Subject: [Sip] Removal proposal: Password in SIP-URL

From: Christer Holmberg <[email-masked]>
Date: Wed, 31 Oct 2001 07:46:16 +0200

Hi,

The bis recommends that the password of the SIP-URL user part is not to
be used.

My question is: in this case, can't we remove it completely? OR, is
there anyone who really uses it?

In future, if someone wants to send passwords in SIP messages, a
specific header (and maybe also even an option-tag) could be used for
that.

Comments?

Regards,

Christer Holmberg
Ericsson Finland

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 31 Oct 2001 08:17:01 -0500

If my recollection is correct, this suggestion has been discussed
before, at least once, and been rejected. Apparently, people do
implement it; the cost is essentially zero. (A header wouldn't add any
security benefit, but would make including the password, e.g., for a SIP
URL on a secure, private web page for friends, much more painful and
prone to errors.)

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 31 Oct 2001 19:52:19 +0200

Hi,

>URL on a secure, private web page for friends, much more painful and

Fair enough. However, if encryption is used, would be easier to encrypt
a single header, because it could be encrypted together with the rest of
the end-to-end headers (unless some proxy needs that password, of
course).

Then, if the password is not accpeted (it may have expired, it is not
correct, or something similar...), what response code should the UAS
send. 401? 403?

Regards,

Christer Holmberg
Ericsson Finland