Subject: Re: [Sip] Open Issue #204: Password in To/From URL

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Thu, 06 Dec 2001 11:50:10 -0500

Jonathan Rosenberg wrote:
> 
> Issue:
> 
> Minor issue.
> 
> The From field allows a password in the URL, but not the To field. This is
> not discussed and seems inconsistent. We should either allow it in both or
> document the reason.
> 
> Discussion:
> 
> I suspect the main application of the password in From is for things like
> PIN codes; it provides a simple, yet thoroughly insecure, way to identify a
> user. Its not clear what a password in To would mean. Perhaps it provides a
> password valid to talk to the specific user in the To field. However, as
> requests can be forwarded, this password would not be valid in many cases,
> and would potentially directly provide password information to the wrong
> user.
> 
> Its probably sensible to restrict usage of the password as much as possible.
> 
> Proposal:
> 
> Keep restriction. Document usage in From as identifying subscriber, and
> indicate that it makes no sense to have in in the To.

I can't quite parse your initial statement: "The From field allows a
password in the URL, but not the To field." Theoretically, passwords
could appear in

- request-uri
- To
- From

Having it in the destination (request-URI) has some modest value, but
adding it to the To header field doesn't seem to add any. Thus, I think
we're in agreement, but just wanted to make sure:

- request-uri = yes(*)
- To = no (since already in the request-uri for the destination)
- From = yes(*)

(*) with the usual caveats

The only reason I can see to allow this in the To header is that
typically, if you click on a web link such as
sip:alice:[email-masked], it would be copied into both request-URI
and To. Since we wanted to treat the user:pw as effectively a single
string, it would seem easier not to special-case this and forcing the
program to strip the 'pw' part.

(We've had this discussion before, but just in case: a password for the
destination can be mildly useful for cases where I want to put my URI on
a secure or internal web page or some other directory. This is about as
secure as an unpublished telephone number, but it has its
spam-prevention uses.)
-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 6 Dec 2001 11:21:28 -0500

Issue:

Minor issue.

Discussion:

Proposal:

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com