Re: [rtcweb] Security implications of host candidates

Martin Thomson <martin.thomson@gmail.com> Mon, 09 July 2018 21:48 UTC

MIME-Version: 1.0
References: <CAOJ7v-1t_BDEEHmA4eqiS9ksYOOyHUz9LFLhQxs8FhjTdswP5w@mail.gmail.com> <CANN+akZLRdZdexjU44zPCA6vdQR0hVYT17_4P8DefC0JbRL5mA@mail.gmail.com> <CAOJ7v-2JdiMJ9iWE_cL8G7xDM6iekexJL8KLEbz0jD=p7hiGZg@mail.gmail.com> <CANN+akbv2mpyhgV5vxDHKcsA8UPsSEr0bEjJK4xYxtvbkXNA7w@mail.gmail.com> <CAOJ7v-3gHMCxHU02YG3NoqvWHtXgOSWSm+y88GNDW0qc=Sqq=A@mail.gmail.com> <CAOJ7v-3moUqwgxkz1Fek4vy-XV+WpDaO-PsQZEw4ougoCHjLww@mail.gmail.com> <CANN+akZ=Ebw41mA2wEX7-4u6q5WcZbFtM=VMLX4nDK39S=QGOQ@mail.gmail.com> <CAOJ7v-3X2Sj8Yid+i0=xadyH_Hmf4pMOF_iuOV+56Ty8HNnJuw@mail.gmail.com> <0ED74BE5-AC02-44C5-80E1-18532BD3D1FF@westhawk.co.uk> <CAOJ7v-0TGqvp=MUmeEUjYZTcvV37qbYSTV0pFMoi1J0CJQ7Q4A@mail.gmail.com> <CABkgnnXBTC5TERquJPO4dgiAKz037Cm0Omw4YrobtCW=wmGPyQ@mail.gmail.com> <CAOJ7v-0yzvu9POvR4Auokykqc63eju6_CveAzyVpcSd1kkK6Nw@mail.gmail.com>
In-Reply-To: <CAOJ7v-0yzvu9POvR4Auokykqc63eju6_CveAzyVpcSd1kkK6Nw@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Tue, 10 Jul 2018 07:48:10 +1000
Message-ID: <CABkgnnXL6sdCDt=hjX+7KbP+xYm9jCmgjJNy4CvPPna_0oin=g@mail.gmail.com>
To: Justin Uberti <juberti@google.com>
Cc: tim panton <thp@westhawk.co.uk>, RTCWeb IETF <rtcweb@ietf.org>, youenn fablet <yfablet@apple.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtcweb/gozsB6fLYbnvZUqzUPjDR305oPQ>
Subject: Re: [rtcweb] Security implications of host candidates
Precedence: list

On Tue, Jul 10, 2018 at 7:38 AM Justin Uberti <juberti@google.com> wrote:
> e) [new] RTT < 5ms (indicates "probably same machine")

My thought was that this only creates a valid "same-network" signal.
But the number of instances of one host per network is high enough
that the distinction might be meaningless.  But that's not the point,
the point was to avoid creating a new signal.

One thing that I found helpful in thinking about this was the
question: "What would Tor Browser do?"  And in that case, the proposed
tweak does work: a hairpin over the Tor network expands the anonymity
set considerably.

Re: [rtcweb] Security implications of host candid… westhawk
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Feross Aboukhadijeh
[rtcweb] Security implications of host candidates Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Lennart Grahl
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Manuel Kasper
Re: [rtcweb] Security implications of host candid… Nils Ohlmeier
Re: [rtcweb] Security implications of host candid… Justin Uberti