Re: [rtcweb] Requiring ICE for RTC calls

[Roman Shpount <[e-mail]>]

>
>
> I am confused. Which phones today connect directly to a SIP to PSTN gateway
> ? I'd guess none.
> Almost all of them go through some registrar and/or proxy.
>
>
We are not talking about SIP proxy here. We are talking about media proxy.
These have a tendency to consume wast quantities of CPU and bandwidth, since
they need to resend every media packet. There is no doubt that we need a
proxy for signaling but it will not require as much resources.



> No, HTTP today does not let me probe the innards of your network ( inside
> your firewall) just by sending
> a legal but evil payload. If you permit webRTC without ICE, then the
> browser can be told to fake up UDP packets
> and send them to anywhere on your inner LAN. DOS-city.
>
> Tim.
>

How real or big do you think this problem is going to be? None of the
current SIP/VoIP clients address this now, and we have quite a number of
them out there. I understand that this is an attack vector but how big of an
attack vector is this going to be if we ask for user confirmation?
_____________
Roman Shpount