Re: [rtcweb] Mirja Kühlewind's Discuss on draft-ietf-rtcweb-security-11: (with DISCUSS and COMMENT)

["Mirja Kuehlewind (IETF)" <[e-mail]>]

Hi Ekr,

see below.

> Am 28.02.2019 um 22:22 schrieb Eric Rescorla <[e-mail]>:
> 
> 
> 
> On Thu, Feb 28, 2019 at 10:00 AM Mirja Kühlewind <ietf@kuehlewind..net> wrote:
> Mirja Kühlewind has entered the following ballot position for
> draft-ietf-rtcweb-security-11: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-rtcweb-security/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> I think this document is clearly informational. Other RTCweb documents should
> refer this document informatively and only reference the sec arch doc
> normatively.
> 
> I don't feel strongly one way or the other. I will defer to the AD.


I will wait for more feedback from other ADs and then clear my discuss respectively. However, to be honest I also don’t quite fully understand the split between this doc and the sec-arch one. But maybe that just me...
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> I would have also expected some discussion about the risks to the user if the
> browser gets corrupted, as indicated by the trust model presented in
> draft-ietf-rtcweb-security-arch. Alternatively, this document could go in the
> appendix of draft-ietf-rtcweb-security-arch instead.
> 
> Hmm... We generally assume that the browser is uncorrupted. If it is, it's pretty much game over. Can you explain more about your position. 

My thinking here is that the security consideration should usually mention potentially attacks. First the whole document assumes that the browser is not corrupted but never says that. So it would help if this document would also mention the trust model as explicitly described in the sec-arch doc or refer to it. But then I also thought that it could be good to say more about what „game over“ means. Which information could or would be lost in danger. I understand that if an attacker has full control over the blower it can basically display anything, however, I was wondering if it would be possible to say more than that. Maybe there are part that can be easier hack than others… anyway was just a thought.