Re: [rtcweb] No Interim on SDES at this juncture

["Timothy B. Terriberry" <[e-mail]>]

Hadriel Kaplan wrote:
> Right, and I'm hoping the Browser vendors can tell us if browsers can safely know whether all the JS running on a given page is from HTTPS or not, and not allow SDES if the JS is not all from (signed) HTTPS.  If not, then I agree that's another negative downside for SDES.  In fact I think it's even a problem for DTLS-SRTP.  I don't know why we'd be ok with using HTTP at all, if we're *truly* concerned about MitM and malicious 3rd party JS attacks.

Yes, this is detectable. As I said at the mic in Beijing, however, this 
is a property that can change at any time, because a page can load 
script from a new, programmatically constructed URL at any point. See 
Section 5.1 of the updated draft-ietf-rtcweb-security-arch-07.

That makes it difficult to design security policy guarantees (it might 
seem "safe" to access a resource when you ask to access it, but very 
difficult to revoke access later when you realize it's not safe). For 
that reason among many others, browsers have been moving to simply block 
mixed content entirely. See 
<https://blog.mozilla.org/security/2013/06/27/mixed-content-blocker-hits-firefox-beta/>. 
Firefox will release this in August. Chrome already does this. IE has 
prompted users since at least IE 7.