WebRTC Security Assessment

Hi all, 

as promised to some of you during TPAC, the STREWS project has published 
today the WebRTC Security Case Study. It was teamwork from the entire 
project, but special thanks go to Stephen Farrell for constantly 
cleaning and improving the document. 

The Document is published on the STREWS website under "results": 

http://www.strews.eu/results/91-d12

For your convenience, here is the abstract: 

Built-in handling of Real Time Media (audio, video) on the web promises 
potentially significant change in telephony and in conference calling. 
The W3C WebRTC and IETF rtcweb working groups are developing the set of 
specifications that will allow browsers and web sites to support such 
calling and other functions. This is clearly a potentially security 
sensitive extension to the web, so STREWS has devoted effort on this 
topic as a case study to both attempt to improve the overall security of 
the result and to see if this approach holds promise as a way to improve 
interactions between researchers and standards makers and hence the 
overall security of the web. In this deliverable, we show some possibly 
new issues with WebRTC security discovered by researchers (from SAP) 
that the standards makers may not have considered. However, while this 
deliverable is, as a deliverable, final, the work itself goes on, partly 
involving discussions between the STREWS project and participants in the 
IETF and W3C so in technical terms this remains a work-in-progress.

-- 
Rigo Wenning (@rigow) - W3C Legal counsel