[rtcweb] Security implications of host candidates

[Justin Uberti <[e-mail]>]

https://tools.ietf.org/html/draft-mdns-ice-candidates-00 has a section
where it talks about the privacy implications of being able to determine
that two browser contexts are running on the same machine by making a
host-host connection and analyzing the connection RTT:

   A successful WebRTC connection between two peers is also a potential
   thread to user privacy.  When a WebRTC connection latency is close to
   zero, the probability is high that the two peers are running on the
   same device.  Browsers often isolate contexts one from the other.
   Private browsing mode contexts usually do not share any information
   with regular browsing contexts.  The WebKit engine isolates third-
   party iframes in various ways (cookies, ITP) to prevent user
   tracking.  Enabling a web application to determine that two contexts
   run in the same device would defeat some of the protections provided
   by modern browsers.


I would think that this concern would still exist even without host
candidates, through either

a) IP matching + user-agent fingerprinting

b) srflx-srflx connections and NAT hairpinning


FWIW, this topic does not appear to be noted in the rtcweb security docs.