Re: [rtcweb] Resolving RTP/SDES question in Paris

[Eric Rescorla <[e-mail]>]

On Fri, Mar 16, 2012 at 4:35 PM, Roman Shpount <[e-mail]> wrote:
> On Fri, Mar 16, 2012 at 6:55 PM, Iñaki Baz Castillo <[e-mail]> wrote:
>>
>> Giving the security responsability to end users as a configurable
>> option is not a good idea. The world would be much better if the
>> browsers would not allow plain HTTP, but it's not possible to change
>> the WWW requeriments and mandate HTTPS given the ammount of plain HTTP
>> deployments. In contrast, WebRTC does not exist yet so *now* is the
>> moment to mandate security.
>>
>
> And you imply that the fact that security is most of the times unnecessary
> and often prohibited, has absolutely nothing to do with using HTTP over
> HTTPS. If you think people in the military or in prisons do not use web
> browsers, think again. Requiring secure communications will prevent them
> from using WebRTC.

This doesn't seem obvious at all. Rather it will require the people who wish
to access their communications to do so explicitly in the same way as
enterprises who wish to monitor HTTPS do so now.

-Ekr