Re: [rtcweb] No Interim on SDES at this juncture

[Hadriel Kaplan <[e-mail]>]

On Jun 21, 2013, at 11:58 AM, Martin Thomson <[e-mail]> wrote:

> On 20 June 2013 18:11, Hadriel Kaplan <[e-mail]> wrote:
>> criminals, drug dealers, mobsters, casinos, news organizations, political parties, and governments
> 
> I assume that large corporations fit in this list in several places,
> so you chose to omit specific mention of those.  

Yes I chose to omit them.  Not because I think large corporations are angels, but because I think there are fairly effective mechanisms in place to keep large corporations from being malicious in terms of recording audio/video you don't expect to be recorded: laws, law suits and brand reputation.

That's why I think even direct competitors of Cisco are willing to use WebEx - and my last 4 employers all used WebEx and were all direct competitors of Cisco - not because we think it's impossible for the WebEx server to do it, nor because we believe they don't store keys or whatever, but rather because we know if they got caught doing it on purpose for malicious use then they'd be sued for blood, and the reputation of WebEx would be so tarnished as to be put out of existence.

Obviously there are some large corporations I won't name that my employers probably feel couldn't be held accountable or in-check in those ways - but we would never trust such large corporations no matter what key-exchange mechanism WebRTC uses.  In fact, even if WebRTC could provide a key-exchange that no malicious MITM could bypass, we still wouldn't trust such corporations - because the information in the JSON is almost as important as the conversation audio/video: it identifies who's communicating with whom, for how long, from where, and often even on what subject.  That's one of the reasons I was saying the other day: if the web-server or JS is truly malicious or compromised, it's game over.


> There seems to be a
> fair amount of overlap in those categories as it stands.

I get the impression each one might not be a criminal in some country-or-other's perspective.
Arguably for some countries, *all* of them are "criminals". ;)

-hadriel