Re: [rtcweb] Strawman for how to prevent voice-hammer without ICE

[Bernard Aboba <[e-mail]>]

[BA] Agree that it's worth exploring further, if only to document what the security requirements are, and what is required to meet them.  The problem with the gateway argument is that it can be extended too far -- it is one thing to require a gateway for signaling, and quite another to require transcoding of media, for example.  As long as we have legacy interop use cases, and aren't asserting that RTCWEB represents a "singularity", then we need to be able to handle them. 


> [JRE] This assumes RTP-RTCP multiplexing, which not many current devices support. There are so many things that RTC-Web is proposing to use that are not widely supported on existing devices that some sort of gateway looks inevitable. Eliminating one particular instance of incompatibility might reduce the amount of adaptation the gateway needs to perform, but it looks increasingly unlikely that all adaptation can be eliminated. So is there any real value in trying to eliminate one aspect if others can't be eliminated? Probably yes, but not if it introduces other compromises, e.g., security. I think it is worth exploring this further.