[secdir] WebRTC

[Hank Nussbacher <[e-mail]>]

Dear Security Area people,

Quick intro:

WebRTC http://www.webrtc.org/ is a free, open project that enables web 
browsers with Real-Time Communications (RTC) capabilities via simple 
Javascript APIs.   It is supported by Google, Mozilla and Opera.  One can 
test it already in Chrome. Basically, it is meant to be a Skype replacement 
technology (no app to download - all built-in to the browser).  But there 
are many other ideas that can be used here with this technology.

Now we get to the security part.  As stated here: 
http://www.webrtc.org/blog/webrtcnowavailableinthechromedevchannel
one has to specifically enable "--enable-media-stream" in order to get it 
to work. That is now, but the future plan is to have this "on" by default 
in FF and Chrome by the end of 2012.

So what does the IETF have to say:

Security Considerations for RTC-Web
http://tools.ietf.org/html/draft-ietf-rtcweb-security-01
which caused:
RTCWEB Security Architecture
http://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-01
Section 5.2:
"Clients MAY permit the formation of data channels without any direct user 
approval."

I can just see new apps all over the place using this technology opening a 
huge can of worms for data stealing from the PC running the app that did 
NOT ask permission for the formation of a data channel without the direct 
user's permission.  This is similar in concept to ActiveX:
http://en.wikipedia.org/wiki/ActiveX
"This made the web "richer" but provoked objections (since such controls 
ran only on Windows) and security risks (especially given the lack of user 
intervention). Microsoft subsequently introduced security measures to make 
browsing including ActiveX safer[6] . For example:

     digital signing of installation packages (Cabinet files and executables)
     controls must explicitly declare themselves safe for scripting
     increasingly stringent default security settings
     Internet Explorer maintains a blacklist of bad controls"

Microsoft didn't envision the security issues of a "lack of user 
intervention" and it took them 3 years to add the appropriate knobs to make 
ActiveX more secure.

I am not involved in WebRTC or the IETF group - I only found out about this 
incidentally.  I raise this issue to you guys and leave it the Security 
Area to decide whether section 5 needs to be changed or not.

Regards,
Hank Nussbacher