Re: [rtcweb] Consensus call regarding media security

On Mar 28, 2012 2:08 PM, "Basil Mohamed Gohar" <
abu_hurayrah@hidayahonline.org> wrote:
>
> On 03/28/2012 04:41 PM, Roman Shpount wrote:
> > My main objection is that if an application developer does not take
> > care to develop a secure application, nothing you can do on the
> > standard side will make it a secure application. If I am building a
> > public voice blog that records a voice message that anybody can listen
> > to on the web site security is not needed. My assumption is that a
> > fair number of applications would be like this. So for such
> > applications this is an unnecessary feature.
> >
> > WebRTC will not exist in vacuum. It will communicate with other
> > systems. It is not limited to old SIP devices. It can be something new
> > like server side speech recognition that is integrated with web
> > application. For such application extra code and interop requirements
> > to support security will represent a real and significant cost. Any
> > requirement, unless absolutely necessary will create barriers to entry
> > for new applications. I would like to avoid as many of those as
> > possible.
> > _____________
> > Roman Shpount
> Roman,
>
> You make a lot of good points.  However, the inverse is true as well -
> namely, that is if encryption is not mandated, most implementations will
> likely leave it out,

That means SRTP unnecessary to fullfill major practical usage cases.

The decision to use telnet or ssh for remote desktop should be made by IT
department, not by standard committee.

- jesse

and adoption of secured communications would be
> stifled even longer.  I cannot speak about the implementation
> difficulties, but I can speak from the user side that most people will
> remain ignorant of the underlying technology and not know enough to
> demand nor enable a feature if it is optional to implement and/or use.
>
> As WebRTC is a new standard, requiring encryption will ensure that, at
> least going forward, the important concept of encryption is widely
> adopted correctly from the beginning.  Tacking it on later, no matter
> how much it is emphasized, will be difficult or impossible.
>
> The scope of WebRTC is broad enough to consider that we need to think
> about what's best going forward with regards to its implementation.
> Security by default is one of the best practices in general, the support
> from the browser community and others that are behind it will definitely
> ensure that adoption is widespread enough to make it easy enough to
> integrate into existing systems, as free software solutions will become
> available shortly after the standard emerges.
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb