Subject: [Sip] History-Info Privacy Issue

From: "Mary Barnes" <[email-masked]>
Date: Fri, 16 Apr 2004 11:05:31 -0500

Per my posting on the status of History-Info, Privacy is one of the
remaining open issues.  The proposal currently in the draft is quite simple:

If the Privacy header has a priv-value of "Session" or "Header" privacy, the
History-Info  SHOULD not be included in the Request (or subsequent
responses).  

This is effectively applying the fundamental recommendation in RFC3323 that
any optional information that can divulge information about the user(s)
should not be included in the requests.  

A proposal was made that there are scenarios (e.g. where local policy limits
the applicability of History-Info within a specific domain) where you would
want to capture the History-Info but not send it beyond certain
intermediaries or domains.  To support this, it was proposed that we could
extend the Privacy header defined in RFC 3323 with tags for History-Info
something like the following:

priv-value = "history" / "history-index"  

The "history" priv-value would mean that all the History-Info entries should
be removed.  The "history-index" would be used to indicate that the specific
entry is to be removed and would need to have the Privacy header escaped in
the URI so that it can be associated with a specific History-Info entry (or
we need to add another field to History-Info for this).    

So, I think we have two options here:
1) Extend History-Info to have an optional privacy field along the lines of
what's detailed above.  

2) Defer the definition of the privacy field to a separate draft, since it
appears to be primarily limited to scenarios with certain trust models.  

So, if folks could just take a bit of time and consider their preference, I
would like to get the draft updated soon and closed off prior to the Interim
meeting.

Regards, 
Mary H. Barnes
[email-masked]

---

From: David Oran <[email-masked]>
Date: Mon, 19 Apr 2004 15:41:04 -0400

Either resolution is fine with me. dave.

--On Friday, April 16, 2004 11:05 AM -0500 Mary Barnes 
<[email-masked]> wrote:

> If the Privacy header has a priv-value of "Session" or "Header" privacy,
> the History-Info  SHOULD not be included in the Request (or subsequent
> responses).
>
> This is effectively applying the fundamental recommendation in RFC3323
> that any optional information that can divulge information about the
> user(s) should not be included in the requests.
>
> A proposal was made that there are scenarios (e.g. where local policy
> limits the applicability of History-Info within a specific domain) where
> you would want to capture the History-Info but not send it beyond certain
> intermediaries or domains.  To support this, it was proposed that we
> could extend the Privacy header defined in RFC 3323 with tags for
> History-Info something like the following:
>
> The "history" priv-value would mean that all the History-Info entries
> should be removed.  The "history-index" would be used to indicate that
> the specific entry is to be removed and would need to have the Privacy
> header escaped in the URI so that it can be associated with a specific
> History-Info entry (or we need to add another field to History-Info for
> this).
>
> 1) Extend History-Info to have an optional privacy field along the lines
> of what's detailed above.
>
> 2) Defer the definition of the privacy field to a separate draft, since
> it appears to be primarily limited to scenarios with certain trust
> models.
>
> So, if folks could just take a bit of time and consider their preference,
> I would like to get the draft updated soon and closed off prior to the
> Interim meeting.
>
> Regards,
> Mary H. Barnes

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 21 Apr 2004 15:03:38 -0700

I don¹t care a huge amount but I think I slightly favor 2.

On 4/16/04 9:05 AM, "Mary Barnes" <[email-masked]> wrote:

> Per my posting on the status of History-Info, Privacy is one of the remaining
> open issues.  The proposal currently in the draft is quite simple:
> 
> History-Info  SHOULD not be included in the Request (or subsequent responses).
> 
> any optional information that can divulge information about the user(s) should
> not be included in the requests.
> 
> want to capture the History-Info but not send it beyond certain intermediaries
> or domains.  To support this, it was proposed that we could extend the Privacy
> header defined in RFC 3323 with tags for History-Info something like the
> following:
> 
> the URI so that it can be associated with a specific History-Info entry (or we
> need to add another field to History-Info for this).
>