Change:
Ben cleared his discuss after Adam's response, but we still need to include text to address the . I'd like to have a brief discussion about a few points, though it's not clear that any change to the document will be required (details in the COMMENT section for all of these): Mutually-verifiable "secure mode" seems to require that the peer's browser be included in the TCB, which is a bit hard to swallow.  Are we comfortable wrapping that in alongside "we trust the peer to not be malicious"? It's not clear how much benefit we can get from *optional* third-party identity providers; won't the calling service have the ability to silently downgrade to their non-usage even if both calling peers support it? I mostly only have editorial comments, though there are a few that are more content-ful. The user can observe the javascript running the browser, though maybe this distinction is not necessary here. I note that the author of this document is listed as a coauthor on huang-w2sp; does the self-cite really add much authority to the summary of the guarantee? The use of ALL-CAPS to call out new terms feels a bit dated. nit: I know this is a web-centric document, but the privileging of https as the only "secure" traffic reads a bit oddly to me; something like "note that in some cases, a network attacker is also a web attacker, since transport protocols that do not provide integrity protection allow the network to inject traffic as if they were any communications peer. TLS, and HTTPS in particular, prevent against these attacks, but when analyzing HTTP connections, we must assume that traffic is going to the attacker."  (A thought experiment might be to consider whether wss://traffic counts as "HTTPS traffic".) It might be appropriate to provide some example references in place of "extensive research". nit: the wording here is a bit odd, since in case (1) you're verifying you're talking to A, but you still control where the media goes (in terms of A or not-A; A can of course then forward on the media further). nit: "local" is perhaps overly restricting, depending on interpretation Maybe note that the "result" of the cross-site requests that is leaked is in the form of pixels and not structured data, but that does not change the information content. nit: I'm confused by "another" here. This seems to be relying on the reader to have some background knowledge and make some leaps of reasoning that may not be reasonable to expect. This is especially challenging because if the site (and/or its javascript) is in the path for binding a cryptographic identity to a real-world identity, then a malicious site can still get whatever keys it wants authorized. seem to be missing a word or two here. nit: "If any page" is more emphatic, I think. Do we want any discussion of the risks when metered bandwidth (pay per byte) is in use? There's probably some room to tighten up the verbiage here; e.g., "the site initiating ICE" is referring to a website that is using a browser API to request ICE against some remote peer (right?).  And "ICE keepalives are indications" is using Indication as the technical term for a message that doesn't get an ACK response, not in its common English usage. A one- or two-sentence summary of the impact of misinterpretation attacks is probably in order, instead of making us follow the reference (which isn't a section reference). nit: "employed" to obfuscate what, exactly? nit: "incorporated" into what? I think I'm a little confused about which legacy actors we're talking about.  Are we still considering the broader situation a webserver-mediated interaction between two browsers or brower-adjacent applications?  (E.g., a WebRTC client calling some other sort of video chat system?) nit: "threat is" Is "answered" supposed to be some interaction with the controlling site? Some rewording for clarity is probably in order; "ordinary operation" is of a website without WebRTC; "sites can cause the browser to provide IP addresses" is when the site uses the browser API to request ICE initiation; etc. [Obligatory note about "Forward Secrecy" vs. "Perfect Forward Secrecy"] To be clear, the authentication that the calling service provides is a binding between identity and the public keys that are input to the key exchange mechanism? nit: "browser to use trusted UI" It's not clear that third-party identity providers actually provide downgrade-resistance -- can't the site mediating the calls just decline to acknowledge that a third-party identity is/was available for the peer? This seems to require extending the TCB from just the local browser to the remote browser as well, which is ... a stretch. (Also, do we really need the first person?) The coordinates for [OpenID] don't seem quite right.

Discussion:
into the cryptographic authentication procedures detailed in the previous sections. <ins> It should be noted that the use of this secure media mode is left to the discretion of the site.  When such a mode is engaged, the browser will need to provide indicia to the user that the associated media has been authenticated as coming from the identified user.  This allows WebRTC services that wish to claim end-to-end security to do so in a way that can be easily verified by the user.  This model requires that the remote party's browser be included in the TCB, as described in sec.web-security. </ins> 4.3.3. One class of attack that we do not generally try to prevent is