Re: [rtcweb] Preserving stream isolation when traversing the network

[Randell Jesup <[e-mail]>]

On 3/7/2014 6:16 AM, Harald Alvestrand wrote:
> On 03/07/2014 12:04 PM, Martin Thomson wrote:
>> On 7 March 2014 10:57, Harald Alvestrand <[e-mail]> wrote:
>>> I think that's a very specialized use case.
>> While I agree with much of the rest of your argument, casting this as
>> specialized does our future users a disservice, I think.
>>
>> I appreciate that some companies consider their "value-add" to be so
>> compelling that isolation is something they would not consider.  That
>> doesn't mean that everyone will.
> There may be people in both camps. Probably will be.
>
> I don't think that "companies' value-add" matters in this situation.
> What matters is whether JS access to the media is necessary to achieve
> the applications' purpose.

Right.  The example given by Cullen in previous conversations was that 
if someone is using a service provided by Large Company to have internal 
discussions, they want some assurance that Large Company (serving the JS 
code to them for both ends of the conference) doesn't have access to the 
media streams.

I presented an early look at this issue and the use of origins in the W3 
part of the Feb 2012 IETF/W3 interim in MV.

The more general case is a service that wants to provide people with 
secure calls can use isolated streams (modulo the ability of the 
participants to verify through browser UI that they're being used), or 
conversely the ability to tell the browser not to let the JS application 
(*or* the application at the other side!) access the mediastreams.  
(Note that some uses might break, or (if the app was written knowing the 
user can do this) would disable features. That's fine)

This is solely to protect against the JS.  It does not protect against 
other attacks or the far-end user themselves (who could always have a 
camera/mic pointed at the screen).  Even if you trust the application 
provider, in some cases they may have been hacked, or they may have been 
coerced into spying on you (how *would* that happen....)

The ability to do this is important to some people, for the same sort of 
reasons why someone I worked with building videophones kept a post-it 
note over the camera of the videophone on her desk; she didn't feel safe 
without it.

> We've seen virtual drum kits that you play by waving your hands in front
> of a camera. That application simply can't be made without JS access to
> media; it's inherent in what the function is.
>
> That's my point - there are many such applications.

Sure.  I don't think anyone is seriously proposing making isolated 
streams the default (or aren't anymore).

-- 
Randell Jesup -- rjesup a t mozilla d o t com