Re: [rtcweb] Let's define the purpose of WebRTC

["Muthu Arul Mozhi Perumal (mperumal)" <[e-mail]>]

|And what is the advantage? you still say exactly the 
|same: a WebRTC client "MUST" allow plain RTP if the 
|peer is not a WebRTC client. Why is that an argument 
|in favour of non mandating SRTP?

We seem to have a group of people concerned about the cost associated with having to upgrade/replace/supplement their non-SRTP capable gears such as PSTN gateways, and I was sympathetic towards them -:) 

|If I'm in a shared WiFi network and receive a call from 
|a non-WebRTC client not supporting SRTP, my neighbors can 
|intercept it.

If the shared WiFi network hasn't employed WiFi encryption, then you would probably be more concerned with your neighbors intercepting all of your traffic than just RTP -:)

|What does such "STUN extension" provides here?

It would tell the browser that the peer (browser) claims WebRTC compliance and so shouldn't allow insecure calling (the STUN extension is added by the browser and the applications has no control over it).

Muthu

|-----Original Message-----
|From: Iñaki Baz Castillo [mailto:[e-mail]]
|Sent: Wednesday, November 09, 2011 7:14 PM
|To: Muthu Arul Mozhi Perumal (mperumal)
|Cc: Avasarala, Ranjit; Ravindran Parthasarathi; Cullen Jennings (fluffy); Olle E. Johansson;
|[e-mail]
|Subject: Re: [rtcweb] Let's define the purpose of WebRTC
|
|2011/11/9 Muthu Arul Mozhi Perumal (mperumal) <[e-mail]>:
|> |And what you state is that, in case the peer does not annouce
|> |support for SRTP then the browser should downgrade security
|> |to plain RTP.
|>
|> No, not based on the SRTP capability advertised by the peer, rather based on whether the peer claims
|it is WebRTC compliant (to make sure calls b/w WebRTC clients are always secure).
|>
|> |The user (web visitor) has no way to know whether the WebRTC
|> |application will contact a WebRTC browser or another device
|> |at the media plane.
|>
|> We could add a STUN extension to indicate compliance to WebRTC, including the supported version
|level if we ever come up with WebRTC2.0.
|
|And what is the advantage? you still say exactly the same: a WebRTC
|client "MUST" allow plain RTP if the peer is not a WebRTC client. Why
|is that an argument in favour of non mandating SRTP?
|
|If I'm in a shared WiFi network and receive a call from a non-WebRTC
|client not supporting SRTP, my neighbors can intercept it. What does
|such "STUN extension" provides here? just nothing.
|
|
|
|
|
|--
|Iñaki Baz Castillo
|<[e-mail]>