Re: [rtcweb] #10: Additional Threats

This opens a new category of attack, one that I wasn't all that
concerned about.  Namely, the guy on the other end isn't trustworthy.

To a large extent, peer authentication allows users to make their own
assessments, but we have to acknowledge (and likely accept) that the
other guy isn't necessarily trustworthy.  I think that we can rule the
age-old human problem out of scope, but perhaps we should be clear
that we are doing so.

On 16 February 2013 14:26, rtcweb issue tracker
<trac+rtcweb@trac.tools.ietf.org> wrote:
> #10: Additional Threats
>
>  Aside from the threats described in the document, a few others come to
>  mind.  It might be useful for the document to state explicitly why or why
>  not these are out of scope:
>
>  a. Live versus replayed streams.  While you might have media security,
>  this doesn't tell you whether the stream is actually originating from a
>  device or is being replayed.
>
>  b. Prank calling.  While the document talks about permission to make
>  calls, it doesn't mention permission to receive or blocking of unwanted
>  calls.
>
> --
> -------------------------------------+-------------------------------------
>  Reporter:                           |      Owner:  draft-ietf-rtcweb-
>   bernard_aboba@hotmail.com          |  security@tools.ietf.org
>      Type:  defect                   |     Status:  new
>  Priority:  major                    |  Milestone:  milestone1
> Component:  security                 |    Version:  1.0
>  Severity:  In WG Last Call          |   Keywords:
> -------------------------------------+-------------------------------------
>
> Ticket URL: <http://trac.tools.ietf.org/wg/rtcweb/trac/ticket/10>
> rtcweb <http://tools.ietf.org/rtcweb/>
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb