Re: [rtcweb] WGLC for draft-ietf-rtcweb-ip-handling

[Lennart Grahl <[e-mail]>]

On 27.03.2018 18:57, Cullen Jennings wrote:
> This draft results in the situation where implementations decide if they should reveal the users location to the website by asking a questions of the form "Will you allow example.com to use your camera?" If the user says that is OK to use their camera, in many cases they have also allowed the website to get their location via the IP address. From a user point of view, I think this is awful, There are many reasons I might allow a website I do not trust to know my location to access my camera - for example, I have a black cover over my camera and the website won't work unless I say yes to this request. Or a webcam worker where the job involves revealing video but revealing the locations they work at may put them at risk of serious harm. Or I am in a domestic abuse shelter and want to have a call but revealing may location puts me at risk of physical harm. I do not think the IETF should in any way endorse this extremely misleading form of consent. It is simply not consent. I realize this would be good for companies that are primary funded by by web advertising for which location is valuable.

I agree with you here and this is most likely the reason why WebRTC is
on the blacklist of many privacy extensions for browsers.

However, I believe there could be a form of consent in the browsers -
tell them what you actually want to do: Expose (all) private IP
addresses to create a direct connection. Yes, getting users to
understand what it means to "establish a direct connection" may not be
trivial - granted. But it's much more sincere AND it would not
discriminate data channel only use cases (yeah, it's really shady to
request capture permissions to be able to use mode 1).

And FWIW I'm not sure this form of consent fits into the scope of the
IETF. Maybe the modes could be defined in this document and which mode
to choose under which circumstances could be moved into the W3C WebRTC spec.

Cheers
Lennart