Re: [rtcweb] Requiring ICE for RTC calls

[Matthew Kaufman <[e-mail]>]

On 9/26/2011 8:15 AM, Iñaki Baz Castillo wrote:
> 2011/9/26 Cameron Byrne<[e-mail]>:
>> Maybe I misundersatnd you, but the PSTN carriers today and in the future
>> will always run an SBC because that is their security policy.
> Hi. Please let's forget "SBC" and let's go to a simpler case: a PSTN
> provider that speeak SIP and RTP with clients and SIP/SS7/ISUP with
> other PSTN operators. The signaling and media conversion is done in
> PSTN gateways. Most of them, for sure, don't implement ICE neither
> SRTP.
>
> Anyhow, concerning this subject, I already proposed something in other
> thread: why couldn't the provider (the web site) tell their WebRTC
> clients wheter they shoud or not accept media sessions without ICE
> and/or SRTP?

Because that doesn't meet the security requirements.
>
> For example, a telco operator that creates a web site for allow its
> clients making PSTN calls from the web, could relax those requirements
> and don't mandate ICE/SRTP. In the other side, a social network web
> site which just allows calls between web users could mandate them.
> Such configuration could be retrieved by the WebRTC client via HTTP or
> WebSocket by standarizing a document format.

For example, an evil overlord that creates a web site for allowing its 
clients to attack systems behind a firewall could relax those 
requirements and not mandate ICE/SRTP when opening arbitrary connections 
to systems behind said firewall.

The "configuration" must be retrieved by the WebRTC client *from the 
system it will be sending traffic to*... the best format we have for 
that is to send a (rate-limited) STUN connectivity check with short-term 
credentials and see if it is replied to properly. That's how ICE works.

Matthew Kaufman