- From: Bernard Aboba <Bernard.Aboba@microsoft.com>
- Date: Sat, 16 May 2015 18:24:51 +0000
- To: "public-ortc@w3.org" <public-ortc@w3.org>
Received on Saturday, 16 May 2015 18:25:20 UTC
At the ORTC CG meeting on May 13, Justin pointed out that passing incoming media to an RtpReceiver prior to verification of the remote fingerprint could permit a DTLS man-in-the-middle attack. So while there is the potential for incoming media in the DTLS "connecting" state, there probably should be a prohibition on passing decrypted media to an attacked RtpReceiver until the "connected" state is reached.
Received on Saturday, 16 May 2015 18:25:20 UTC