Re: [rtcweb] draft-schwartz-rtcweb-return

"Cullen Jennings (fluffy)" <fluffy@cisco.com> Wed, 08 April 2015 00:58 UTC

From: "Cullen Jennings (fluffy)" <fluffy@cisco.com>
To: "rtcweb@ietf.org" <rtcweb@ietf.org>
Thread-Topic: draft-schwartz-rtcweb-return
Thread-Index: AQHQcZcXNcaRDaX+lUCRQe6Qs13tdg==
Date: Wed, 08 Apr 2015 00:58:29 +0000
Message-ID: <6042868B-57EB-4C5A-B93E-C58D846E14E4@cisco.com>
References: <9DA8307B-263C-4951-A55C-36B42D27C08B@cisco.com>
In-Reply-To: <9DA8307B-263C-4951-A55C-36B42D27C08B@cisco.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <0515A927655C71489A47EEE69D08AE57@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/rtcweb/7iGzlpnPN7yeT-yXgAoqOfEnBrI>
Subject: Re: [rtcweb] draft-schwartz-rtcweb-return
Precedence: list

> On Mar 26, 2015, at 9:20 AM, Cullen Jennings <fluffy@cisco.com> wrote:
> 
> I'd like to point out that the combination of ietf-tram-turn-server-discovery and draft-schwartz-rtcweb-return allow any network you are connected to more or less MITM your media and do things like rate limit it, generate analytics on who you are talking to, force your traffic through an intermediary that is in a  different legal jurisdiction and so on. 

We discussed this after the meeting and came up with a  way to resolve this concern. Benjamin has added some text to the -06 to that specifically addresses this issue

http://www.ietf.org/rfcdiff?url1=draft-schwartz-rtcweb-return-05&url2=draft-schwartz-rtcweb-return-06

This completely deals with the issue I raised and with that change I support adopting this as a WG document. 

After adoption, I think the WG should consider if any text is needed around the issue of TURN credentials. (If you run TURN with no credentials and an attacker can spoof the IP address in UDP packets, you can end up with the TURN servers in a nasty forwarding loop that allows an huge amplification factor for an attacker trying do DOS the turn servers - this is still possible with authentication but you know who to blame. When TURN was first done with was one of the reason TURN requires auth and STUN does not). However, I believe this issue can solved and should not block adopting the draft. )

Cullen

[rtcweb] draft-schwartz-rtcweb-return Cullen Jennings
Re: [rtcweb] draft-schwartz-rtcweb-return Benjamin Schwartz
Re: [rtcweb] draft-schwartz-rtcweb-return Alan Johnston
Re: [rtcweb] draft-schwartz-rtcweb-return Justin Uberti
Re: [rtcweb] draft-schwartz-rtcweb-return Prashanth Patil (praspati)
Re: [rtcweb] draft-schwartz-rtcweb-return Hutton, Andrew
Re: [rtcweb] draft-schwartz-rtcweb-return Cullen Jennings (fluffy)
Re: [rtcweb] draft-schwartz-rtcweb-return Justin Uberti
Re: [rtcweb] draft-schwartz-rtcweb-return Hutton, Andrew