IETF Logo Mail Archive

Re: [rtcweb] Please require user consent for data channels

Justin Uberti <juberti@google.com> Fri, 17 July 2015 18:05 UTC

Return-Path: <juberti@google.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFDAC1ACE9F for <rtcweb@ietfa.amsl.com>; Fri, 17 Jul 2015 11:05:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.388
X-Spam-Level:
X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nvkeMP8RJOaO for <rtcweb@ietfa.amsl.com>; Fri, 17 Jul 2015 11:05:05 -0700 (PDT)
Received: from mail-ig0-x22d.google.com (mail-ig0-x22d.google.com [IPv6:2607:f8b0:4001:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C026C1ACE2D for <rtcweb@ietf.org>; Fri, 17 Jul 2015 11:05:05 -0700 (PDT)
Received: by igbpg9 with SMTP id pg9so1399825igb.0 for <rtcweb@ietf.org>; Fri, 17 Jul 2015 11:05:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=QJPW0GLpZxyzUbvk64zfrRX+172++WMmQ1Rsr91Mqio=; b=GJQn1Ht9fviwZIVvhDnVIVTlBCfGwm/rm2AsWPcpZrgCLr0o+fpHNI+QKbA+AsBCTQ 7Kcg4+JmKfTVzPRL+9vdfMLulOzLJrQ++Dqx5zmx0OS4cKKfpS5kBk2Au/D3SIaZgyA3 03kQgsGvZL13dYAmsP6nM029W6H63IfBPTGaUPDu7AJriO1TlXKTDjRKC6UlOJh1bqQU 9yprpltfsUiMi+3DPsMR4pQieeB9xW/k8Q47eya2QMOizWEVK8Ol3jVHqGC4ATXcIq75 x7oDIbLp7zCNdahLiwioMR5u2Hd4rw92qr9p6lvzx98W7YpnncV2aGt/8ZbV5JY6H3uR 3C9w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=QJPW0GLpZxyzUbvk64zfrRX+172++WMmQ1Rsr91Mqio=; b=hlQApei7Cr/h3OmwpygQtBFYMtIh/PKm3hcdwxjiPhHPjeY6XTj094IP5Bd7Vrb0aK hRHnObrKPcCBaCi5HHV6FLfAqd8Mkov9KTBdUcXDr3xLbX5f6TfaKGJd6zVlv9oi4Ydv ZS/kD0oHKuAHZ3VCXknLHg53fHh9bphTEPrC11itiQYM5IXTR4nKJPSrRfZsV8I1Q3/5 tspN/upAL3lVXNnh/KYep2nLhRwRJgmIKAQ6+GR102FntlNk1jYF98muRuzqMo+DCd83 4MssD4WC3kPAesaRIZJUsAg16T9KU58RUxumselFvBJBypUD3cXrQDdau4OC2pVc8wnh HiPg==
X-Gm-Message-State: ALoCoQlWT4eFlXpQyFZ3cFQfAyo4XCa6rMFZ+GcGtnscqq9YnRFA2AGYMwZUmvcBujfXpev2mkYc
X-Received: by 10.50.29.75 with SMTP id i11mr12246410igh.50.1437156304942; Fri, 17 Jul 2015 11:05:04 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.64.32.233 with HTTP; Fri, 17 Jul 2015 11:04:45 -0700 (PDT)
In-Reply-To: <CA+65OspMD_PVjk0BXh7t4LtjmFDcDatoeNjFQOO_OVtC-Br+OA@mail.gmail.com>
References: <CA+65OspMD_PVjk0BXh7t4LtjmFDcDatoeNjFQOO_OVtC-Br+OA@mail.gmail.com>
From: Justin Uberti <juberti@google.com>
Date: Fri, 17 Jul 2015 11:04:45 -0700
Message-ID: <CAOJ7v-0UBGtP0-atxP7X4OTj-H6Lost5o42aAS65mA6CEqcQsw@mail.gmail.com>
To: Daniel Roesler <diafygi@gmail.com>
Content-Type: multipart/alternative; boundary="047d7bd767780b33d3051b1607b6"
Archived-At: <http://mailarchive.ietf.org/arch/msg/rtcweb/370aTNS8r6KJsybElDVzDN4Wog0>
Cc: "rtcweb@ietf.org" <rtcweb@ietf.org>
Subject: Re: [rtcweb] Please require user consent for data channels
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jul 2015 18:05:06 -0000

>
>
> I'm really unclear on why it's so important to have the silent webRTC
> data channel behavior. P2P data connections should be held to the same
> consent requirements just like P2P video and voice connections. In
> addition to the silent third party local IP tracking, a silent P2P
> data channel opens up users to silently becoming nodes in a web-based
> file sharing network. For example, webtorrent[2] can be silently
> embedded on a website so that all of the users to that website start
> seeding content they don't know they are seeding.
>
>
>
This is already possible using non-WebRTC technologies, e.g. web sockets.
As such, I don't think that permission should be needed to create a data
channel, or receive (but not send) media.

That said, I agree that WebRTC should not allow drive-by harvesting of IP
addresses, and we intend to make changes to Chrome to prevent this.

v2.23.0 | Report a Bug | By Email