Re: [rtcweb] Let's define the purpose of WebRTC

["Muthu Arul Mozhi Perumal (mperumal)" <[e-mail]>]

I was trying to envision a solution for the "untrusted JS" issue and I don't intend to argue on whether or not we should allow insecure calling to non-WebRTC clients.

|The "browser" cannot decide that. Probably you mean the user

Yes, a decision made by the browser with user consent if required, with no application involvement.

|And what you state is that, in case the peer does not annouce 
|support for SRTP then the browser should downgrade security 
|to plain RTP.

No, not based on the SRTP capability advertised by the peer, rather based on whether the peer claims it is WebRTC compliant (to make sure calls b/w WebRTC clients are always secure).

|The user (web visitor) has no way to know whether the WebRTC 
|application will contact a WebRTC browser or another device 
|at the media plane.

We could add a STUN extension to indicate compliance to WebRTC, including the supported version level if we ever come up with WebRTC2.0.

Muthu

|-----Original Message-----
|From: Iñaki Baz Castillo [mailto:[e-mail]]
|Sent: Wednesday, November 09, 2011 5:28 PM
|To: Muthu Arul Mozhi Perumal (mperumal)
|Cc: Avasarala, Ranjit; Ravindran Parthasarathi; Cullen Jennings (fluffy); Olle E. Johansson;
|[e-mail]
|Subject: Re: [rtcweb] Let's define the purpose of WebRTC
|
|2011/11/9 Muthu Arul Mozhi Perumal (mperumal) <[e-mail]>:
|> I am thinking we could burn SRTP into the browser such that the decision of whether or not to use
|SRTP vests solely with the browser.
|
|The "browser" cannot decide that. Probably you mean the user, that
|person that in 99.999% of cases does not know what "encryption" or
|"SRTP" is, and in 85% of cases does not matter about security.
|
|
|> If a WebRTC browser is exchanging media with another WebRTC browser they always do SRTP/SRTCP.
|
|The browser has NO way to determine whether it's exchanging media with
|another browser or not. And what you state is that, in case the peer
|does not annouce support for SRTP then the browser should downgrade
|security to plain RTP. The user (web visitor) has no way to know
|whether the WebRTC application will contact a WebRTC browser or
|another device at the media plane.
|
|
|> If either side isn't WebRTC compliant they end up with RTP/RTCP.
|
|So no security. Bad.
|
|
|> This way we don't need to trust the JS, instead trust only the browser.
|
|You mean the user.
|
|
|> We can also interoperate with legacy devices without taxing them.
|
|Sorry, but WebRTC is about "realtime communications for the Web",
|rather than "SIP business coming to the Web". SIP uses RTP, including
|RFC's about SRTP. If you want SIP interoperability with a WebRTC
|device, then make your work as vendor and add security to your SIP
|devices rather than asking no-security for WebRTC.
|
|Please, take a look to XMPP/Jingle !!  They implement SRTP and ICE
|from the beginning!! *Do* your homeworks as SIP vendor.
|
|This is a problem of SIP vendors/telcos, this is not a problem of
|WebRTC. You should implement SRTP in your legacy and non-secure SIP
|devices and make them valid for communication across the open Internet
|in which security is a MUST (Internet is not a telco wallen garden).
|The main purpose of WebRTC is not to interoperate with insecure
|devices, do we all agree here?
|
|I don't support this kind of arguments in favour of non mandating SRTP.
|
|
|PS: Somebody could argue that, in the Web, neither HTTPS or
|WebSocket+TLS is a MUST but optional per website, so why to make SRTP
|mandatory? That would be a very different argument I could understand
|and discuss about. But forcing a *new* specification to be insecure
|just to allow interoperability with non-secure devices is not welcome.
|WebRTC is for the Web, not for SIP.
|
|PS: This kind of discussions give the reason to recent comments like
|the one from Tim Parton. This WG is too much focused on SIP
|vendors/telcos which are not fully interested in RTC communications in
|pure Web/Internet environments, but in making the web browsers a new
|SIP phone for integratting them into their telco business. Bad.
|
|PS: I'm also interested in interoperability between WebRTC browsers
|and SIP devices (as much as you), but I assume that just a few SIP
|devices MUST be able to interop with WebRTC (those that have done
|their homeworks by implementing SRTP and ICE).
|
|
|And those discussions are becoming very boring. There are not new
|arguments at all. It seems than within next weeks/months, SIP
|telcos/vendors will continue requesting not mandatory SRTP just to
|facilitate their business without investing in improving their
|non-secure devices. This is a no-go.
|
|
|Regards.
|
|
|--
|Iñaki Baz Castillo
|<[e-mail]>