Re: [rtcweb] SRTP not mandatory-to-use

[Roman Shpount <[e-mail]>]

On Wed, Jan 11, 2012 at 2:52 PM, Justin Uberti <[e-mail]> wrote:

> To reply to the OP: The consensus that I see having emerged from this
> discussion is that SRTP should be mandatory to use, with a provision for
> NULL ciphers for debugging. This provision is only exposed through
> developer settings, and can never be invoked from the web app; for all
> practical purposes, applications will have to use SRTP
>
>
I would still argue (even though I am obviously a minority here), that
plain RTP should be supported and this support should be accessible via JS
API with no web server configuration changes. The reasons are (apart from
debugging that will be addressed by NULL cypher), are overall symmetry with
HTTP vs HTTPS. As I have mentioned before, there are environments where
completely unsecured communication applications should be delivered, such
as some countries, army, prisons and such. I understand that you want to
disregard these people but they are internet users as well. Please keep in
mind that I am not arguing for a back-door to intercept secure
communications (against IETF policy) or to provide a way for secure
communication to fall back to unsecured. All I am looking for is an ability
to provide unsecured service if I, as a service provider, decide to do so.
_____________
Roman Shpount