Re: [rtcweb] Resolving RTP/SDES question in Paris

[Iñaki Baz Castillo <[e-mail]>]

2012/3/19 Ejzak, Richard P (Richard) <[e-mail]>:
> RTP
>
> There are too many reasonable use cases for unsecured media for us to ignore
> them.

Which ones? I just see one: interoperability with legacy SIP devices.
The question is: does it make sense to create a new specification
(WebRTC) less secure that it can be instead of forcing SIP vendors to
implement SRTP in their devices? If SIP vendors assumed that their
devices would just work in trusted networks (or wallen gardens) that
should not affect the security aspects of a new specification made for
*Internet*. That's their problem (SRTP was initially defined for SIP,
so they must do their homeworks).

Is plain RTP an advantage for WebRTC? Not at all since WebRTC
implementations will support SRTP by design so downgrading to plain
RTP is never better than using SRTP. Even if you use an VPN for your
enterprise WebRTC application there is NO problem at all in using SRTP
over the VPN.

So instead of anecdotal usecases in which plain RTP is "good enough" I
would prefer to read the truth: "I am a telco/vendor and I want WebRTC
(a specification originally designed for Internet) to support plain
RTP so I can make business with my legacy and not secure SIP devices,
those that don't implement SRTP regardless SRTP was designed for SIP".



> The browser should be very clear when media security is unavailable
> and make it easy to prevent communication without media security (perhaps as
> a default setting), but there are legitimate use cases in various private
> environments (e.g., enterprise, jail) where media security may not be
> allowed (or must somehow be compromised), or is just not available, that we
> should just support straight RTP.  As long as the user can control the
> conditions under which media security is disabled, I do not see a problem.

I assume that finally plain RTP will be allowed in WebRTC, too much
interest in interoperability with legacy and non secure SIP devices.
However, adding more and more "security approvals" for end users in
their web browsers is much worse than mandating security by design.


Regards.


-- 
Iñaki Baz Castillo
<[e-mail]>