Subject: [rtcweb] #10: Additional Threats

From: "rtcweb issue tracker" <[email-masked]>
Date: Sat, 16 Feb 2013 22:26:12 -0000

#10: Additional Threats

 Aside from the threats described in the document, a few others come to
 mind.  It might be useful for the document to state explicitly why or why
 not these are out of scope:

 a. Live versus replayed streams.  While you might have media security,
 this doesn't tell you whether the stream is actually originating from a
 device or is being replayed.

 b. Prank calling.  While the document talks about permission to make
 calls, it doesn't mention permission to receive or blocking of unwanted
 calls.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-rtcweb-
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  major                    |  Milestone:  milestone1
Component:  security                 |    Version:  1.0
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/rtcweb/trac/ticket/10>
rtcweb <http://tools.ietf.org/rtcweb/>

---

From: Martin Thomson <[email-masked]>
Date: Mon, 18 Feb 2013 11:13:53 -0800

This opens a new category of attack, one that I wasn't all that
concerned about.  Namely, the guy on the other end isn't trustworthy.

To a large extent, peer authentication allows users to make their own
assessments, but we have to acknowledge (and likely accept) that the
other guy isn't necessarily trustworthy.  I think that we can rule the
age-old human problem out of scope, but perhaps we should be clear
that we are doing so.

On 16 February 2013 14:26, rtcweb issue tracker
<[email-masked]> wrote:
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb