Re: [rtcweb] Resolving RTP/SDES question in Paris

[Iñaki Baz Castillo <[e-mail]>]

2012/3/16 Ravindran, Parthasarathi <[e-mail]>:
> As I mentioned in earlier mail thread (http://www.ietf.org/mail-archive/web/rtcweb/current/msg03148.html), RTP has to be supported by RTCWeb client with local user consent.

Well, that's your opinnion, not a MUST (or not yet).



> To clarify why RTP is not harmful in some usage, VPN access of intranet RTCWeb client in public internet usecase is as follows:
>
> Usecase details: Enterprise employee Alice access enterprise (HTTP & WebRTC compliant) intranet with VPN connection using Airport WiFi internet connection, Alice will have the mechanism to call another employee Bob in the same enterprise using WebRTC session and the session between Alice and bob will be plain RTP in VPN network.
>
> Security aspect: Here, accessing (HTTP) intranet browsing today is safe even though Alice is using Airport Wifi internet connection as he has VPN connection (IPSec) and no dependency on HTTPS. In the same way, WebRTC mechanism should not mandate for SRTP-DTLS in media and MUST allow RTP.  The local user consent (configuration) is required to restrict this usage by Dr Evil website.


To clarify why RTP *is* harmful in *common* usages:

Usecase details: An user in an airport using an open WiFi connection
and accesing to a social web page implementing WebRTC for calls
between web users and between web users and PSTN numbers. And not, the
user does not use a VPN to connect to a social web. The user calls to
a PSTN number (since the contact he wants to call to is not currently
online in the web). The call is established with a SIP PSTN gateway
which does not implement SRTP but just RTP.

Security aspect: Plain RTP is negotiated so anyone in the airport can
spoof the media. A good reason to state "WebRTC mechanism MUST mandate
for SRTP and MUST NOT allow plain RTP, since the security aspect
depends on the service provider (and there are tons of irresponsible
service providers out there in Internet).



> The local user consent (configuration) is required to restrict this usage by Dr Evil website.

Giving the security responsability to end users as a configurable
option is not a good idea. The world would be much better if the
browsers would not allow plain HTTP, but it's not possible to change
the WWW requeriments and mandate HTTPS given the ammount of plain HTTP
deployments. In contrast, WebRTC does not exist yet so *now* is the
moment to mandate security.


Regards.



-- 
Iñaki Baz Castillo
<[e-mail]>