Re: [rtcweb] SRTP not mandatory-to-use

[Iñaki Baz Castillo <[e-mail]>]

2012/1/11 Ravindran, Parthasarathi <[e-mail]>:
> I agree with you that it is not website trust but also network has to be considered. Please look at this requirement like accessing company intranet service (email, document) from public hotspot or Internet café. Your usecase wherein the deployment will consider security like VPN wherein the (webRTC) application has no need to perform the double encryption. In case accessing company (Enterprise) e-mail in a specific hotspot/public internet care is unsecure, then accessing company WebRTC application is also unsecure. If not, it is perfectly fine to access RTP WebRTC application as the security is ensured in some other layer of the network.


It seems that there is no evolution at all in this issue, same
arguments as two months ago.

AFAIR the main question/problem is: who does decide when to use SRTP
or just plain RTP? does such a suggestion come from the web page
itself? If so, the user (the human user) can be deceived:

  "Press the 'Accept unsecure communication' button and you will win a car !!!"

The double encryption is not a problem at all. The application (the
browser) performs SRTP encryption (no problem here!) and the TCP/IP
stack in the computer or in the router performs network encryption.
Which is the problem??? There is no problem at all. All of this just
seems a poor argument in favour of plain RTP to interoperate with
legacy and non secure RTP implementations (and this is the fail of
lazy SIP vendors, don't bring that to WebRTC please).


Regards.

-- 
Iñaki Baz Castillo
<[e-mail]>