IETF Logo Mail Archive

Re: [rtcweb] surveillance in RTCWEB (was wiretapping)

Bernard Aboba <bernard_aboba@hotmail.com> Wed, 09 November 2011 01:50 UTC

Return-Path: <bernard_aboba@hotmail.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 431FB21F8801 for <rtcweb@ietfa.amsl.com>; Tue, 8 Nov 2011 17:50:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.543
X-Spam-Level:
X-Spam-Status: No, score=-102.543 tagged_above=-999 required=5 tests=[AWL=0.055, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0hRvZ3tqc93w for <rtcweb@ietfa.amsl.com>; Tue, 8 Nov 2011 17:50:36 -0800 (PST)
Received: from blu0-omc3-s13.blu0.hotmail.com (blu0-omc3-s13.blu0.hotmail.com [65.55.116.88]) by ietfa.amsl.com (Postfix) with ESMTP id B1B3721F87FA for <rtcweb@ietf.org>; Tue, 8 Nov 2011 17:50:36 -0800 (PST)
Received: from BLU152-W59 ([65.55.116.74]) by blu0-omc3-s13.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 8 Nov 2011 17:50:36 -0800
Message-ID: <BLU152-W59182B6C952E64A825D50293DF0@phx.gbl>
Content-Type: multipart/alternative; boundary="_76f37926-2912-4363-b475-3651c285e336_"
X-Originating-IP: [131.107.0.94]
From: Bernard Aboba <bernard_aboba@hotmail.com>
To: rtcweb@ietf.org
Date: Tue, 08 Nov 2011 17:50:35 -0800
Importance: Normal
In-Reply-To: <BLU152-W41331230A189F8586FFDB793DF0@phx.gbl>
References: <CALiegfkVNVAs_MyU_-4koA4zRwSn1-FwLjY9g_oZVkhi9rSK5Q@mail.gmail.com>, , <8A61D801-D14D-408B-9875-63C37D0CC166@acmepacket.com>, , <CABw3bnPE=OY_h5bM7GA6wgrXiOBL8P4J0kw1jLv-GSpHAbg=Cg@mail.gmail.com>, , <CABcZeBNqdkh8u=gwOvKfDCQA7rXdAyQkfaM1r2Sx10787btP6A@mail.gmail.com>, , <B10FEFF6-0ADC-4DB1-83BB-50A11C65EC35@acmepacket.com>, , <CABcZeBNSXtim_VqzqAd8Z-u4zWSjaYmsVZPN=7sDYkJsgtRAHA@mail.gmail.com>, , <4EB7E6A5.70209@alvestrand.no>, , <F8003BA9-BCD8-4F02-B514-8B883FF90F91@acmepacket.com>, , <387F9047F55E8C42850AD6B3A7A03C6C01349D81@inba-mail01.sonusnet.com>, , <4EB9ACF5.80805@alvestrand.no>, , <387F9047F55E8C42850AD6B3A7A03C6C01349F60@inba-mail01.sonusnet.com>, <BLU152-W41331230A189F8586FFDB793DF0@phx.gbl>
MIME-Version: 1.0
X-OriginalArrivalTime: 09 Nov 2011 01:50:36.0251 (UTC) FILETIME=[F99A4AB0:01CC9E81]
Subject: Re: [rtcweb] surveillance in RTCWEB (was wiretapping)
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Nov 2011 01:50:37 -0000



[BA]  If the concern is that we will make RTCWEB soooo secure that browser-based surveillance would be "too difficult" even for national governments with lots of resources, that is what I'd call a "high quality problem".  
 
Reading Eric's draft, I would not say that the available security solutions are soooo advanced at the moment that this is a practical concern.  Even if we were to mandate a "heap o' crypto" (e.g. SRTP, DTLS/SRTP, PKI, etc.) the chances are excellent that it would not be deployed, would be contravened by disreputable CAs, or would not be understood well enough by users to avoid misfortunes on a regular basis.  
 
What *does* worry me is that surveillance in RTCWEB would be so easy that any script kiddie could do it, and that it could become an everyday occurrence.

v2.23.0 | Report a Bug | By Email