Re: [rtcweb] Requiring ICE for RTC calls

Iñaki Baz Castillo <ibc@aliax.net> Tue, 27 September 2011 16:35 UTC

Return-Path: <ibc@aliax.net>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A629D21F8EE8 for <rtcweb@ietfa.amsl.com>; Tue, 27 Sep 2011 09:35:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.336
X-Spam-Level:
X-Spam-Status: No, score=-2.336 tagged_above=-999 required=5 tests=[AWL=-0.259, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_43=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B3LufI5AAydT for <rtcweb@ietfa.amsl.com>; Tue, 27 Sep 2011 09:35:19 -0700 (PDT)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by ietfa.amsl.com (Postfix) with ESMTP id 2CCDF21F8ED6 for <rtcweb@ietf.org>; Tue, 27 Sep 2011 09:35:19 -0700 (PDT)
Received: by vws5 with SMTP id 5so8407719vws.31 for <rtcweb@ietf.org>; Tue, 27 Sep 2011 09:38:04 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.52.23.4 with SMTP id i4mr7566132vdf.514.1317141484842; Tue, 27 Sep 2011 09:38:04 -0700 (PDT)
Received: by 10.220.118.143 with HTTP; Tue, 27 Sep 2011 09:38:04 -0700 (PDT)
In-Reply-To: <CAD5OKxukiZzhotpjhmH6y6XCRYsBWUjzYAUYX9bGy+n=D-V31g@mail.gmail.com>
References: <CAD5OKxtNjmWBz92bRuxka7e-BUpTPgVUvr3ahJGpmZ-U5nuPbQ@mail.gmail.com> <CAD6AjGSmz5T_F+SK2EoBQm6T-iRKp7dd4j8ZAF5JKdbbyomZQA@mail.gmail.com> <CALiegfmO54HC+g9L_DYn4jtXAAbLEvS++qxKa6TNrLDREs9SeA@mail.gmail.com> <4E80984A.903@skype.net> <CALiegfmyvTb57WVooKryS-ubfcg+w5gZ+zfO1zzBLn3609AzaA@mail.gmail.com> <4E809EE6.2050702@skype.net> <CAD5OKxvUOadaU0dnB7-Ho9cZ92VY+4Owuhj7oKPCx9Jy1iwT1Q@mail.gmail.com> <C2DF2C51-B3F7-443D-A047-7E6FB03E6D20@phonefromhere.com> <CAD5OKxsy2eKx5Bc8iayYazSyyykZZTGx9UO7NEE=fxYYdouy0w@mail.gmail.com> <4E81E8AB.2080404@skype.net> <CAD5OKxukiZzhotpjhmH6y6XCRYsBWUjzYAUYX9bGy+n=D-V31g@mail.gmail.com>
Date: Tue, 27 Sep 2011 18:38:04 +0200
Message-ID: <CALiegfmKsiXt_QZQX-WdTnFYmvx1OqjBeLNx8K2VmPYH_CD2=w@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Roman Shpount <roman@telurix.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Randell Jesup <randell-ietf@jesup.org>, rtcweb@ietf.org
Subject: Re: [rtcweb] Requiring ICE for RTC calls
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Sep 2011 16:35:19 -0000

2011/9/27 Roman Shpount <roman@telurix.com>om>:
> If we do decide that ICE is a requirement, we can also have a local policy,
> web site can be specified for which the calls are allowed without ICE.

I agree. Somebody would reply now that the provider could be
malicious, but nothing prevents a malicious provider to establish a
valid and secure SRTP+ICE video session with a web visitor and later
publish the video in Youtube.


> Independently from all of this, SRTP should be optional. It does present
> privacy concerns, but they are no different then privacy concerns over HTTP.

The privacy concerns of RTP are the same that those present in HTTP,
SMTP, FTP, SIP, XMPP or whatever application level protocol. But none
of those specifications require TLS. Of course a service provider
could decide to impose TLS, but the specification (rtcweb here) should
not mandate so much (IMHO).

-- 
Iñaki Baz Castillo
<ibc@aliax.net>