Subject: RE: [Sipping] Screened From: and Privacy

From: "Christian Huitema" <[email-masked]>
Date: Wed, 17 Apr 2002 12:25:05 -0700

> Can we assume that Mark is correct about SUBSCRIBER (he who pays) as
> opposed to USER rights?   I don't like it, but I conclude we
> are stuck with it.

Well, let's put it this way: the only think that a network service can
possibly disclose is the identity of the subscriber. I do not agree
however that the From field should necessarily contain the name of the
subscriber.

> Can we assume a Network Asserted Identity is a requirement?  I
actually
> don't agree with all of Mark's proposed requirements yet, but I think
> we HAVE to have it.

No, I do not agree.

> Can we possibly agree that an anonymizing B2BUA, provided by a service
> provider, would be the only way to achieve real privacy?  I don't
think
> any
> of the short cuts like messing with this header or that header will
do.

I believe that "B2BUA provided by a service provider" do not actually
provide any more privacy than any service in which the provider agrees
to let you place random values in the "from" field. In practice, privacy
and third parties don't mix. I also believe that it is in practice
impossible to provide a useful anonymizing service in the network.

> If we had a reasonable network asserted identity, I think that is
> sufficient to avoid the kinds of problems Christian pointed out
> with anonymizers.  It's not truly anonymous - the SP knows who
> called.

I think trusting a network asserted identity would be a big mistake --
much like trusting a source IP address. Real end-to-end assessment of
the third party's identity can only result from end-to-end
authentication, as in S-MIME. Trying to push the trust in the network
requires a chain of trust between all relays, which is bound to fail in
a system the size of the Internet.

-- Christian Huitema

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Dean Willis" <[email-masked]>
Date: Wed, 17 Apr 2002 15:00:52 -0500

> however that the From field should necessarily contain the name of the

No argument here.

> > don't agree with all of Mark's proposed requirements yet, but I
think

I think it is a requirement only for PSTN interworking where a "name"
has to be mapped to a PSTN phone number for caller-ID purposes.

> impossible to provide a useful anonymizing service in the network.

Well, they do have the advantage of being able to suppress Via and Route
information that would tend to give away your location, and of being
able to provide a media-intermediary that prevents traceroutes back
along the RTP path from giving up much useful information.

Actually, I use useful anonymizing services every day. Can you tell if
this email is being sent from a PC at my house or from my office? I hope
not, because as far as I know I'm ssh tunnelling to my mail relay, which
is then sending the mail onward. So the SMTP relay is anonymizing my
physical location, insofar as it might be readily determined from the
actual IP address I'm using at the moment.

> a system the size of the Internet.

If absolute truth is an absolute lie, then perhaps absolute trust is an
absolute betrayal.

Does the network-asserted identity work well enough to do caller ID
interworking? What is calling-party-ID except for network-asserted
identity, anyhow?

Do you trust your browser to know that the web server you're banking
with is actually your bank's server, and not somebody else? Probably --
but in doing so you trusted Microsoft (really?) to give you good root CA
certs. You then trusted the CA to validate the cert of the bank.
Reasonably solid crypto. It's not impossible to do something similar for
SIP identity assertion. How much do we really need?

--
Dean