Subject: Re: [Ice] [rtcweb] WGLC Review of draft-ietf-ice-rfc5245bis-12 - Security Considerations Pull Request

From: Christer Holmberg <[email-masked]>
Date: Wed, 18 Oct 2017 12:37:16 +0000

Hi,

...

>> 
>>> * Security considerations should mention the problem that ICE reveals
>>> addresses that might otherwise remain hidden, and that this is a
>>>privacy
>>> concern.
>> 
>> I would be glad if someone could provide text for that, to make sure we
>> get it right.
>
>The paragraph I suggested in the PDF was:
>
>³The process of probing for candidates reveals the source addresses of
>the client and its peer to any on-network listening attacker, and the
>process of exchanging candidates reveals the addresses to any attacker
>that is able to see the negotiation. Some addresses, such as the server
>reflexive addresses gathered through the local interface of VPN users,
>may be sensitive information. If these potential attacks can¹t be
>mitigated, the implementation may want to institute controls for which
>addresses are revealed to the negotiation and/or probing process. Such
>controls need to be specified as part of the ICE usage.²
>
>Of course, that's only my suggestion.

Pull request created:

https://github.com/ice-wg/rfc5245bis/pull/49

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 19 Oct 2017 12:40:19 +0000

Hi,

The PR has been merged.

Regards,

Christer

-----Original Message-----
From: rtcweb [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 18 October 2017 14:37
To: Harald Alvestrand <[email-masked]>; [email-masked]
Cc: [email-masked]
Subject: Re: [rtcweb] WGLC Review of draft-ietf-ice-rfc5245bis-12 - Security Considerations Pull Request

Hi,

...

>> 
>>> * Security considerations should mention the problem that ICE 
>>>reveals  addresses that might otherwise remain hidden, and that this 
>>>is a privacy  concern.
>> 
>> I would be glad if someone could provide text for that, to make sure 
>> we get it right.
>

Pull request created:

Regards,

Christer

_______________________________________________
rtcweb mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/rtcweb