Re: [rtcweb] Resolving RTP/SDES question in Paris

[Roman Shpount <[e-mail]>]

On Sat, Mar 17, 2012 at 4:45 PM, Martin Thomson <[e-mail]>wrote:

> This isn't that hard.  I run an intercepting proxy that offers its own
> certificate.  Then I explicitly place a trust anchor for that
> certificate in your browser.  The proxy is then able to intercept any
> encrypted traffic it chooses to.  The proxy does two lots of crypto
> work, but that's not as much of a big deal as you might think.
>
> No protocol changes at all.  The proxy might need to do more work to
> convince you that the identity hasn't been replaced (swap itself in as
> the identity provider, for example), but anything is possible once it
> is "trusted".
>
>
I understand how this will work with HTTPS, but how would this work with
WebRTC? Signaling is traveling over some separate path withing a websocket
or some other HTTP-based encapsulating protocol. Keys/Key signatures are
part of this signaling, which is almost impossible to intercept, even if
you have access to all HTTP(S) traffic, since each application can define
the protocol being used. Intercepting proxy needs access to this info, or
it cannot decode the media or spoof the signatures. Unless I am missing
something, client needs to send the SDP to the proxy and get the modified
SDP back, which probably requires some sort of network protocol.
_____________
Roman Shpount