Re: [rtcweb] Let's define the purpose of WebRTC

[Eric Rescorla <[e-mail]>]

On Wed, Nov 9, 2011 at 6:33 AM, Roman Shpount <[e-mail]> wrote:
> On Wed, Nov 9, 2011 at 8:44 AM, Iñaki Baz Castillo <[e-mail]> wrote

> 2. SRTP is not required: If we are dealing with a greeting card application
> or game chat, no one expects security. If security can be provided this will
> probably not hurt anybody, but in the end it will serve no purpose there.

I'm focusing solely on this point because I think it does such a good job
of demonstrating the limitations of this kind of "who would ever want security
for application X" thinking.

I can envision situations on which security would be desirable in both of
these applications. In the case of a "greeting card application" (whatever
that is) my greeting card might contain sensitive personal or medical
information (congratulations on your pregnancy, sorry to hear you have
cancer etc.) Surely I do in fact want that information secured. Similarly,
it might not be important to have my Farmville chats secure, but if the
purpose of an in-game chat is for me and my co-player to cooperate
in a game where money is on the line (e.g., a tournament), then suddenlu
security becomesmuch more important. Not to mention that the players
may simply be using in-game chat to discuss personal stuff.

The point is that it's very hard to anticipate which communications media
will be used for sensitive information. To say "we don't need security
in this application because nobody will ever use it to discuss sensitive
stuff" is short-sighted. Better simply to be secure all the time.

-Ekr