Subject: RE: [Sip] REFER security options - removing Referred-By

From: "Zmolek, Andrew (Andrew)" <[email-masked]>
Date: Mon, 22 Apr 2002 10:55:34 -0600

Michael Thomas wrote:

>    So you're saying that it's OK for me to be able
>    to just put Kofi Anann's admin's name in the
>    Referred-by header, so that I can get through
>    his screening so we can chat about my thoughts
>    on San Francisco annexing Canada?

As long as you believe it's OK for email, it's OK for SIP. How's that for some moral relativity?

In fact, it's possible to claim another persons identity without even using an IETF protocol. It's a real shame there isn't a secure protocol to eliminate social engineering. 

I think it's clear that a secure Referred-By should happen. I'm not going to suggest that we should be satisfied with unauthenticated Referred-by information.

But let's not throw the baby out with the bathwater, guys.

--Andy Zmolek 
    Technology & Standards Engineer 
      CTO Standards 
        Avaya Inc. 

            [email-masked] 
              +1 720 444 4001 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Ben Campbell" <[email-masked]>
Date: Mon, 22 Apr 2002 12:26:48 -0500

> -----Original Message-----
> From: Zmolek, Andrew (Andrew) [mailto:[email-masked]]
> Sent: Monday, April 22, 2002 11:56 AM
> To: Michael Thomas; Rosen, Brian
> Cc: Ben Campbell; [email-masked]; Adam Roach; Elwell, John;
> [email-masked]; Robert Sparks; [email-masked]
> Subject: RE: [Sip] REFER security options - removing Referred-By
>
>
> Michael Thomas wrote:
>

No. It's not. Email does not demand my immediate attention. (OK, so it does,
but I'm an email addict, and assume that not _everyone_ on this list shares
my affliction.) Email allows me to compose my thoughts, read carefully, and
respond at my leisure. The phone on the other hand rips my brain from one
context to another. It demands me to immediately shift gears to the callers
subject. I respond with a well reasoned and eloquent "huh?" as I'm trying to
remember the subject the caller wants to talk to me about. Usually this
memory recall happens some minutes after we hang up, leaving me wondering
how stupid I really did sound to the caller.

OK, I exaggerate--but the point is, interruptive, synchronous, intrusive
communication should be held to a higher authentication and authorization
standard than asynchronous communication that I can respond to when I get
good and ready.

>
> In fact, it's possible to claim another persons identity without
> even using an IETF protocol. It's a real shame there isn't a
> secure protocol to eliminate social engineering.

Heh. There are technologies that _could_ be used for this, if anyone wanted
to go to the trouble. The fact that social engineering works so well is a
testament to what end users will do with unauthenticated identity info if
you let them.

>
> I think it's clear that a secure Referred-By should happen. I'm
> not going to suggest that we should be satisfied with
> unauthenticated Referred-by information.
>

No one suggested that. They only suggested not delivering the baby
prematurely, and not making the rest of refer depend on its presence.