Subject: Re: [Sip] sip-identity-05: display-name woes

From: Paul Kyzivat <[email-masked]>
Date: Tue, 19 Apr 2005 09:21:00 -0400

Brian Rosen wrote:
> Which do you find more useful: Caller name in the PSTN or display name in
> email?

I don't think the two cases are quite analogous. Display names are less 
important with email because the URIs are themselves often more human 
friendly. So, if I get an email with a display name I don't recognize, I 
can look at the URI and sometimes get an idea of who it is.

Even so, if I get a mail from somebody else claimg to be Brian Rosen I 
am quite likely to be confused for awhile.

Otherwise it is hard to compare because the human factors of the devices 
I use for each are so different. I think it will become much more of an 
issue when voicemails with addresses derived from sip headers start 
showing up in my email inbox.

> One is "authenticated", the other is not.
> 
> Let's face it, the PSTN caller name system is fundamentally broken, and it
> doesn't work as well, or as reliably FROM THE POINT OF VIEW OF THE USER, as
> nearly anything else.  Imitating that is a poor choice.  To be sure, much of
> what doesn't work is due to poor implementation and "star syndrome" (I block
> my Caller ID and I don't take calls without CallerId).

The fact that the info is often blocked, or that I often use devices 
that can't present it, isn't a good argument. We should be evaluating 
how it works when it is used.

And I didn't say that we should just copy that system, or do as poorly. 
I only said we should aim to do no worse.

> No one really trusts display name in the PSTN.  Few even understand it.

Well, its probably true that nobody understands it. And nobody trusts it 
to always be there. But I suspect people do trust that if a value is 
displayed then it is vouched for by "the phone company".

> Everyone who uses email knows what to expect of a display name.

No. Everybody that participates in IETF knows what to expect, and a big 
chunk of techies elsewhere do too.

But grandma doesn't. And when grandma switches her phone service to her 
cable company because it is cheaper, she won't know that she should 
change her expectations.

> With session initiation on the Internet, it's not very useful to hide behind
> the trust of the originating carrier, because there are too many of them and
> you have no reasonable way to distinguish a trustworthy one from an
> untrustworthy one.  There may not even be an originating carrier.

That is partly what certificate chains are for. The originating carrier 
needs to get its cert from somebody I trust.

I certainly can't predict exactly how this is going to play out. But it 
may be that part of the value proposition of carriers is that they will 
be able to provide some identity guarantees that you can't so easily get 
otherwise.

But I think people will continue to want to make and receive calls from 
strangers, and will want to know the identity of the caller in some 
useful way.

> In this case, I think we trust users to be polite, and when they aren't,
> you have the option of not taking their calls.  

Well, I would probably take a call from Brian Rosen. And I would do so 
even though I don't know your phone number. But that means I will 
probably take a call from a telemarketer claiming to be Brian Rosen too. 
While I have the option to not take the call, I don't have the data to 
distinguish one from the other.

I realize the situation is similar with email, but the ergonomics are 
different. I can look at the beginning of the message and the subject, 
and quickly realize it is not you. I'm much less bothered by the 
misrepresentation than if I have answered the phone.

My main point is that sip initially adopted the very loose 
identification semantics of email. Now there are attempts to tighten 
those up. I think we should be considering where we would like to get as 
well as where we know how to get. And the expectations of existing phone 
users are one source of requirements about where we want to get.

	Paul

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul
> Kyzivat
> Sent: Monday, April 18, 2005 6:51 PM
> To: Michael Thomas
> Cc: [email-masked]; 'Peterson, Jon'
> Subject: Re: [Sip] sip-identity-05: display-name woes
> 
> I agree.
> 
> One way or another I think we need to have an approach caller id and 
> calling name that works at least as well and reliably as it does in the 
> PSTN, and that does so whether going between two sip endpoints in 
> different domains, or between a sip endpoint and a PSTN gateway. And it 
> needs to do this whether you are using sip native URIs or telephone 
> numbers. For telephone numbers there probably must be consistency with 
> what happens for PSTN-PSTN calls. For sip native addresses there may be 
> some wiggle room about how it should work, but I think people will want 
> the same level of trust with either kind of address.
> 
> 	Paul
> 
> Michael Thomas wrote:
> 
>>On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote:
>>
>>
>>>Brian does have some point in what he's saying. Usually, the number is 
>>>displayed (the sip address in out case) unless the receiver has the 
>>>caller in the address book. In this case the name displayed is the one 
>>>in the local address book. But is it too late to think that way? It 
>>>probably is since a lot of implementations out there already display 
>>>the Display Name in the From header field, but we could recommend 
>>>against it.
>>
>>
>>I think that people are tempting the fates if they
>>think that proscriptions against misuse buried in
>>some arcane RFC will stop developers from putting
>>juicy identity bits in front their users. Even if it's
>>really, really stupid. And insecure. 
>>
>>And SIP is not just about voice rendezvous. Imagine a
>>proscription on an IM user agent against putting a 
>>display name in front of their user. It's not only
>>ludicrous, it would make the protocol useless.
>>
>>		Mike
>>
>>
>>------------------------------------------------------------------------
>>
>>_______________________________________________
>>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>>This list is for NEW development of the core SIP Protocol
>>Use [email-masked] for questions on current sip
>>Use [email-masked] for new developments on the application of sip
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 19 Apr 2005 10:09:51 -0400

