Re: [rtcweb] Solutions sought for non-ICE RTC calls, not +1 (Re: Requiring ICE for RTC calls)

[Matthew Kaufman <[e-mail]>]

On 9/27/2011 3:13 PM, Roman Shpount wrote:
> Eric,
>
> I would suggest we should have an ability to disable ICE/SRTP in 
> browser settings altogether for debugging purposes 

No idea why that would be helpful. If you really want cleartext traffic, 
allow a null SRTP cipher, not plain RTP.

And disabling ICE doesn't help anything.

> and have an ability to add a web site to browser settings (or assign 
> it to intranet zone), which would enable this web site to setup calls 
> without ICE/SRTP. 

Bad idea.

> This way a developer can disable these protocols to test things, and 
> user can take an action to say that it trust a certain web site and 
> allows it to place calls anywhere. 

Yes, and the same way a malicious site can say "if you want to browse 
our free porn collection, you must click 'yes' on the next dialog" and 
then proceed to attack at will. Totally unacceptable.

> I would think browser settings are outside of the standards document, 
> but we at least should have requirements for ICE-required and SRTP as 
> SHOULD, not MUST.

ICE needs to be a MUST. Debate is still going on support (or not) for 
plain RTP.

Matthew Kaufman