Re: [rtcweb] Which servers to trust (Re: Consensus call regarding media security)

[Randell Jesup <[e-mail]>]

On 4/3/2012 7:55 AM, Iñaki Baz Castillo wrote:
> 2012/4/3 Harald Alvestrand<[e-mail]>:
>>> SDES-SRTP provide a very reliable and simple way to let a WebRTC peer to
>>> establish security with the server, assuming that it already have
>>> established security trough HTTPS/TLS that's a consolidate trust method.
>>
>> The term "the server" is a fallacy. The Web server and the media gateway (if
>> there is one) are likely not the same server, and may even be operated by
>> different entities.
>> SDES-SRTP forces you to trust both.
>
>
> If you trust the Web server (i.e. due to HTTPS usage with a valid
> server certificate) then you will also trust that the Web server will
> not signal your WebRTC communication to a malicious destination, am I
> wrong?

Partly.  First, as you mention, the site can be hacked.  Another issue 
is that you may NOT trust the website to avoid tapping your 
communication (and in fact they may be legally obligated to do so, and 
have no choice in the matter).  Also, as shown by Diginotar, website 
certs can be forged transparently if a CA is hacked.  Those are both 
real-world cases where you cannot trust the site you connect to via 
https to secure your data (in addition to "the site was hacked", even if 
they are "trustworthy".

> Don't take me wrong but, which kind of security obsession are we
> trying to satisfy in rtcweb? a media communication is not more
> important than a web access to my back website in which I enter my
> credit card PIN. Does IETF define "security standards" for POS ("Point
> of sale terminal") for making a bank payment via a 3rd web
> (e-commerce)? AFAIK not.

No, but other organizations define such standards in great detail - and 
still there are weekly breaches of security that require credit card 
companies to send out thousands or millions of replace cards & numbers.

And a site providing media communication will not have the ultra-strict 
security reviews and audits that come with processing credit card info, 
and so is much more likely to be hacked.

> If the Web server (assuming HTTPS) is trusted and SDES-SRTP used, we
> should trust the communication. If it fails that is because the Web
> server has been attacked. If that occurs, it's really worse the case
> in which my bank website has been attacked (I'm giving my credit card
> PIN to the attacker).

It can be far worse - most people are given guarantees about how much 
they can lose (often $0) - a hassle is all usually; sometimes a big 
hassle, but not harmful personally.  Media interception (especially 
video) can cause horrible repercussions in some cases - blackmail, 
embarrassment, scandal, and in countries like Iran or cases like the 
Arab Spring, jail or death.


-- 
Randell Jesup
[e-mail]