Change:
cannot interfere.  In order to facilitate that, it will be necessary to provide features whereby the site can verifiably give up access to the media streams.  This verification must be possible both from the <del> local side and the remote side.  I.e., I must be able to verify that the person I am calling has engaged a secure media mode (see </del> <ins> local side and the remote side.  I.e., users must be able to verify that the person called has engaged a secure media mode (see </ins> sec.malicious).  In order to achieve this it will be necessary to cryptographically bind an indication of the local media access policy into the cryptographic authentication procedures detailed in the

Discussion:
(or attempts to at least).
NAME ready to merge
Need to work through Ben's . I'd like to have a brief discussion about a few points, though it's not clear that any change to the document will be required (details in the COMMENT section for all of these): Mutually-verifiable "secure mode" seems to require that the peer's browser be included in the TCB, which is a bit hard to swallow.  Are we comfortable wrapping that in alongside "we trust the peer to not be malicious"? It's not clear how much benefit we can get from *optional* third-party identity providers; won't the calling service have the ability to silently downgrade to their non-usage even if both calling peers support it? I mostly only have editorial comments, though there are a few that are more content-ful. The user can observe the javascript running the browser, though maybe this distinction is not necessary here. I note that the author of this document is listed as a coauthor on huang-w2sp; does the self-cite really add much authority to the summary of the guarantee? The use of ALL-CAPS to call out new terms feels a bit dated. nit: I know this is a web-centric document, but the privileging of https as the only "secure" traffic reads a bit oddly to me; something like "note that in some cases, a network attacker is also a web attacker, since transport protocols that do not provide integrity protection allow the network to inject traffic as if they were any communications peer. TLS, and HTTPS in particular, prevent against these attacks, but when analyzing HTTP connections, we must assume that traffic is going to the attacker."  (A thought experiment might be to consider whether wss://traffic counts as "HTTPS traffic".) It might be appropriate to provide some example references in place of "extensive research". nit: the wording here is a bit odd, since in case (1) you're verifying you're talking to A, but you still control where the media goes (in terms of A or not-A; A can of course then forward on the media further). nit: "local" is perhaps overly restricting, depending on interpretation Maybe note that the "result" of the cross-site requests that is leaked is in the form of pixels and not structured data, but that does not change the information content. nit: I'm confused by "another" here.

This seems to be relying on the reader to have some background knowledge and make some leaps of reasoning that may not be reasonable to expect. This is especially challenging because if the site (and/or its javascript) is in the path for binding a cryptographic identity to a real-world identity, then a malicious site can still get whatever keys it wants authorized. seem to be missing a word or two here. nit: "If any page" is more emphatic, I think. Do we want any discussion of the risks when metered bandwidth (pay per byte) is in use? There's probably some room to tighten up the verbiage here; e.g., "the site initiating ICE" is referring to a website that is using a browser API to request ICE against some remote peer (right?).  And "ICE keepalives are indications" is using Indication as the technical term for a message that doesn't get an ACK response, not in its common English usage. A one- or two-sentence summary of the impact of misinterpretation attacks is probably in order, instead of making us follow the reference (which isn't a section reference). nit: "employed" to obfuscate what, exactly? nit: "incorporated" into what? I think I'm a little confused about which legacy actors we're talking about.  Are we still considering the broader situation a webserver-mediated interaction between two browsers or brower-adjacent applications?  (E.g., a WebRTC client calling some other sort of video chat system?) nit: "threat is" Is "answered" supposed to be some interaction with the controlling site? Some rewording for clarity is probably in order; "ordinary operation" is of a website without WebRTC; "sites can cause the browser to provide IP addresses" is when the site uses the browser API to request ICE initiation; etc. [Obligatory note about "Forward Secrecy" vs. "Perfect Forward Secrecy"] To be clear, the authentication that the calling service provides is a binding between identity and the public keys that are input to the key exchange mechanism? nit: "browser to use trusted UI" It's not clear that third-party identity providers actually provide downgrade-resistance -- can't the site mediating the calls just decline to acknowledge that a third-party identity is/was available for the peer?

This seems to require extending the TCB from just the local browser to the remote browser as well, which is ... a stretch. (Also, do we really need the first person?) The coordinates for [OpenID] don't seem quite right.