Re: [pntaw] TURN over websockets

On 08/31/2013 06:33 PM, Martin Thomson wrote:
> On 31 August 2013 09:24, Parthasarathi R <partha@parthasarathi.co.in> wrote:
>> In case of (firewall) Policy vs protocol, the policy is the final decision
>> maker and not the protocol. In case TURN over WebSocket is chosen, it is a
>> matter of time for firewall policy enhancement to block these rat holes in
>> the network.
> 
> I'm glad someone raised this point.  It's core to the discussion.
> What, if any, visibility will a firewall or proxy be given into the
> purpose of this exchange?   HTTP CONNECT followed by TLS doesn't give
> the intermediary much of a chance to enforce policy.

Just a note on this: Proposed solutions that require a man in the
middle attack on TLS are not likely to fare well. The security ADs
(incl me:-) are *very* strongly against messing about with TLS like
that. So I hope this design team effort (or whatever it is) don't
go down that road. And of course there's no need to go there either,
if you want to know what WebRTC stuff is going on, then there should
be fine WebRTC ways to do that that don't involve a TLS MITM attack.

Cheers,
S.

> _______________________________________________
> pntaw mailing list
> pntaw@ietf.org
> https://www.ietf.org/mailman/listinfo/pntaw
> 