Re: [rtcweb] Let's define the purpose of WebRTC

[Iñaki Baz Castillo <[e-mail]>]

2011/11/9 Muthu Arul Mozhi Perumal (mperumal) <[e-mail]>:
> |And what you state is that, in case the peer does not annouce
> |support for SRTP then the browser should downgrade security
> |to plain RTP.
>
> No, not based on the SRTP capability advertised by the peer, rather based on whether the peer claims it is WebRTC compliant (to make sure calls b/w WebRTC clients are always secure).
>
> |The user (web visitor) has no way to know whether the WebRTC
> |application will contact a WebRTC browser or another device
> |at the media plane.
>
> We could add a STUN extension to indicate compliance to WebRTC, including the supported version level if we ever come up with WebRTC2.0.

And what is the advantage? you still say exactly the same: a WebRTC
client "MUST" allow plain RTP if the peer is not a WebRTC client. Why
is that an argument in favour of non mandating SRTP?

If I'm in a shared WiFi network and receive a call from a non-WebRTC
client not supporting SRTP, my neighbors can intercept it. What does
such "STUN extension" provides here? just nothing.





-- 
Iñaki Baz Castillo
<[e-mail]>