IETF Logo Mail Archive

Re: [rtcweb] Please require user consent for data channels

"Timothy B. Terriberry" <tterriberry@mozilla.com> Mon, 13 July 2015 18:54 UTC

Return-Path: <tterriberry@mozilla.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87A781B2D37 for <rtcweb@ietfa.amsl.com>; Mon, 13 Jul 2015 11:54:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.989
X-Spam-Level:
X-Spam-Status: No, score=-5.989 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_ORG=0.611, HOST_MISMATCH_COM=0.311, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iRBtCD9fD89b for <rtcweb@ietfa.amsl.com>; Mon, 13 Jul 2015 11:54:57 -0700 (PDT)
Received: from smtp.mozilla.org (mx1.scl3.mozilla.com [63.245.214.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC7041B2D2A for <rtcweb@ietf.org>; Mon, 13 Jul 2015 11:54:56 -0700 (PDT)
Received: from localhost (localhost6.localdomain [127.0.0.1]) by mx1.mail.scl3.mozilla.com (Postfix) with ESMTP id 0E1C1C1D3A; Mon, 13 Jul 2015 18:54:56 +0000 (UTC)
X-Virus-Scanned: amavisd-new at mozilla.org
Received: from smtp.mozilla.org ([127.0.0.1]) by localhost (mx1.mail.scl3.mozilla.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1U5ioq88M3M4; Mon, 13 Jul 2015 18:54:55 +0000 (UTC)
Received: from [10.252.28.163] (corp.mtv2.mozilla.com [63.245.221.32]) (Authenticated sender: tterriberry@mozilla.com) by mx1.mail.scl3.mozilla.com (Postfix) with ESMTPSA id E92AAC2910; Mon, 13 Jul 2015 18:54:55 +0000 (UTC)
Message-ID: <55A4097F.3060106@mozilla.com>
Date: Mon, 13 Jul 2015 11:54:55 -0700
From: "Timothy B. Terriberry" <tterriberry@mozilla.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:29.0) Gecko/20100101 SeaMonkey/2.26
MIME-Version: 1.0
To: Michael Tuexen <Michael.Tuexen@lurchi.franken.de>, Daniel Roesler <diafygi@gmail.com>
References: <CA+65OspMD_PVjk0BXh7t4LtjmFDcDatoeNjFQOO_OVtC-Br+OA@mail.gmail.com> <55A22A1B.4000202@gmail.com> <CA+65OspKCvwFh0GebiuUrhdtaL9zxYKLw04HdKEfewLCWQ+ZpQ@mail.gmail.com> <804017F1-0211-43F0-9CE3-1F51A9C9E705@lurchi.franken.de>
In-Reply-To: <804017F1-0211-43F0-9CE3-1F51A9C9E705@lurchi.franken.de>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/rtcweb/4D6Zqx-RCEmT9mYQLsTPA3fy7fQ>
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] Please require user consent for data channels
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Jul 2015 18:54:59 -0000

Michael Tuexen wrote:
> Don't you ask for user consent for a peer connection?

No.

Since there seems to be some misunderstanding on this thread: consent is 
required for getUserMedia (camera/microphone) access. This is true 
regardless of whether or not you send that data anywhere over the 
network. User consent is not required for a peer connection (since you 
cannot use it to send any data that you could not otherwise have just 
relayed through the server, e.g., via WebSockets).

Consent *is* required by the other side to continue receiving your data 
(to prevent DDoS attacks), but that is automatic and does not require 
user intervention (other than viewing a page/running a program designed 
to operate the other end of the PeerConnection).

These issues are all detailed in 
<https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch>. I would 
encourage those participating in this thread to read that document. We 
could always benefit from additional review.

v2.23.0 | Report a Bug | By Email