Re: [rtcweb] draft-schwartz-rtcweb-return

I think this is a sensible change and we should adopt the revised document.

On Tue, Apr 7, 2015 at 5:58 PM, Cullen Jennings (fluffy) <fluffy@cisco.com>
wrote:

>
> > On Mar 26, 2015, at 9:20 AM, Cullen Jennings <fluffy@cisco.com> wrote:
> >
> > I'd like to point out that the combination of
> ietf-tram-turn-server-discovery and draft-schwartz-rtcweb-return allow any
> network you are connected to more or less MITM your media and do things
> like rate limit it, generate analytics on who you are talking to, force
> your traffic through an intermediary that is in a  different legal
> jurisdiction and so on.
>
> We discussed this after the meeting and came up with a  way to resolve
> this concern. Benjamin has added some text to the -06 to that specifically
> addresses this issue
>
>
> http://www.ietf.org/rfcdiff?url1=draft-schwartz-rtcweb-return-05&url2=draft-schwartz-rtcweb-return-06
>
> This completely deals with the issue I raised and with that change I
> support adopting this as a WG document.
>
> After adoption, I think the WG should consider if any text is needed
> around the issue of TURN credentials. (If you run TURN with no credentials
> and an attacker can spoof the IP address in UDP packets, you can end up
> with the TURN servers in a nasty forwarding loop that allows an huge
> amplification factor for an attacker trying do DOS the turn servers - this
> is still possible with authentication but you know who to blame. When TURN
> was first done with was one of the reason TURN requires auth and STUN does
> not). However, I believe this issue can solved and should not block
> adopting the draft. )
>
> Cullen
>
>
>
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>