Re: [rtcweb] SRTP and "marketing"

On Wed, Mar 28, 2012 at 2:15 AM, Richard L. Barnes <rbarnes@bbn.com> wrote:

> [...]
> What I'm concerned about in the RTCWEB context is that without a universal
> authentication/identity infrastructure, we will end up *promising* a secure
> call, but not *delivering* it.  I haven't done the analysis, but it does
> not seem implausible to me that FireSheep-like vulnerabilities are lurking
> here.
>
>
>

The choices of framework proposed in today's meeting still carry an overall
undercurrent of the same generic mechanism as a SAML-based authentication
and authorization.
Even if a universal authentication infrastructure should exist - it becomes
a potential single point of failure (imagine that being the defunct
diginotar) or non-success (MS Passport).
Too many trust-anchors (IdPs) is a problem as well for the single end-user
(non-enterprise). But in the end - would users prefer to go with the
trust-anchors they have come to associate with and have gained a reputation
for; or something completely new?

Even with identity - the authoritative case proposes a <name>:<domain>
paradigm and in the 3rd party case too - assertions are based on
association of a user to domain - by an outside idP. Thus, there's
significant closeness in the identity form - regardless of whether it is
the most common RFC822 (email address), SIP URI (with a slight exception of
OpenID) or other URI forms.

-mani

> So ISTM the "marketing" argument carries with it some serious risks as
> well as some small possible benefit.
>
> --Richard
> ______________________________**_________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/**listinfo/rtcweb<https://www.ietf.org/mailman/listinfo/rtcweb>
>