Subject: RE: [Sip] Removal proposal: Password in SIP-URL

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 31 Oct 2001 23:16:29 -0500

> -----Original Message-----
> From: Christer Holmberg [mailto:[email-masked]]
> Sent: Wednesday, October 31, 2001 12:52 PM
> To: Henning Schulzrinne
> Cc: [email-masked]
> Subject: Re: [Sip] Removal proposal: Password in SIP-URL
> 
> 
> 
> Hi,
> 
> >If my recollection is correct, this suggestion has been discussed
> >before, at least once, and been rejected. Apparently, people do
> >implement it; the cost is essentially zero. (A header 
> wouldn't add any
> >security benefit, but would make including the password, 
> e.g., for a SIP
> >URL on a secure, private web page for friends, much more painful and
> >prone to errors.)
> 
> Fair enough. However, if encryption is used, would be easier 
> to encrypt
> a single header, because it could be encrypted together with 
> the rest of
> the end-to-end headers (unless some proxy needs that password, of
> course).

If you are bothering with real security, then use a real authentication
mechanism. The password in the URI is a mega-cheap, mega-unsecure mechanism.
In any case, as Henning has pointed out, it is in use and therefore can't
really be deprecated.

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip