Re: [rtcweb] Exchange of trusted identities in server-based conferencing (Re: Use case change request: Identity in multiuser calls)

[Randell Jesup <[e-mail]>]

On 8/12/2011 10:18 AM, Igor Faynberg wrote:

> On 8/12/2011 7:31 AM, Harald Alvestrand wrote:
>> ...
>> The normal method of authentication for teleconferences today is that
>> people prove they have the conference number (by calling in), and
>> recognize each others' voices.
>> ...
> Is there not a conference code, too?  In all (five or six of them that I
> have used) there was one.  This code is, effectively, a shared secret.
> In the service we use, the conference host can create a new code for
> each meeting.  (One problem with relying on recognizing voices is
> passive intruding: I can join your conference and never say a word.)

IMHO that particular level/type of security is not something to be decided by
rtcweb, that's up to the application and server to decide and handle.

At most, I'd suggest an API that lets the application supply a shared secret
(how it's obtained isn't our problem - from the user, from secure email, etc)
to use in generating/validating the keys and/or identities.


-- 
Randell Jesup
[e-mail]