Re: [rtcweb] Resolving RTP/SDES question in Paris

[Roman Shpount <[e-mail]>]

On Fri, Mar 16, 2012 at 6:55 PM, Iñaki Baz Castillo <[e-mail]> wrote:

> Giving the security responsability to end users as a configurable
> option is not a good idea. The world would be much better if the
> browsers would not allow plain HTTP, but it's not possible to change
> the WWW requeriments and mandate HTTPS given the ammount of plain HTTP
> deployments. In contrast, WebRTC does not exist yet so *now* is the
> moment to mandate security.
>
>
And you imply that the fact that security is most of the times unnecessary
and often prohibited, has absolutely nothing to do with using HTTP over
HTTPS. If you think people in the military or in prisons do not use web
browsers, think again. Requiring secure communications will prevent them
from using WebRTC.

Furthermore comparison between HTTP/HTTPS and RTP/SRTP in not entirely
appropriate. HTTPS communications are reasonably secure. SRTP calls, unless
we make identity management a requirement for WebRTC, are only giving
people a false sense of security. The fact that browser uses SRTP does not,
in any way, imply that the communication is secure. If the key was
delivered over HTTP, anybody intercepting your IP traffic can listen to it.
If we are dealing with the server based attack then all hell breaks loose.
So, unless we requiring that only connections are over DTLS-SRTP using an
SDP signed by a verified remote party are allowed, we allow unsecure
connections. We need to show an appropriate warning for all of them, and
warning RTP vs SDES-SRTP vs unsigned DTLS-SRTP should not be very
different. It should say "You are trying to communicate over unsecure
peer--to-peer channel with an unknown party. Continue?" There is no, "you
are trying to use slightly more secure channel. Is this ok?".
_____________
Roman Shpount