Re: [rtcweb] Let's define the purpose of WebRTC

[Roman Shpount <[e-mail]>]

On Mon, Nov 14, 2011 at 7:42 PM, Matthew Kaufman
<[e-mail]>wrote:

> Do you want *your* browser to be able to switch to plain RTP for the call
> you're making from a place with an unsecured wi-fi network (as essentially
> all are at this point, given the ease of cracking the typical schemes used
> for wireless security these days) ?
>
> I don't. Even though I do agree that there might be external reasons why
> service providers might want the browser to have that ability.
>

I guess you are missing the point on two accounts:

First of call, in most of the cases I (as well as possibly most of the
people) do not care. If I am sitting on the public WiFi in a coffee shop, I
do not care, because there are hundreds of people around who already hear
what I am saying. Almost all traditional phone conversations provided no
privacy (just ask your friendly phone technician which a handset in the
basement), and most of people did not care. Cell phones are not as private
as you would think (I know of examples when entire countries turned the
encryption off for a few months) and users did not care. Encryption is
good, but not as important as you are making it to be.

Second, it is an application developers decision if he wants to provide
secure communications. If he does not intend to (all conversations are
recorded and posted on the web as a voice blog for example), there is no
point of forcing this encryption. No matter what we do on the browser side,
the app will never be secure, if it is not intended to be so. In this case
all this encryption is a wasted effort. It is not a web browser or a user
decision if communications with a particular app should be secure. User
should be able to see that the certain application takes no effort in
securing the communications and decide if they would use this application
based on this. The simplest and probably best understood model by web users
is, if an application is delivered over HTTPS from a known provider, it
should be secure. If it is delivered over HTTP, it provides no guarantees
over its security and should be used this at your own risk.
_____________
Roman Shpount