Re: [rtcweb] A plea for simplicity, marketability - and... who are we designing RTCWEB for?

[Eric Rescorla <[e-mail]>]

On Thu, Oct 20, 2011 at 7:32 AM, Bernard Aboba
<[e-mail]> wrote:
> No, I'm saying that *if* a developer remains within the "single origin"
> model, that a number of requirements for peer-to-peer operation do not
> apply.
>
> Also that the APIs should also enable media to be sent over a websocket to
> the "single origin" as well as a PeerConnection.
>

I don't think I'm following you're argument. ISTM that there are two
conditions that one
might term "single origin":

1. Alice and Bob are on the same site (e.g., PokerStars) and are
calling each other via P2P media,
2. Alice and Bob are on the same site and are calling each other
via media over WS.

In the first case, I don't see why this would allow us to relax any of
the security
requirements. As long as Alice and Bob are sending media to each other, we still
cannot trust the site to adequately verify consent, so we clearly need
ICE. As for
the need for E2E security, this seems equally important regardless of whether
Alice and Bob share the same site.

In the second case, I agree that you don't need to verify consent because it's
implicit in the WS protocol. (I'm leaving aside the question of whether using WS
this way is advisable), but the need for E2E security seems equal if
not greater,
since in this case the site would have direct access to the media.

-Ekr