Re: [rtcweb] Question on sec architecture proposal

[Randell Jesup <[e-mail]>]

On 1/10/2012 3:22 AM, Stefan Hakansson LK wrote:
> On 01/09/2012 04:46 PM, Randell Jesup wrote:
> ....
>>> Any use trying to access the data (including using the audio element as
>>> source) would throw security exceptions.
>>
>> I suggest starting by going back in the archives to that period; there
>> was considerable discussion of the issue.

> Thanks for the tip, funny how things fade away from memory....
>
> I did read up, but it seems that discussion did not really end up at a
> conclusion. And it was mostly discussed for the local context, never how
> to ensure that the data of a stream on the other end of a PeerConnection
> can not be accessed.

I was talking to roc (Robert O'Callahan) last night, and he believes 
using cross-origin-type controls can be used to basically block the JS 
from getting access to the decrypted/decoded media streams.  (This 
already exists for blocking JS access to cross-origin images.)  So, no 
need to use tainting per-se.

There certainly remains the issue of when and how the JS would get 
access to the streams, and without it they wouldn't be able to use some 
of the audio "processed streams" stuff we're working on.  And if the 
user has to give permission for access, does this permission stick? 
(This is overall related to the whole "does this app/website have 
permission to access the camera & mic" issue.)

A strawman proposal might be a "secure connection" checkbox on the 
getUserMedia() popup which defaults to secure.  That may not be an 
optimum UI, however.

-- 
Randell Jesup
[e-mail]