Subject: RE: [Sipping] History info and privacy

From: "Mark Watson" <[email-masked]>
Date: Fri, 20 Dec 2002 16:02:08 -0000

Well, there is still a difference between the solutions below and the ISDN
case.

B may well know C's (non-private) identity, but not C's privacy preferences.
C may not have expected B to use their non-private identity for forwarding,
and so has given them C and not C'. C may have *instructed* B not to use the
identity for forwarding and B may have *disobeyed* that instruction.

The ISDN service provides C with an opportunity, in real-time, to prevent
their identity being delivered to A - no matter how many of C's instructions
B has disobeyed, and no matter what mis-understandings there were about
privacy between B and C, the network ensures that C's preferences are
honoured.

I don't think SIP can provide this kind of protection against
'mis-understandings' and 'disobeyed instructions' between human users,
because we do not have the same network of 'trusted' elements that the ISDN
has.

I don't think this is a problem either, but it is certainly a PSTN/ISDN
feature which is not available in SIP.

Btw - the C' approach does not work perfectly, because C' still identifies
C. Ok, so the first time A sees C' they do not know who it is, but on
subsequent occasions they can glean some information when they see the same
identity again. Also, C may not wish A to know that the call has been
forwarded *at all*. This can only be done by requiring B to use retargeting,
rather than redirect, and then probably through some privacy service as
well.

Regards...Mark

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: 20 December 2002 15:28
> To: Elwell, John
> Cc: Watson, Mark [MOP:EP10:EXCH]; [email-masked]'
> Subject: Re: [Sipping] History info and privacy
> 
> 
> 
> 
> Elwell, John wrote:
> > Mark,
> >  
> > OK, this is a problem with redirects. Perhaps we just have 
> to conclude that
> > this privacy feature that is available in ISDN/QSIG is not 
> achievable in
> > SIP. 
> 
> Clearly that is not the case. Its just an issue of proper 
> configuration 
> at B's proxy. Indeed, I would argue that if C was so concerned about 
> their identity being revealed, they would provide B with an alternate 
> identity, C', which routes to a privacy service before 
> getting forwarded 
> to them.
> 
> > It means C has to trust B not to use a redirect (unless it 
> is sent back
> > to another trusted entity) and to configure B's proxy in a 
> way that does not
> > disclose the identity of C back towards A.
> 
> If C provides an alternate identity, as I propose above, it doesn't 
> matter whether B redirects or not.
> 
> -Jonathan R.
> 
> 
> 
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
> Chief Scientist                             First Floor
> dynamicsoft                                 East Hanover, NJ 07936
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
>

---

From: "Cullen Jennings" <[email-masked]>
Date: Fri, 20 Dec 2002 08:57:12 -0800

Let's say that the network elements A,B,C are operated by the human
users Alice, Bob, and Chuck respectively. Now the Chuck told Bob an
address that Bob can program into B that to be able to forward calls to
C. If Bob takes this address and posts it on a bathroom stall in a bar
that Alice goes to there is nothing that ISDN can do about it. 

This whole argument has diverged into the silly - It is sounding like
the assumption is that every element in a ISDN networks is trusted and
always does what it is supposed to and never leaks any information and
that all SIP network elements are not trusted and do the worst thing
possible the information they receive. With this assumption, yes, they
two systems will different overall security properties.

Cullen

PS. C' could be a address that was only usable once a new one was
generated each time. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Mark Watson
Sent: Friday, December 20, 2002 8:02 AM
To: 'Jonathan Rosenberg'; Elwell, John
Cc: [email-masked]'
Subject: RE: [Sipping] History info and privacy

Well, there is still a difference between the solutions below and the
ISDN case. 
B may well know C's (non-private) identity, but not C's privacy
preferences. C may not have expected B to use their non-private identity
for forwarding, and so has given them C and not C'. C may have
*instructed* B not to use the identity for forwarding and B may have
*disobeyed* that instruction.
The ISDN service provides C with an opportunity, in real-time, to
prevent their identity being delivered to A - no matter how many of C's
instructions B has disobeyed, and no matter what mis-understandings
there were about privacy between B and C, the network ensures that C's
preferences are honoured.
I don't think SIP can provide this kind of protection against
'mis-understandings' and 'disobeyed instructions' between human users,
because we do not have the same network of 'trusted' elements that the
ISDN has.
I don't think this is a problem either, but it is certainly a PSTN/ISDN
feature which is not available in SIP. 
Btw - the C' approach does not work perfectly, because C' still
identifies C. Ok, so the first time A sees C' they do not know who it
is, but on subsequent occasions they can glean some information when
they see the same identity again. Also, C may not wish A to know that
the call has been forwarded *at all*. This can only be done by requiring
B to use retargeting, rather than redirect, and then probably through
some privacy service as well.
Regards...Mark 
> matter whether B redirects or not. 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP