Re: WebRTC Certificate Management - a plea to NOT use Web Crypto

On 23 December 2014 at 10:43, Ryan Sleevi <sleevi@google.com> wrote:
> - Undoes three years of hard work to design some semblance of security
> guarantees regarding what is usable and exposed.
> - Introduces unnecessary ontological confusion by attempting to overlay a
> high-level semantic onto the notion of keys that the WG *repeatedly* has
> rejected
> - attempts to redefine the charter and scope of a WG and its key deliverable

Ryan, I'm seeing a lot of very strong language[1], but I'm having
trouble understanding your objections.

Let's see if I can try to ask some simple questions for clarity.

If, as Richard proposes, you get a CryptoKey with a usage of 'webrtc',
and that isn't good for anything but WebRTC, what risk does this pose
to WebCrypto?  What security protections in particular does this
ignore or jeopardize?

--Martin

[1] Frankly, I'm shocked that you think this tone is acceptable.

Received on Tuesday, 23 December 2014 19:31:50 UTC