Re: [rtcweb] Use Case draft - Eavesdropping.

["Fabio Pietrosanti (naif)" <[e-mail]>]

On 5/1/12 3:14 PM, Hutton, Andrew wrote:
> Hi,
> 
> A number of use cases within Draft-ietf-rtcweb-use-cases-and-requirements-07 contain the statement "It is essential that the communication cannot be eavesdropped" however there is no definition of what is actually meant by "eavesdropped" although I think we all have an idea of what it means.
> 
> Maybe it would be better to replace these statements with something that refers to wiretapping and RFC 2804 (RAVEN) which actually has a definition of wiretapping.

That's a core topic imho, especially because WebRTC would like to make
it appear like carrying on end-to-end security.

If WebRTC provide full end-to-end security no wiretapping should be
possible.

Because WebRTC, from the discussion done in this mailing lists, cannot
satisfy end-to-end security requirements (no wiretapping) in many cases,
then it's highly relevant that the user is aware if the connection is
secured peer-to-peer (so between the end-user-device of the parties that
are talking together) or if there's a gateway in the middle
decrypting/deciphering the call, and so potentially eavesdropping it.

I think that to avoid a "shame" on the reputation of WebRTC, it's very
and highly important to clearly state and explain how/when/who can do
eavesdropping.

At least to know "when" it's end-to-end security and when it's not, in a
clear, unique, identifiable way.

Fabio