Re: [rtcweb] I-D Action: draft-ietf-rtcweb-transports-00.txt

[Philipp Hancke <[e-mail]>]

> > Most -- but not all -- of the security obtained with TURN over TLS is achieved with TURN REST (draft-uberti-behave-turn-rest and draft-uberti-rtcweb-turn-rest). I think the working group should consider if TURN REST satisfies the requirements, or if TURN over TLS
> is really, really necessary.
> 
> [BA] Not sure I follow this.   TURN over TLS provides confidentiality for the relay addresses and also some firewall traversal benefits.  TURN REST is trying to solve a different problem entirely (e.g. misuse of TURN credentials).  Personally, I don't think TURN REST
> really minimizes the risk to the extent necessary, since time limiting the credentials alone won't necessarily stop an ingenious (and greedy) thief.  As an example, when hackers gain control of a PBX they can run up shocking bills in a very short period of time, and
> even if TURN charges are minimal, you'd be surprised at what Internet miscreants can do with stolen credentials within a 24 hour period.  So to my mind, TURN REST needs some additional bolstering to limit the potential financial liability, such as bandwidth limits. 

Note that the 24 hours are something that is currently necessary because 
browsers don't implement updateIce yet (which would be used to add the 
TURN server and the time limited credentials). Once that is solved it is 
possible to to reduce the attackers window to a couple of seconds.