Subject: Re: [rtcweb] SRTP and "marketing"

From: Oscar Ohlsson <[email-masked]>
Date: Mon, 2 Apr 2012 14:32:45 +0200

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Gregory Maxwell
> Sent: Friday, March 30, 2012 5:38 PM
> To: Randell Jesup; [email-masked]
> Subject: Re: [rtcweb] SRTP and "marketing"
> 
> 
> A point which needs to be emphasized is that undetectable 
> attacks are not at all the same thing as detectable attacks: 
> Even when the chance of detection is somewhat low, if the 
> cost of detection is high the possibility of it can be an 
> effective deterrent.
> 

It is definely important to distinguish between detectable and un-detectable interception. But as I mentioned earlier, I don't think enabling SDES in WebRTC will enable un-detectable interception. If both parties open up Tools->PageInfo->Media->session-security and see something like:

Is SDES turned on? Yes
Is this endpoint capable of DTLS-SRTP? Yes

Then they could automatically assume that they're are beeing intercepted. In my opinion this is not that much different from comparing fingerprints.

Regards,

Oscar