Subject: RE: Notes from Non-meeting (Privacy vs. Authentication based Identification)

From: Ricardo Cuellar <[email-masked]>
Date: Thu, 21 Mar 2002 01:43:55 +0100

Brian wrote:

> However, it is possible to put reasonable mechanisms in
> place such that calls to a specific address (sos@anydomain)
> gets to the PSAP serving the local domain. Such mechanisms
> may not be perfect, but I think they are adequate.

Why not perfect? why adequate? What is the requirement?
I would like to understand that better.

In general it is a privacy concern to use a "global identifier"
say a (static) phone number, a NAI, etc.

Besides eavesdropping, the concern is that the Location Server
can create a large dossier of information of where a user has been,
and which communication partners he had (the clients).

On the other hand, if you go for authentication without explicit
identification (say using the standard solutions for privacy, 
pseudonyms, or using "purpuse-built-keys and identities"
etc.) besides that authentication is not tivial, you run into
other problems, for instance DoS attacks, etc.

Although this is not trivial, that if fits in a half-page, this
is a well-known problem space.

Jorge
Dr Jorge R Cuellar   Office: Tel +49 89 636 47585
Siemens CT IC 3              Fax +49 89 636 48000
Otto-Hahn Ring 6    [email-masked]
81730 München
---------  Out of town: -------------
    Fax & Voicebox: +49 (0) 12125-130-30-549 
    [email-masked]

______________________________________________________________________________
Die schönsten Ski-Regionen der Alpen - jetzt bei Ferienklick.de
http://ferienklick.de/ski/?PP=2-5-100-105-38