Re: [rtcweb] Let's define the purpose of WebRTC

[Iñaki Baz Castillo <[e-mail]>]

2011/11/9 Muthu Arul Mozhi Perumal (mperumal) <[e-mail]>:
> |And what is the advantage? you still say exactly the
> |same: a WebRTC client "MUST" allow plain RTP if the
> |peer is not a WebRTC client. Why is that an argument
> |in favour of non mandating SRTP?
>
> We seem to have a group of people concerned about the cost associated with having to upgrade/replace/supplement their non-SRTP capable gears such as PSTN gateways, and I was sympathetic towards them -:)

That's *your* problem. But you want to translate *your* problem into
WebRTC users by making their communications non secure.

Implementing SRTP is really easier and cheap. There is no reason at
all not to mandate it in a new specification, even less when it's
designed to work in the open (and untrusted) Internet.

So bad luck. You, telcos, have the specs and the tools to upgrade your
non-secure SIP devices. Do it.



> |If I'm in a shared WiFi network and receive a call from
> |a non-WebRTC client not supporting SRTP, my neighbors can
> |intercept it.
>
> If the shared WiFi network hasn't employed WiFi encryption, then you would probably be more concerned with your neighbors intercepting all of your traffic than just RTP -:)

It was just an example. Think about so many open WiFi networks in
airports (captive portals with no encryption).



> |What does such "STUN extension" provides here?
>
> It would tell the browser that the peer (browser) claims WebRTC compliance and so shouldn't allow insecure calling (the STUN extension is added by the browser and the applications has no control over it).

I insist: that provides nothing. It just means that me, a WebRTC user,
could have a non-secure media session in case the remote peer is not a
WebRTC peer (or a peer implementing SRTP). It solves nothing. It makes
my communication unsafe regardless I'm a WebRTC client implementing
SRTP. *My* security should NOT depend on the security implemented in
the peer (since I cannot trust the peer, never).



-- 
Iñaki Baz Castillo
<[e-mail]>