Subject: Re: Summary of RE: [Sip] Comment, SIP Privacy draft

From: [email-masked]
Date: Wed, 17 Apr 2002 19:21:19 EDT

In a message dated 4/16/02 2:39:47 PM Eastern Daylight Time, 
[email-masked] writes:

> > [Oran] I think the information that is of relevance to this discussion is 
> stuff 
> >   that was *NOT* inserted by the user, but was instead inserted by the 
> >   service provider based on things the user had previously disclosed to 
> >   the service provider. These are the things which in fact do need some 
> >   level of protection, which is why we have this complicated 
> applicability 
> >   statement on the privacy draft and why (I at least) would argue that 
> the 
> >   only reasonable design is one in which any identifying information 
> >   inserted by the service provider be encrypted or otherwise protected 
> >   from disclosure to other parties (including the callee) unless the 
> >   customer explicitly requests it not to be. 
> > 
> > 
> > 
> > [Mike Pierce] I think you have to add to the first sentence above "and 
> information inserted by the user that is required by the
> > Service Provider as a prerequisite for service". If the service provider 
> requires that the user enter a valid ID, then it
> > must be protected the same as an ID that the Service Provider inserted. 
> 
> [HGS] No reasonable provider should put that requirement on From, for the
> reasons Dean mentioned. This leaves the proxy-authentication data.
> Interesting question is whether the proxy-authentication data needs to
> be stripped after it has been "used", as it may well apply to several
> down-stream proxies.
> 

I think this shows how far we are from any agreement on anything. In his 
e-mail of Apr 15, Dean "mostly" agreed with my statement (although crediting 
it to Mark).

While my statement was "If the service provider requires..." and I believe 
there have been a number of comments that certain service providers must 
require this to support mandated tracing, etc., your comment argues that "No 
reasonable provider should put that requirement on From..."

The issue again is what type of "service provider" is being talked about. It 
is clear that some may require this (a valid ID in From) and some may not. So 
my statement is true. If it's not the "From" field that must be provided, it 
is whatever field the discussion ends up with that provides the functionality 
that many presumed was the purpose of "From".

Mike

---

From: "Dean Willis" <[email-masked]>
Date: Wed, 17 Apr 2002 18:49:28 -0500

M said:
---------
I think this shows how far we are from any agreement on anything. In his e-mail of Apr 15, Dean "mostly" agreed with my statement (although crediting it to Mark). 
--------

whoops, sorry -- I guess I'll stick to initials. Detangling mhtml postings is hard.

M said also:
--------
While my statement was "If the service provider requires..." and I believe there have been a number of comments that certain service providers must require this to support mandated tracing, etc., your comment argues that "No reasonable provider should put that requirement on From..." 

The issue again is what type of "service provider" is being talked about. It is clear that some may require this (a valid ID in From) and some may not. So my statement is true. If it's not the "From" field that must be provided, it is whatever field the discussion ends up with that provides the functionality that many presumed was the purpose of "From". 
---------

And speaking of discussion, it looks like Jon Peterson just published a new draft on this very topic.

--
Dean

---

From: [email-masked]
Date: Thu, 18 Apr 2002 08:33:49 +0300

[email-masked] writes:

 > The issue again is what type of "service provider" is being talked
 > about. It is clear that some may require this (a valid ID in From)
 > and some may not. 

to me this is the same thing as verifying the customer's source ip
address.  we as a service provider DO check that the source ip address
of packets that we receive from our subscribers really belong to them.
if all service providers would do such checking, dod attacks would be
must more easier to trace down.

-- juha

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip