Re: [rtcweb] More on authorization and endpoint authentication

[Harald Alvestrand <[e-mail]>]

On 08/04/11 18:46, Eric Rescorla wrote:
> At a higher level, I think we've been failing to draw the distinction
> between two cases which are socially (and arguably technically) very
> different:
>
> 1. The calling service is permitted to place a call but all the
>     information about who you are actually calling is accessible
>     only to the JS provided by the calling service.
>
> 2. The calling service is permitted to place a call but the
>     browser has independent information about who you are
>     actually talking to. [and could at least in principle render
>     it to the user.]
I do not like the thought of going down the case #2 road.

The reason is that in case 2, the concept of remote identity gets 
hardwired into the browser, and the API becomes useful only for 
applications that subscribe to the particular identity model that is 
hardwired into the browser.

In case #1, the API can be used with any (or no) concept of "remote 
identity", and the JS provider (who has a kind of "identity" by virtue 
of the Same Origin Policy definition, so it's already wired into the 
browser) gets to hold the responsibility.