Re: [rtcweb] AVPF [was: Encryption mandate (and offer/answer)]

[Stefan Håkansson LK <[e-mail]>]

I think there is no protection against badly written apps. If the 
signaling messages ("SDPs") are not properly protected as an example, 
there is another security hole. People not bothering with protecting 
media may not bother to protect the signaling either.

I also think the default in my model protection (if the app makes no 
input) should be DTLS-SRTP.

Stefan


On 2011-09-11 15:39, Timothy B. Terriberry wrote:
>> * The level of media protection to use (NONE, SDES-SRTP or DTLS-SRTP) should be set by the web app
>
> Why wouldn't this devolve to, "Don't communicate anything. Instead, try
> to create a PeerConnection with DTLS-SRTP, and when that fails, try to
> create a second one with NONE," in the actual webapp.
>
> Or, more likely, since NONE will have a better chance of working with
> legacy devices, "Try to create a PeerConnection with NONE, and when that
> fails, try to create a second one with DTLS-SRTP." Assuming anyone
> bothers with the second step. Having the choice of SDES-SRTP or
> DTLS-SRTP will also make it more likely people won't bother with either,
> as they won't know which one to use. We can try to create incentives
> with browser chrome, but there's only so much that can do.
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb