Re: [rtcweb] Traffic should be encrypted. (Re: Let's define the purpose of WebRTC)

[Roman Shpount <[e-mail]>]

On Thu, Nov 10, 2011 at 4:37 PM, Harald Alvestrand <[e-mail]>wrote:

>  So far, we've heard arguments that:
>
> - encryption uses more CPU (true, but arguably not significant compared to
> media processing)
> - It is needed for legacy interoperability (may be true for some, but not
> necessarily compelling)
> - It helps debugging (which has been disputed by people who debug systems)
>
> Did I miss some?
>
>
Encryption being illegal in some situations is yet another reason (I know
about the IETF position on wiretapping, but I would still argue that this
is a valid reason.)

Higher barrier to entry for building new services -- for instance if you
are building a media server to work with WebRTC client. Having one more
thing to implement before something works is not critical, but makes a
difference.

Debugging is actually not a decided issues since we have not reached
consensus on the key exchange protocol. Depending on it, debugging can be a
lot more or much less difficult. We do provide an SIPS/SRTP/HTTPS enabled
systems and services to our customers, but we are regularly being asked to
turn security off for debugging.

These arguments are not very strong and would not prevent WebRTC from being
used (except the illegal part). My main problem is that mandatory
encryption is not serving any useful purpose. I strongly oppose the
illusion of security when communications are not secure. If an application
is delivered over HTTP, the fact that media is encrypted is irrelevant and
provides no useful security. There is a duality about web based
applications with HTTP and HTTPS. I think WebRTC should reflect this. There
is a working model present for HTTP applications already (secure document
-- secure communications, insecure document -- insecure communications), so
I do not see the reason to break it.
_____________
Roman Shpount