Re: [rtcweb] Consensus call regarding media security

[Roman Shpount <[e-mail]>]

On Wed, Mar 28, 2012 at 1:56 PM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2012/3/28 Roman Shpount <[e-mail]>:
> > As I have mentioned before on this list I am strongly against making SRTP
> > protection for RTP a requirement. I think this is an unnecessary
> requirement
> > that serves little real purpose except feeding into some marketing
> message
> > that most of the WebRTC users would not care about. Unless use of
> identity
> > is also a requirement, requiring SRTP will provide security only in a
> very
> > narrow sense of the word. At the same time I do believe that extra
> standard
> > requirements will stifle innovation and  will complicate new service or
> > application creation.
>
> SRTP (with SDES so without identity authentication) is still much
> better than plain RTP, right? If I'm in an airport connected to an
> open WiFi network, but I use HTTPS/WSS for signaling from my WebRTC
> browser, then I can be sure that no one in the airport can intercept
> my media streams (using SRTP-SDES).
>
> Of course this does not solve the fact that there could be some MiM
> attacker somewhere in the signaling path, but NOT in the airport! What
> is sure is that if I was using plain RTP then everyone in the open
> WiFi network could intercept my media streams.
>
> IMHO it's really clear that SRTP (even with SDES) is MUCH better than
> plain RTP. And so far I have not heard any advantage fof allowing
> plain RTP other than "it allows interoperability with my 5 years ago
> SIP device".
>
>
My main objection is that if an application developer does not take care to
develop a secure application, nothing you can do on the standard side will
make it a secure application. If I am building a public voice blog that
records a voice message that anybody can listen to on the web site security
is not needed. My assumption is that a fair number of applications would be
like this. So for such applications this is an unnecessary feature.

WebRTC will not exist in vacuum. It will communicate with other systems. It
is not limited to old SIP devices. It can be something new like server side
speech recognition that is integrated with web application. For such
application extra code and interop requirements to support security will
represent a real and significant cost. Any requirement, unless absolutely
necessary will create barriers to entry for new applications. I would like
to avoid as many of those as possible.
_____________
Roman Shpount