Re: [rtcweb] Please require user consent for data channels

[Simon Perreault <[e-mail]>]

Le 2015-07-20 14:26, Tim Panton a écrit :
> Gulp. Whilst I mostly see the logic - it is wholly unexpected behaviour
> to the average sys admin. 
> Certainly not what I expected.

I don't know how you can expect ICE to work otherwise.

> It strikes me that binding to all interfaces might well give a vector
> for attackers to map out a company’s internal networks.

You are sending your IP address(es) as payload so that your peer may
connect to them. We've been doing this in various protocols for ages.
Just take FTP for example, where data and signalling are separate. How
is any of this different?

> It also may restrict the user’s ability to manipulate which medium is used. 
> E.g. I’m at home and my chromebook pixel (or firefox tablet) is on wifi,
> but I’ve left LTE enabled.
> I (or the OS) is configured to prefer wifi wen available - but it
> happens that for a specific peer LTE completes first.
> So now my video call goes over LTE without my say-so and with no hint
> this is happening  - costing me real
> money. My only option is to completely disable LTE when I get home  (and
> lose SMS too) ?

That is a valid concern, and the answer to it is MIF.

Simon