Subject: Re: [Ecrit] requirements

From: "Stastny Richard" <[email-masked]>
Date: Wed, 23 Mar 2005 20:02:42 +0100

>Are you authorized to place a 911 call with your IP phone when you're in
>the US?

This is the wrong question.

You MUST be able to provide an emergency call in any case, or you will get
sued the first time something happens, as Brian always said:

https://mail.oefeg.at/exchweb/bin/redir.asp?URL=http://news.com.com/Texas%2Bsues%2BVonage%2Bover%2B911%2Bproblem/2100-7352_3-5630118.html?tag=nefd.top

Authorizazion, authentication. identification, etc is only a nice to have

Richard

________________________________

Von: [email-masked] im Auftrag von James M. Polk
Gesendet: Mi 23.03.2005 19:53
An: Tschofenig Hannes; 'Ken Carlberg'; [email-masked]
Betreff: Re: AW: [Ecrit] requirements

At 07:24 PM 3/23/2005 +0100, Tschofenig Hannes wrote:

>maybe we just have a terminology problem here. i think that we need to
>provide authentication in order to provide authorization and accountability.

Are you authorized to place a 911 call with your IP phone when you're in
the US?

How exactly is this going to be accomplished (even in general)? And what
does that have to do with routing the set-up messages to the correct ECC
(which is ECRIT's charter)?

I do not believe these very useful attributes are within ECRIT's current
charter, so they shouldn't be the focus of so many messages on this list.

>ciao
>hannes

cheers,
James

                                *******************
                 Truth is not to be argued... it is to be presented

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 23 Mar 2005 14:20:11 -0500

I'm afraid that we're using the terms authentication, authorization and 
lcoation verification far too loosely. They encompass many different 
questions, such as, for identity:

- Did the IP address (in the UDP-based SIP request) actually place this 
request, and, if not, which one did?

- Did the SIP URI claimed in the From header actually place the call?

- What is the legal name and address of the person using that SIP 
address (so that I can send a cop to that residence to arrest the prank 
caller)?

- Did the domain in the SIP From header authorize the caller to use that 
user name?

Similarly, location verification can mean several things, all useful, 
but increasingly hard:

- Does this address or geo coordinate exist in real life or is a 
probable or possible calling location?

- Who provided this particular location information? (Which does not, by 
the way, imply that the information was provided for this particular 
call. I could have gotten this information from a friend or another 
location that I'm logged in.)

- Did the call originate from that particular geo or civic address and 
who says so and how do they know?

This will all be in more detail in the next iteration of the 
requirements draft. I'm sure there are more such questions and it might 
be more helpful to state, say, authentication or verification 
requirements as such questions.