Re: [webrtc-pc] either full check certs or explain why it's not necessary (4.4.1.1 Constructor)

These are not domain PKI certificates.  Though we use certificates, they are glorified holders of public keys.  Trust is anchored in the signaling.

The explanation for why checking isn't needed is a few levels of indirection away (in draft-ietf-rtcweb-security-arch, or further).  So no objection to someone adding an explanation here.

-- 
GitHub Notification of comment by martinthomson
Please view or discuss this issue at https://github.com/w3c/webrtc-pc/issues/1808#issuecomment-373926648 using your GitHub account

Received on Saturday, 17 March 2018 15:02:07 UTC