> can look at the URI and sometimes get an idea of who it is.
Which of course you could do with a URI on a SIP call

> showing up in my email inbox.
I'm not sure I agree.  The displays for phones are becoming more like the
displays for email.  The human factors are converging.

I think the voicemail example is a good one, and I think you have the same
choices you have with any other email, and authentication isn't going to
help.

> how it works when it is used.
I don't agree.  You are positing that we should provide at least the level
of service the PSTN does.  I'm claiming users don't appreciate the
difference; they think PSTN caller ID is broken, and email display names are
forgeable.

> I only said we should aim to do no worse.
I'm always interested in improving things, but only if real users perceive
the difference.

> displayed then it is vouched for by "the phone company".
Go find some non techie friends and do a small survey.  Let me know what you
find.  I think you will discover that no one believes the name is "vouched
for".  I think they will tell you that it's anything that the subscriber
told the phone company, the phone company does no checking, and doesn't
vouch for it, they just spit it out, rarely, in some pattern not discernable
from a users point of view.

> cable company because it is cheaper, she won't know that she should
Dunno about yours, but my Mom knows what to expect of email. 
Since she sees Caller Name once in a blue moon on her current phone, 
she isn't going to have any expectations if she switches to her cable
vendor's system.

> be able to provide some identity guarantees that you can't so easily get
I'm pretty sure that's what will happen for URIs.  I don't think that can
happen for display names.  The guarantee is NOT that the identity is any
good; it's that the identity was used to place the call.  You aren't
identifying the caller, you are providing traceability.  
> strangers, and will want to know the identity of the caller in some
Agree.  They want to.  The question is, is there a way to place any amount
of trust in the identity as an identity?

> distinguish one from the other.
And I don't think you ever will.  If the telemarketer tells the phone
company that his name is Brian Rosen, the carrier will believe him, and will
do no checking at all.  The only advantage you have is the time delay to
change the name.  If that is some advantage, maybe we could work on that,
but it's not anything to do with identity, it's a brake on the rate of
change.

> misrepresentation than if I have answered the phone.
True.  If we CAN make things better, we should.  I just don't see any
reasonable way to do that yet.

> users are one source of requirements about where we want to get.
Careful.  The email folks are just as interested in identity as we are these
days.  We should not invent a separate solution.  Of course we shouldn't
copy a known-to-be-broken scheme either.

Brian

---

From: Michael Thomas <[email-masked]>
Date: Tue, 19 Apr 2005 10:59:23 -0700

> Which do you find more useful: Caller name in the PSTN or display name in

This a false dilemma: both are "useful", or at least
ought to be "useful".

> One is "authenticated", the other is not.

Uh, I'll bite: which one is authenticated?

> my Caller ID and I don't take calls without CallerId).

_You_ might not, but the world is full of people who
do, including some major users of call centers who
should have known better.

Nature abhors a vacuum. If there is nothing better, the
crappy identities _will_ be used. And that's bad for SIP
just like it's bad for email.

> Everyone who uses email knows what to expect of a display name.

I'm sorry, but I beg to differ. Phishers are *right* *now*
exploiting people's gullibility and lack of understanding
about this area.

> untrustworthy one.  There may not even be an originating carrier.

I don't understand what you mean by "too many of them". If
I get a call from [email-masked], I'd like to have some reasonable
assurance - key word being reasonable -- that I will be talking
to [email-masked] and not [email-masked] if I pick up
the phone.

> you have the option of not taking their calls.  

The world has vastly changed, and expectations of politeness
are gone with the wind.

		Mike
> es have some point in what he's saying. Usually, the number is