Subject: RE: [Sipping] draft-niccolini-sipping-feedback-spit-00

From: "Samir Srivastava" <[email-masked]>
Date: Wed, 22 Mar 2006 01:09:43 -0600

IMHO, Identity itself alone is not sufficient. Suppose SPAMMER calls using Privacy Service (Annonymous  From header, some networks might reject annonymous callers) SAML assertion might pass it, but with different values. When Callee gives the feedback, it can be exchanged between the providers. And the provider where caller was situated, that provider (who is providing privacy 
Service in this case) can take appropiate action.

There is fundamental difference in email and Voice. Wherever you have access to email whether
through Cyber café etc, you are allowed to send emails with somebody@somedomain as originator. 
This is not the case always with voice. What will be the identity when SPAMMER calls from Hallway phones, Conference Room Phones, public phones etc. 

Look at hotmail/yahoo etc, one might get sip URI from similar SIP providers in future.  

The case you mentioned below, caller might be blacklisted in callee specific URI list.  BTW, SIP has Subject header. And We have the feedback mechanism in yahoo/hotmail etc in email world.

Thx
Samir

-----Original Message-----
From: Dan Wing [mailto:[email-masked]] 
Sent: Tuesday, March 21, 2006 9:26 PM
To: 'Saverio Niccolini'; [email-masked]
Cc: 'Sandra Tartarelli'; john.elw@[email-masked]; 'Martin Stiemerling'
Subject: RE: [Sipping] draft-niccolini-sipping-feedback-spit-00

> Are there any more comments?
> Do you believe this is an important topic the group should discuss?

I don't feel standardizing this is helpful for SPIT.  There has been years of research into email antispam.  While they have content and subject lines (and SIP doesn't), the problem of 'blacklisting' someone is very complex (how does one get off the list, what if a blacklisted person is a legitimate customer of a legitimate company [wants to get their car repaired at the local car dealer, or wants to get a pizza delivered] but that person earlier in the day was harassing their congressman's office and got blacklisted?

I don't think we want to go there, at least not in SIP or in SIPPING.

Whoever does go there can tell us what information they find useful.  And I'm sure it'll be sip-identity and some codification of the claimed SPIT offense.

-d

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP Use [email-masked] for questions on current sip Use [email-masked] for new developments of core SIP

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 22 Mar 2006 07:31:09 -0800

> IMHO, Identity itself alone is not sufficient. Suppose 
> SPAMMER calls using Privacy Service (Annonymous  From header, 
> some networks might reject annonymous callers) SAML assertion 
> might pass it, but with different values. When Callee gives 
> the feedback, it can be exchanged between the providers. And 
> the provider where caller was situated, that provider (who is 
> providing privacy Service in this case) can take appropiate 
> action.

Sure, that's one model.  

> somebody@somedomain as originator. 

Sure.  But because spammers are doing this, email identity 
is being standardized in the IETF via the DKIM working group.
Google and Yahoo have implemented early versions of this 
already.  I'm sure everyone is aware of the SPF work that 
predated DKIM and attempts to identify legitimate senders
as well.

All of these systems (SPF, DKIM, SIP Identity) merely do 
identity to varying degrees.  They're not the same, quite
obviously.

On top of that you need something like 
niccolini-sipping-feedback-spit.

> This is not the case always with voice. What will be the 
> identity when SPAMMER calls from Hallway phones, Conference 
> Room Phones, public phones etc. 

They'll have a different identity each time, perhaps.  It's
hard to guess -- we don't have SPIT yet.  However, they'll
take the easiest path to bypass existing call-blocking 
techniques that are in place.  That goes without saying.

So, with a different identity each time, how useful is
reputation?  I argue it's useless if that's the attack.
Instead you need the consent framework, or you need some
reputation-like introduction system ("You can ring my 
phone if my friend Billy says you are his friend").

> The case you mentioned below, caller might be blacklisted in 
> callee specific URI list.  BTW, SIP has Subject header. 

Uh-huh.  And when you make a SIP phone call, what value to
you _personally_ put in that Subject header?  What value 
appears in the Subject line of a SIP trunk call originated by
Cisco/Avaya/Nortel/Siemens/Asterisk IP PBX?

> And 
> We have the feedback mechanism in yahoo/hotmail etc in email world.

Yep, we do.  And those feedback systems aren't perfect by any
means.  Are we sure that -niccolini-sipping-feedback-spit 
provides enough information to those feedback systems to enable
those feedback systems to ensure false-positives can be detected
and removed from the feedback system?

-d

> I don't feel standardizing this is helpful for SPIT.  There 
> has been years of research into email antispam.  While they 
> have content and subject lines (and SIP doesn't), the problem 
> of 'blacklisting' someone is very complex (how does one get 
> off the list, what if a blacklisted person is a legitimate 
> customer of a legitimate company [wants to get their car 
> repaired at the local car dealer, or wants to get a pizza 
> delivered] but that person earlier in the day was harassing 
> their congressman's office and got blacklisted?
> 
> Whoever does go there can tell us what information they find 
> useful.  And I'm sure it'll be sip-identity and some 
> codification of the claimed SPIT offense.
> 
> -d
> 
> Use [email-masked] for questions on current 
> sip Use [email-masked] for new developments of core SIP