Re: [rtcweb] Consensus call regarding media security

[Basil Mohamed Gohar <[e-mail]>]

On 03/28/2012 04:41 PM, Roman Shpount wrote:
> My main objection is that if an application developer does not take
> care to develop a secure application, nothing you can do on the
> standard side will make it a secure application. If I am building a
> public voice blog that records a voice message that anybody can listen
> to on the web site security is not needed. My assumption is that a
> fair number of applications would be like this. So for such
> applications this is an unnecessary feature.
>
> WebRTC will not exist in vacuum. It will communicate with other
> systems. It is not limited to old SIP devices. It can be something new
> like server side speech recognition that is integrated with web
> application. For such application extra code and interop requirements
> to support security will represent a real and significant cost. Any
> requirement, unless absolutely necessary will create barriers to entry
> for new applications. I would like to avoid as many of those as
> possible. 
> _____________
> Roman Shpount
Roman,

You make a lot of good points.  However, the inverse is true as well -
namely, that is if encryption is not mandated, most implementations will
likely leave it out, and adoption of secured communications would be
stifled even longer.  I cannot speak about the implementation
difficulties, but I can speak from the user side that most people will
remain ignorant of the underlying technology and not know enough to
demand nor enable a feature if it is optional to implement and/or use.

As WebRTC is a new standard, requiring encryption will ensure that, at
least going forward, the important concept of encryption is widely
adopted correctly from the beginning.  Tacking it on later, no matter
how much it is emphasized, will be difficult or impossible.

The scope of WebRTC is broad enough to consider that we need to think
about what's best going forward with regards to its implementation. 
Security by default is one of the best practices in general, the support
from the browser community and others that are behind it will definitely
ensure that adoption is widespread enough to make it easy enough to
integrate into existing systems, as free software solutions will become
available shortly after the standard emerges.