Re: [rtcweb] Requiring ICE for RTC calls

[Matthew Kaufman <[e-mail]>]

On 9/27/2011 7:46 AM, Roman Shpount wrote:
>
> How real or big do you think this problem is going to be? None of the 
> current SIP/VoIP clients address this now, and we have quite a number 
> of them out there. I understand that this is an attack vector but how 
> big of an attack vector is this going to be if we ask for user 
> confirmation?
>

There is no plan to ask for user confirmation to open a connection, 
receive media, or send and receive data. The only user confirmation that 
is expected would be for camera and/or microphone access.

I've seen a dozen messages from you arguing that the requirement for a 
STUN connectivity check is a barrier and should be removed, but I have 
not yet seen an alternative proposal that meets the requirements of 
browser authors with regard to preventing attacks on behind-firewall 
infrastructure from the browser platform.

Matthew Kaufman