Subject: Re: Summary of RE: [Sip] Comment, SIP Privacy draft

From: [email-masked]
Date: Tue, 16 Apr 2002 10:50:46 EDT

In a message dated 4/16/02 10:09:55 AM Eastern Daylight Time, [email-masked] 
writes:

> I think the information that is of relevance to this discussion is stuff
> that was *NOT* inserted by the user, but was instead inserted by the
> service provider based on things the user had previously disclosed to
> the service provider. These are the things which in fact do need some
> level of protection, which is why we have this complicated applicability
> statement on the privacy draft and why (I at least) would argue that the
> only reasonable design is one in which any identifying information
> inserted by the service provider be encrypted or otherwise protected
> from disclosure to other parties (including the callee) unless the
> customer explicitly requests it not to be.
> 
> 

I think you have to add to the first sentence above "and information inserted 
by the user that is required by the Service Provider as a prerequisite for 
service". If the service provider requires that the user enter a valid ID, 
then it must be protected the same as an ID that the Service Provider 
inserted.

Mike

---

From: "Dean Willis" <[email-masked]>
Date: Tue, 16 Apr 2002 12:21:10 -0500

In a message dated 4/16/02 10:09:55 AM Eastern Daylight Time,
[email-masked] writes:
---------
__________

I think Dave's generally right, with the one caveat noted by Mark below:

And Mark responded:
------------------
I think you have to add to the first sentence above "and information
inserted by the user that is required by the Service Provider as a
prerequisite for service". If the service provider requires that the
user enter a valid ID, then it must be protected the same as an ID that
the Service Provider inserted.
------------------

I agree mostly with Mark here -- which is why I'm continuing to push
back on an approach that "requires" the From: field to be specific
user-identifying information or suggests that it is more significant
than a "display name" which might optionally be used by some nodes for
some sort of lightweight filtering and displayed at the end point.

From bis:

-----
8.1.1.3 From The From header field indicates the logical identity of the
initiator of the request, possibly the user's address-of-record. Like
the To header field, it contains a URI and optionally a display name. It
is used by SIP elements to determine which processing rules to apply to
a request (for example, automatic call rejection). As such, it is very
important that the From URI not contain IP addresses or the FQDN of the
host on which the UA is running, since these are not logical names. 

The From header field allows for a display name. A UAC SHOULD use the
display name "Anonymous", along with a syntactically correct, but
otherwise meaningless URI (like sip:[email-masked]), if the
identity of the client is to remain hidden. 
-----

Note that the strongest requirements statement about usage here is a
"SHOULD" class statement on anonymity, and guidelines include "possibly
the user's address-of-record" on content in general. The SIP spec does
NOT mandate that the From field: contain any specific information. This
is in some measure intended to prevent the regulatoryistic (I just made
that up) abuse of the field. 

Let us also consider the phrase "very important that the From URI not
contain IP addresses or the FQDN of the host on which the UA is running,
since these are not logical names." This clearly indicates that the From
field is intended to provide a LOGICAL reference, not a DIRECT
reference. "Logical" is a broad term, and implies that the field should
be completed in a manner logically consistent with the role in which the
completor expects to use that field or have that field used by target
nodes.

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 16 Apr 2002 14:38:26 -0400

> I think you have to add to the first sentence above "and information inserted by the user that is required by the
> Service Provider as a prerequisite for service". If the service provider requires that the user enter a valid ID, then it
> must be protected the same as an ID that the Service Provider inserted. 

No reasonable provider should put that requirement on From, for the
reasons Dean mentioned. This leaves the proxy-authentication data.
Interesting question is whether the proxy-authentication data needs to
be stripped after it has been "used", as it may well apply to several
down-stream proxies.