Re: [rtcweb] [MMUSIC] Draft new: draft-wang-mmusic-encrypted-ice-candidates

As for precedent for managing Chrome in an enterprise environment,
https://cloud.google.com/docs/chrome-enterprise/policies/ gives a rundown
on what is currently supported, and is the easiest way to do this sort of
thing.

DHCP could also be used, but requires OS support.

On Mon, Nov 11, 2019 at 1:04 AM Sean DuBois <sean@pion.ly> wrote:

> On Fri, Nov 01, 2019 at 01:06:22PM -0700, Qingsi Wang wrote:
> > Greetings.
> >
> > This draft (
> >
> https://tools.ietf.org/html/draft-wang-mmusic-encrypted-ice-candidates-00)
> > proposes a complementary solution to the mDNS candidate detailed
> > in draft-ietf-rtcweb-mdns-ice-candidates, specifically for managed
> > networks. IPs of ICE candidates are encrypted via PSK and signaled as
> > pseudo-FQDNs in this proposal, and it aims to address the connectivity
> > challenge from the mDNS technique in these managed environments. The
> > current work on this draft is tracked in
> > https://github.com/tQsW/encrypted-ice-candidates.
> >
> > Regards,
> > Qingsi
>
> > _______________________________________________
> > rtcweb mailing list
> > rtcweb@ietf.org
> > https://www.ietf.org/mailman/listinfo/rtcweb
>
> Hi,
>
> Really excited to see this RFC. This is a real pain point, and glad it
> is being addressed. I implemented this over the weekend and everything
> fell into place.
>
> Have you thought about/explored encrypting the entire SessionDescription?
> There might be some issues I am not aware of, but it would give us some
> other nice things!
>
> * No more SDP munging (or at least make it harder)
>    - People shoot themselves in the foot constantly by editing things
>    - Will push people to communicate API needs more, instead of more hacks
>
> * Host candidates aren't the only thing you can be fingerprinted off of
>   - Agents craft very different SDPs (FireFox vs Chromium)
>   - SDPs reveal hardware attributes (Chromium Android has H264 only with
> HW Accel)
>   - Agent may have different experiments/settings (attributes at
> session/media level)
>
> * Changes to candidate strings is going to cause more breakage
>   Maybe this doesn't matter as much, but I anticipate this is going to
>   cause more bugs. Some clients/SFUs/MCUs... blew up when mDNS came out,
>
>   I bet another change is going to cause the same thing. It sounds like
>   this will be much less likely because people will need to setup
>   something up to get the PSK going.
> -------
>
> I would love to see example implementations of the Key Management. Is
> there any precedent for configuration of the WebRTC agent in managed
> networks?
>
> _______________________________________________
> mmusic mailing list
> mmusic@ietf.org
> https://www.ietf.org/mailman/listinfo/mmusic
>