Re: [rtcweb] Resolving RTP/SDES question in Paris

["Ejzak, Richard P (Richard)" <[e-mail]>]

Ted,
I simply do not buy your argument.

It doesn't matter what security scheme is used if you download a dedicated communications client that you don't trust.  It can play whatever games it wants with the UI and the security configuration and you are none the better off.  You have to trust the application.

It is only within the context of a trusted browser (and its UI) that any of this security work makes sense.  As long as you can trust the browser to tell you what's going on, you don't have to trust the application.

You might also have a trusted dedicated application but it better follow the same guidelines if it expects to remain trusted.

Richard

-----Original Message-----
From: Ted Hardie [mailto:[e-mail]] 
Sent: Monday, March 19, 2012 9:51 AM
To: Ejzak, Richard P (Richard)
Cc: [e-mail]
Subject: Re: [rtcweb] Resolving RTP/SDES question in Paris

On Sun, Mar 18, 2012 at 9:10 PM, Ejzak, Richard P (Richard)
<[e-mail]> wrote:
> I would like to argue two points: 1) DTLS-SRTP with IdP is the only media
> security scheme that rtcweb should support; and 2) rtcweb should also
> support RTP (no media security) with a clear requirement on the browser UI
> to warn the user of the complete lack of media security.
>

I'd like to comment on the "browser UI" issue here.  As we have
discussed in the past, the users of this technology may very well
include applications which are not browsers.  In the "pokerstars"
example, a mobile device may very well be using a purpose-built
application instead of the mobile browser in order to reach the site.
These mobile apps may interact with web-browser based clients during
the same hand of poker.   If the web-browser based client wants to use
an insecure media channel and can get consent, there is still no
guarantee that other clients can do the same using the same UI
feature.

Web technology != browser.  Let's be careful not to build the security
story at the protocol level on UI features we can neither predict nor
control.  We can choose not to have certain levels of security, but
hand-waving that decision away because we believe it can be managed at
some other layer is a very risky proposition.

regards,

Ted