Re: [rtcweb] Comments on draft-ietf-rtcweb-data-channel-06

[Magnus Westerlund <[e-mail]>]

Hi,

Just responding to one thing. I will have a goal to review the new
versions prior to the WG session to see how well the new version
resolves my previous comments.



On 2014-02-12 03:05, Randell Jesup wrote:
> On 2/11/2014 5:47 AM, Michael Tuexen wrote:
>> On Nov 11, 2013, at 2:54 PM, Magnus Westerlund
>> <[e-mail]> wrote:
>>
>>
>>> 3. Section 3.2:
>>>    U-C 7:  Proxy browsing, where a browser uses data channels of a
>>>       PeerConnection to send and receive HTTP/HTTPS requests and data,
>>>       for example to avoid local internet filtering or monitoring.
>>>
>>> Yes, this may be something that is possible, but to express it as a use
>>> cases intended to be supported might not be the best. We are after all
>>> likely talking about circumventing local security policies. I would also
>>> note that "Internet" is with capital I.
>> Change to Internet. The use case seems important, since there are already
>> implementations doing this (possibly not using data channels, don't
>> know).
>> Randell: What do you think?
> 
> There are people actively planning to use it for this usecase in
> high-profile applications (using datachannels), or so I am told.

Okay, this is going to be causing issue, independent on if you include
the use case explicitly or not. Please discuss this security concerns in
the security consideration section. From my perspective this has several
implications.

1. Violating a sites security policy. Can this be detected, controlled
or prevented somehow without generally blocking the data channel or even
DTLS in general?

2. What privacy implications does this have? You are putting your
proxied traffic into another browser instances JS code space. Thus isn't
that browser going to have full insight in what the first browser is
doing, including content coming over a HTTPS from the proxy to the. This
has significant trust issues.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------