[rtcweb] Yesterday's meeting : Security

"Olle E. Johansson" <oej@edvina.net> Fri, 09 September 2011 06:07 UTC

From: "Olle E. Johansson" <oej@edvina.net>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 09 Sep 2011 08:09:20 +0200
Message-Id: <B4D435F5-3B88-4A4E-93D4-2283DBF3F9D2@edvina.net>
To: rtcweb@ietf.org
Mime-Version: 1.0 (Apple Message framework v1244.3)
Subject: [rtcweb] Yesterday's meeting : Security
Precedence: list

http://www.ietf.org/proceedings/82/slides/rtcweb-7.pdf

In the webex meeting yesterday Eric Rescorla delivered a good presentation of some of the security aspects involved in the applications that will be built with webrtc/rtcweb technology.

Some of the issues he raises are application specific, some goes into w3c territory and some belongs in this group. The important question here is the impact of the rtcweb framework. Can we create hooks that help application developers? Is there a need to integrate security mechanisms somehow? 

Like: Does the media system need to be aware of the security properties (certificate chain, ssl state) of the HTTP connection? Does the app need to handle the media encryption keys at all or should we hide it from the app developer and the web server? 

Please read Eric's presentation and think. Maybe you can add a scenario here too.

/O

[rtcweb] Yesterday's meeting : Security Olle E. Johansson