[rtcweb] Relaying for privacy

[Martin Thomson <[e-mail]>]

On 15 May 2012 18:31, Cullen Jennings <[e-mail]> wrote:
> Might want to add to some use case that when A calls B, and B does not reveal their IP address to A.

I agree, but it's questionable whether this is something we
(ietf/w3c...browsers) need to solve the problem or whether we can rely
on sites respecting privacy appropriately.

Obviously, it's quite simple to allocate a relay for all new sessions
in the browser.  The hard part is knowing when it is OK to reveal
host/reflexive candidates so that the call can proceed without
relaying.

 - Is it when the user grants permission for the site to use
microphone/camera?  This seems wrong.  An individual desire for
privacy is often based on who is asking, which in this case is A, not
the site.  It's plausible that the site can be given permission to
access mic/camera prior to the call arriving.

 - Is it when the user indicates acceptance of the call?  I don't
think that the plan is to signal acceptance through chrome, so this
would have to rely on cues from the site, such as calling
createAnswer.  At that point, if the site wants the media off the
relay, they now have an incentive to fake acceptance.  The same
applies to relying on any other cues from the site, including faking
the _initiation_ of the call, which can be done from both A and B.

 - Is there special chrome that enables this?  Adding more chrome
doesn't sound like a great idea to me, but maybe this behaviour could
be tied to the various "private/incognito mode" options in the
browser.

I did have another related thought, but distractions erased it.