[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #62 from Ryan Sleevi <sleevi@google.com> ---
(In reply to Joe Steele from comment #56)
> I don't think we are arguing that TLS is not viable (at least I am not). I
> am arguing that HTTP with message-based encryption is equally viable and has
> certain advantages. We should allow implementations to leverage those
> advantages when they want to.

Frankly, this isn't the case of any of the DRM protocols that I've seen. Nor do
the affordances of message-based encryption protocols, such as Netflix's
description of their desire for WebCrypto over HTTP, meet the security standard
expected by UAs (and our constituencies!) for user privacy and confidentiality.

Nor do I think we can argue that a robustly analyzed and audited protocol is
somehow less desirable than individual vendors' home-grown protocols, for which
it is a design goal of the product to make it difficult to analyze or reason
about, and which short of the UAs individually implementing the protocol from
scratch and auditing it, cannot have any assurances afforded even to the UA.

> 
> There is a good writeup on a weakness specific to SSL/TLS here --
> http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity. 
> Perhaps ironically, the tightly controlled message-based encryption used by
> many DRM are not subject to these issues and thus are more secure than SSL
> in this sense at least.

I suspect any refutal to this will verge so far off topic that we'll end up in
the weeds. To the extent that I say I cannot let misinformation stand, I would
say that the conclusion you reach is not at all supported by the article. Among
the many reasons that this is, consider the most simplest response this: The
public can audit the behaviour of CAs, and CAs business interests are aligned
with promoting security (as the alternative is obsolence). The public CANNOT
audit CDMs (as has been repeatedly established here that this be the outcome,
even if the spec allows for hypothetically audited CDMs), and the business
interests of CDMs is inherently geared towards creating a model of "too big to
fail" (i.e. that they're an inextricable part of certain large media streaming
sites, and as such, no UA can effectively disable or reject the CDM, for fear
of breaking the experience for the users).

The rest we can save for a separate discussion in another forum, if it should
somehow becomes necessary to show how a singular monolithic and opaque entity
is worse than a diverse and robust competitive space with public audits and
transparency.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Thursday, 21 August 2014 22:47:04 UTC