Re: [rtcweb] URI schemes for TURN and STUN

[Keith Moore <[e-mail]>]

On Oct 31, 2011, at 10:57 AM, Marc Petit-Huguenin wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi Martin,
> 
> So I understand Roy's email as saying in fact the opposite of what Harald said,
> i.e. that using an "s" suffix to signify security is a good thing.
> 
> What is your opinion on defining a generic scheme suffix (i.e. "+s" or "+sec")
> that would indicate a well defined set of security properties that could apply
> to any scheme, (vs the current "s" suffix where security properties has to be
> defined scheme by scheme)?


There is no "well defined set of security properties that could apply to any scheme".   Security properties necessarily vary depending on the way a resource is used, the threat model, and so forth. 

Also, the idea that there should be a "secure" bit in a URI scheme, to distinguish it from the "insecure" form of a URL, doesn't make much sense.  You always want to use the best security that's available.  You don't want that to depend on the URI scheme.  

The "s" convention was a hack to distinguish "x over SSL" from "x" for all of the URIs that existed before SSL was well-established, because those protocols didn't (then) have a way to negotiate security in-band.   It made sense as a short term hack, but not as an architectural feature.   It's not something that we want to propagate to new URI types, neither in the form of an "s" suffix, nor as any other syntactic convention.

Keith