Re: [rtcweb] Why persistent consent for HTTP is a problem

[Stefan Hakansson LK <[e-mail]>]

Would it be feasible to allow only pages delivered over https to use 
persistent consent?

(I think that in certain situations it could be annoying to have to give 
consent every time)

Stefan

On 06/27/2012 01:52 AM, Igor Faynberg wrote:
> Not only that, but I find it hard to understand why anyone would need to
> give persistent consent for accessing media devices to any device.
>
> I also thought the issue was closed for good.
>
> (Sorry, I could not be present at the intereem meeting, even remotely...)
>
> Igor
>
> On 6/26/2012 6:59 PM, Eric Rescorla wrote:
>> In Martin's review of draft-ietf-rtcweb-security-arch, he (re)raised
>> the question of persistent consent for camera/microphone access from
>> pages served over HTTP.  I had thought this issue closed, but in the
>> discussion at the interim there seemed to be a fair amount of
>> sentiment that people hadn't understood the security issues and now
>> believed that this was a bad idea. I agreed to attempt to re-start the
>> discussion with a clearer description of what the problem was, hence
>> this message.
>>
>> Here's the basic attack:
>> Say that I have given persistent permission to access my camera and
>> microphone to any page from http://www.example.com/. Now, I go to an
>> Internet cafe and surf to *any* HTTP page, e.g.,
>> http://www.google.com/. At this point, any attacker who controls the
>> wireless network can redirect that access to point to
>> http://www.example.com/ and inject JS that reads from my camera and
>> microphone.
>>
>> That's pretty bad, but made worse by the following facts:
>> 1. It's not that hard for the attacker to open up
>> popups/popunders/iframes, etc. that are in the domain of example.com
>> but actually execute code from the attacker.  So, once you've opened
>> the browser in a hostile environment, the attacker can bug you at
>> times of his choosing until you close your browser.
>>
>> 2. If your browser does any sort of auto-refresh (e.g., because
>> the page refreshes itself) then you can get infected even if you
>> don't do anything deliberate.
>>
>> 3. This also applies if you are using any kind of open wireless
>> network, such as if your home network doesn't use a strong
>> enough WPA key.
>>
>>
>> So, the executive summary is: if you have a persistent permission
>> for an HTTP site, and you ever use your browser on any insecure
>> network, an attacker can bug your computer until you close your
>> browser. This seems bad.
>>
>> Does this change people's opinions about what the rules should be
>> about whether browsers permit persistent HTTP permissions?
>>
>> -Ekr
>> _______________________________________________
>> rtcweb mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rtcweb
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb
>