Re: [rtcweb] Retransmit: Summary of Alternatives for media keying

[Matthew Kaufman <[e-mail]>]

On Jul 28, 2011, at 6:33 PM, Hadriel Kaplan wrote:

> 
> On Jul 28, 2011, at 1:32 PM, Matthew Kaufman wrote:
>> 
>> You can do that, or you can check the fingerprints via the high path to authenticate each end and prove that there's no MITM on the media path.
> 
> That's assuming the high path itself is secure end-to-end.  Since this group has already agreed to allow HTTP rather than mandate HTTPS, and since it can go from your web service to SIP and beyond, such a guarantee is hard to enforce.


I don't believe we had complete consensus to allow HTTP rather than HTTPS... and of course you are free to not use calling services that aren't using HTTPS, just as you're free to not use web-based email providers or web-based social networking sites that don't require the use of HTTPS.

The guarantee of what happens beyond the service is difficult. The guarantee of what happens within the service goes as far as you can trust the service.

Matthew Kaufman