Re: [rtcweb] SRTP and "marketing"

[Roman Shpount <[e-mail]>]

On Wed, Mar 28, 2012 at 10:30 PM, Timothy B. Terriberry <
[e-mail]> wrote:

> Hadriel Kaplan wrote:
>
>> As far as I know, you don't actually "know" that with Skype.  You assume
>> it,
>> because you trust Skype.  They could forge whatever identity they wanted
>> to,
>> and they can insert a recording middlebox if they wanted to, afaict.
>> No one is concerned about that.  They also have skype-in/skype-out to/from
>>
>
> This is, of course, not true. See, for example,
> http://www.technologyreview.**com/web/38379/<http://www.technologyreview.com/web/38379/>
>
> The relevant bit, for those who don't want to read the whole article: '"We
> met using Mumble [which is open-source, uses digital certificate
> authentication, and is regarded by Takriz as more secure than Skype].'
> (brackets in the original).
>
> Which is not to say that Tunisian rebels never used Skype (the article
> mentions several instances where they did), but it is clearly inaccurate to
> say no one was concerned about it.
>
>
And then there is an argument that Skype is a huge security risk exactly
due to the fact that it is using encrypted communications. There were hints
of using Skype communication protocol and Skype client to access files
remotely on the user computer or ability to open ports into a local network
using a Skype client running there (using Skype as a malicious VPN client).
Entire protocol and client are proprietary and were never validated by an
independent party as being secure in a sense of preventing unauthorized
remote access. This is one of the reasons why Skype is not allowed in a lot
of corporate or government networks. Even though this should not apply to
WebRTC since it is going to be an open standard with an intensive peer
review, it would still apply to the web browsers. If web browser software
is compromised due to some sort of attack or malicious plugin (or one of
the browser vendors snooping), and since browser applications will start
establishing unsolicited encrypted connections, there is no easy way to
determine that the browser is not doing something undesirable.  I actually
believe that if sufficient monitoring constraints are not build into a
browser (not to record but at least to monitor who the browser is
exchanging data with and using what protocols), WebRTC would be simply
disabled in most enterprises as a security risk.
_____________
Roman Shpount