Re: [rtcweb] Use Case draft - Eavesdropping.

"Fabio Pietrosanti (naif)" <> Tue, 01 May 2012 13:26 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E40EF21E805F for <>; Tue, 1 May 2012 06:26:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id yZmatmyH16aZ for <>; Tue, 1 May 2012 06:26:47 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 325AD21E8053 for <>; Tue, 1 May 2012 06:26:46 -0700 (PDT)
Received: by werb10 with SMTP id b10so2965543wer.31 for <>; Tue, 01 May 2012 06:26:45 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=sender:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:x-enigmail-version:content-type :content-transfer-encoding:x-gm-message-state; bh=gAm/V4hVNpH8ixzOfTgHkZkDJMYZ78GFUAwXl1JcvQ4=; b=dsTpXIa9nYmx950yEvAiASFtpcxt1H2GKS4e2/P9wQBT4jwoBV3SyCtscnz5uZn6Qq Ddm8m5mCqXXrMl9pRo3naQI6sHUd/apKGDGmFP54Izb9oiaaEyssSQBDYWoGig05j1qB rgRHiOHwtknLzdVxKTXMc3+DJzr81G2qgHqmRSOOCxKucYOExUoEkJDkJHEfKr1NTi+b OUEaKiiDwtQPWjWwRM6DU1q31y/iGGrH1bJWn34TlIE8FfEIUIKzadSdHPZVSerCYy9R XwrEBysfEIBPqr6XuWgNIGomHM+silbV4YMSIMzc6orTyg3wgRND7TI5lzRYxNQEilX8 B9Eg==
Received: by with SMTP id x22mr1936530wei.69.1335878805797; Tue, 01 May 2012 06:26:45 -0700 (PDT)
Received: from sonyvaiop13.local ( []) by with ESMTPS id ff9sm36428748wib.2.2012. (version=TLSv1/SSLv3 cipher=OTHER); Tue, 01 May 2012 06:26:44 -0700 (PDT)
Sender: Fabio Pietrosanti <>
Message-ID: <>
Date: Tue, 01 May 2012 15:26:43 +0200
From: "Fabio Pietrosanti (naif)" <>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20120327 Thunderbird/11.0.1
MIME-Version: 1.0
References: <> <>
In-Reply-To: <>
X-Enigmail-Version: 1.4.1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Gm-Message-State: ALoCoQnD0xK9iSRmRmqU699GrBqz/8etzj1VHp1QS11D9YgtMlZgkzW3rdXGF0MMzrOYeJKsT4xg
Subject: Re: [rtcweb] Use Case draft - Eavesdropping.
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 01 May 2012 13:26:48 -0000

On 5/1/12 3:14 PM, Hutton, Andrew wrote:
> Hi,
> A number of use cases within Draft-ietf-rtcweb-use-cases-and-requirements-07 contain the statement "It is essential that the communication cannot be eavesdropped" however there is no definition of what is actually meant by "eavesdropped" although I think we all have an idea of what it means.
> Maybe it would be better to replace these statements with something that refers to wiretapping and RFC 2804 (RAVEN) which actually has a definition of wiretapping.

That's a core topic imho, especially because WebRTC would like to make
it appear like carrying on end-to-end security.

If WebRTC provide full end-to-end security no wiretapping should be

Because WebRTC, from the discussion done in this mailing lists, cannot
satisfy end-to-end security requirements (no wiretapping) in many cases,
then it's highly relevant that the user is aware if the connection is
secured peer-to-peer (so between the end-user-device of the parties that
are talking together) or if there's a gateway in the middle
decrypting/deciphering the call, and so potentially eavesdropping it.

I think that to avoid a "shame" on the reputation of WebRTC, it's very
and highly important to clearly state and explain how/when/who can do

At least to know "when" it's end-to-end security and when it's not, in a
clear, unique, identifiable way.