Re: [rtcweb] Security implications of host candidates

Justin Uberti <juberti@google.com> Mon, 09 July 2018 22:19 UTC

MIME-Version: 1.0
References: <CAOJ7v-1t_BDEEHmA4eqiS9ksYOOyHUz9LFLhQxs8FhjTdswP5w@mail.gmail.com> <CANN+akZLRdZdexjU44zPCA6vdQR0hVYT17_4P8DefC0JbRL5mA@mail.gmail.com> <CAOJ7v-2JdiMJ9iWE_cL8G7xDM6iekexJL8KLEbz0jD=p7hiGZg@mail.gmail.com> <CANN+akbv2mpyhgV5vxDHKcsA8UPsSEr0bEjJK4xYxtvbkXNA7w@mail.gmail.com> <CAOJ7v-3gHMCxHU02YG3NoqvWHtXgOSWSm+y88GNDW0qc=Sqq=A@mail.gmail.com> <CAOJ7v-3moUqwgxkz1Fek4vy-XV+WpDaO-PsQZEw4ougoCHjLww@mail.gmail.com> <CANN+akZ=Ebw41mA2wEX7-4u6q5WcZbFtM=VMLX4nDK39S=QGOQ@mail.gmail.com> <CAOJ7v-3X2Sj8Yid+i0=xadyH_Hmf4pMOF_iuOV+56Ty8HNnJuw@mail.gmail.com> <0ED74BE5-AC02-44C5-80E1-18532BD3D1FF@westhawk.co.uk> <CAOJ7v-0TGqvp=MUmeEUjYZTcvV37qbYSTV0pFMoi1J0CJQ7Q4A@mail.gmail.com> <CABkgnnXBTC5TERquJPO4dgiAKz037Cm0Omw4YrobtCW=wmGPyQ@mail.gmail.com> <CAOJ7v-0yzvu9POvR4Auokykqc63eju6_CveAzyVpcSd1kkK6Nw@mail.gmail.com> <CABkgnnXL6sdCDt=hjX+7KbP+xYm9jCmgjJNy4CvPPna_0oin=g@mail.gmail.com>
In-Reply-To: <CABkgnnXL6sdCDt=hjX+7KbP+xYm9jCmgjJNy4CvPPna_0oin=g@mail.gmail.com>
From: Justin Uberti <juberti@google.com>
Date: Mon, 09 Jul 2018 15:19:17 -0700
Message-ID: <CAOJ7v-33ODGTsmbHEp_U7UdROvuKR7O7bne2_0tX6ivVf-+C5A@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Tim Panton <thp@westhawk.co.uk>, RTCWeb IETF <rtcweb@ietf.org>, youenn fablet <yfablet@apple.com>
Content-Type: multipart/alternative; boundary="000000000000385dd305709868d9"
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtcweb/ibUNVf-Tdz1boSZpUKjDfp6P8T4>
Subject: Re: [rtcweb] Security implications of host candidates
Precedence: list

On Mon, Jul 9, 2018 at 2:48 PM Martin Thomson <martin.thomson@gmail.com>
wrote:

> On Tue, Jul 10, 2018 at 7:38 AM Justin Uberti <juberti@google.com> wrote:
> > e) [new] RTT < 5ms (indicates "probably same machine")
>
> My thought was that this only creates a valid "same-network" signal.
> But the number of instances of one host per network is high enough
> that the distinction might be meaningless.  But that's not the point,
> the point was to avoid creating a new signal.
>
> One thing that I found helpful in thinking about this was the
> question: "What would Tor Browser do?"  And in that case, the proposed
> tweak does work: a hairpin over the Tor network expands the anonymity
> set considerably.
>

Well, Tor browser would really need all WebRTC traffic to flow through Tor,
to prevent linking sessions via the srflx IPs.

But let me get to the point. Adding the limitations discussed for .local
has minimal downside, but what, if anything, should we do with IPv6 host
candidates? If we decide that we want to prevent host-host IPv6
connections, there will be implications for datachannel applications.

Re: [rtcweb] Security implications of host candid… westhawk
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Martin Thomson
Re: [rtcweb] Security implications of host candid… Feross Aboukhadijeh
[rtcweb] Security implications of host candidates Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Lennart Grahl
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Harald Alvestrand
Re: [rtcweb] Security implications of host candid… youenn fablet
Re: [rtcweb] Security implications of host candid… Justin Uberti
Re: [rtcweb] Security implications of host candid… Manuel Kasper
Re: [rtcweb] Security implications of host candid… Nils Ohlmeier
Re: [rtcweb] Security implications of host candid… Justin Uberti