Re: [rtcweb] Single-origin and consent

[Harald Alvestrand <[e-mail]>]

On 10/20/2011 07:40 PM, Randell Jesup wrote:
> On 10/20/2011 11:36 AM, Eric Rescorla wrote:
>> On Thu, Oct 20, 2011 at 7:32 AM, Bernard Aboba
>> <[e-mail]>  wrote:
>>> No, I'm saying that *if* a developer remains within the "single origin"
>>> model, that a number of requirements for peer-to-peer operation do not
>>> apply.
>>>
>>> Also that the APIs should also enable media to be sent over a 
>>> websocket to
>>> the "single origin" as well as a PeerConnection.
>>>
>>
>> I don't think I'm following you're argument. ISTM that there are two
>> conditions that one
>> might term "single origin":
>>
>> 1. Alice and Bob are on the same site (e.g., PokerStars) and are
>> calling each other via P2P media,
>> 2. Alice and Bob are on the same site and are calling each other
>> via media over WS.
>
> I'll add a third: Alice and Bob are on the same site, and are 
> participating in a (potentially) multi-person conference run through 
> the site, which is acting as a mixer or at least relay.  Media is sent 
> via normal PeerConnection channels, encrypted with DTLS-SRTP.  In this 
> limited case, each participant is sending media to the same site (*) 
> as the JS code is loaded from.
>
> So, the questions here would be
> a) can we relax ICE consent checks if the site/app so wishes and
> b) should we?
>
> I think we can (if the app tells us to, since it's "same-origin" and 
> the app should know), but I'm a little less certain of the "should".  
> Is there an attack wherein someone could 'host' some JS content (app) 
> on a site and use it to attack/DoS that site from multiple places?  It 
> seems at least plausible.

My paranoid self comes up with two, and warns me that there may be 
others....

1) if the "site" is in fact a NAT box, AND the attacker is able to get a 
whole TCP port number on that box AND allow incoming connections....

THEN the attacker can "host" a web server at natbox-ip:hisportnumber, 
and freely use the "same site" criterion to get people to DOS other 
users of the same NAT box.

2) if the "site" is identified by domain name, and the attacker owns the 
domain name, and the attacker can dynamically switch between two 
short-TTL A records for the "site"....

THEN the attacker can let the "helper" load up the page and Javascript 
from the attacking site, switch the A record around to point at his 
victim, and have the attack go to the victim's IP address.

I'm sure people with larger experience in paranoia than I have can come 
up with other scenarios. Or possibly come up with a defense against 
these and other threats that is cheaper than ICE.

But until then ..... I don't think we should.

                    Harald



>
>