Re: [rtcweb] draft-schwartz-rtcweb-return

Cullen,

I think the answer is obvious about credentials.  If an enterprise is
forcing users to use an enterprise TURN server, then it is up to the
enterprise to manage the credentials.  There is nothing new here.

As for your MitM comments, that isn't true unless you are saying that
DTLS-SRTP does not have any protection against MitM attacks.

- Alan -

On Thu, Mar 26, 2015 at 10:20 AM, Cullen Jennings <fluffy@cisco.com> wrote:

> I'd like to point out that the combination of
> ietf-tram-turn-server-discovery and draft-schwartz-rtcweb-return allow any
> network you are connected to more or less MITM your media and do things
> like rate limit it, generate analytics on who you are talking to, force
> your traffic through an intermediary that is in a  different legal
> jurisdiction and so on.
>
> They are also not clear on how the browser gets the credentials to use the
> discovered TURN server. This seems like a major lacking before we can
> significantly discuss this.
>
> As we have seen from the google proxy deployments, enough revenue can be
> generated from this relaying info to pay for the relay. I'm not keen on
> that happening automatically with no user consent or awareness.
>
> But I don't get how this will work for enterprise deployments - It's just
> very unclear how the JS would end with the appropriate set of TURN servers
> to use.
>
>
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>