[rtcweb] What is consent?

[Martin Thomson <[e-mail]>]

What specific properties of a STUN Binding request does the browser
use to determine that the peer has consented to receive packets?

>From what I can infer, it's simply the existence of a response.  That
is insufficient.

-security says:
   [...]  ICE provides this verification as
   well, by using the STUN credentials as a form of per-session shared
   secret.  Those credentials are known to the Web application, but
   would need to also be known and used by the STUN-receiving element to
   be useful.

But that's not strictly correct.  The Binding response necessarily
does not include MESSAGE-INTEGRITY, which is the critical tie to
per-session credentials.

What then would prevent the browser from mistaking a response from a
STUN server as consent?

The STUN server doesn't need to check MESSAGE-INTEGRITY and USERNAME
is systematically ignored where it is not used, so we can't rely on
the server doing something helpful for itself.  I imagine that
stunserver.org could be made safe because it doesn't provide
FINGERPRINT in responses (it's 3489 compliant, not 5389).  But what a
5389 STUN server?

Hopefully, I'm just missing something.  But this has been bugging me.

--Martin