Re: [rtcweb] Resolving RTP/SDES question in Paris

[Roman Shpount <[e-mail]>]

On Tue, Mar 20, 2012 at 11:39 AM, Harald Alvestrand <[e-mail]>wrote:

> **
> On 03/20/2012 02:40 PM, Roman Shpount wrote:
>
> Once again, I understand how this helps in case of HTTPS, but how would
> this help in case of WebRTC? Media description is carried in some sort of
> application defined protocol (can even be transmitted over an encrypted
> SCTP data channel or encrypted in javaScript), so monitoring proxy cannot
> reliably modify it. I understand how it can be allowed to fake the
> signature on modified SDP by inserting a certificate in the browser, but
> how would the proxy get to the SDP in the first place?
>
>
> "this" = inserting a trust root in the browser?
>
> Once you trust the root I inserted, I can intercept all your HTTPS
> connections, and thus I can replace all the Javascript you think you are
> loading from your trusted provider with Javascript of my choice.
>
> Once your browser is running my Javascript, I can do anything the original
> application could - with the privilleges you granted to that application.
>
> I think that's more or less "game over" when it comes to security.
>
>
"this" is inserting the root certificate. It is a game over as far as
security is concerned, but the rest of your email completely missing my
point.

If, as an owner of a computer, you want to enable media monitoring with an
existing standard you need to know exactly how each application is
implemented. This is a solution for hacker but not the normal enterprise.
In order to have monitoring support in the enterprise environment you need
an ability to force the browser to proxy all the media through a monitoring
application without any application modification, via browser settings
alone.
_____________
Roman Shpount