on certain deployment types.  What is the point of mandating something when people will just ignore it when it doesn't suit them?
> 
> I get that security is important and the IETF is full of security idealists, and all IETF protocols should be secure, by in this particular situation it feels like using MUST instead of SHOULD would be done simply because in the IETF you always say MUST for security (whether people will use it or not).

Actually, not so many IETF protocols say "MUST use". "MUST implement" is more common. But MSRP was an attempt to move to a more secure model, so the authors are going to be sensitive to anything that reduces that. And I suspect you will see more "MUST use" requirements these days than you might have this time last year.

Again, I think we should consider a wider policy on how to apply application protocol security requirements when the application moves to WebSocket. MSRP is an interesting test case due to the "MUST use" requirement.

>