Subject: [Sip] REFER Security

From: "Sriramp Parameswar" <[email-masked]>
Date: Wed, 20 Mar 2002 21:07:55 +0000

Hi:

I tend to fall into the camp that believes when you have any intermediary you weaken security - also I am queasy about self signed certificates.

I would put my vote clearly behind C (transfer target from cc-transfer) directly contacts A (transferor in cc-transfer) and asking for verification. This was shown as VERIFY in Roberts slides - and may I suggest that we use NEGOTIATE as the method that does this verification check.

Thanks,

Sriram

Join the world’s largest e-mail service with MSN Hotmail. Click Here

_______________________________________________
Sip mailing list https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Zmolek, Andrew (Andrew)" <[email-masked]>
Date: Wed, 20 Mar 2002 16:23:03 -0700

Are you suggesting that security trumps privacy in this case?
 
--Andy

-----Original Message-----
From: Sriramp Parameswar [mailto:[email-masked]]
Sent: Wednesday, March 20, 2002 2:08 PM
To: [email-masked]
Subject: [Sip] REFER Security

Hi:

 
Thanks,
 
Sriram

  _____  

Join the world's largest e-mail service with MSN Hotmail. Click  <http://g.msn.com/1HM305401/16> Here
_______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use [email-masked] for questions on current sip Use [email-masked] for new developments on the application of sip

---

From: "Sriramp Parameswar" <[email-masked]>
Date: Thu, 21 Mar 2002 17:12:05 +0000

No - remember C can contact A only if the Referred-By header is valid - thus if A wants to remain anonymous he can send a "bogus" Referred-By Header.

The other thing I like with this mechanism is that Party C (transfer target) needs to contact Party A (transferor) *only* if he thinks that he needs to validate the source of the REFER - other wise the REFER goes on its merry way. Also if he contacts Party A and receives a  reply with 'huh? - not me' then Party C can reject the call.

Thanks,

Sriram

>From: "Zmolek, Andrew (Andrew)"

>To: "Sriramp Parameswar" ,

>Subject: RE: [Sip] REFER Security

>Date: Wed, 20 Mar 2002 16:23:03 -0700

>Join the world's largest e-mail service with MSN Hotmail. Click Here

MSN Photos is the easiest way to share and print your photos: Click Here