Subject: RE: [Sip] REFER security options - removing Referred-By

From: Adam Roach <[email-masked]>
Date: Mon, 22 Apr 2002 17:26:03 -0400

There's a major difference, though.

In the protocol, there is currently a clear way that you can respond
to me, saying "you claim to be George Bush. Prove it." (c.f. 401 and
407 responses).

There is absolutely no way that we've been able to define where you
could equivalently say, "you claim you were referred by Kofi Annan's
secretary. Prove it."

This is a fundimental problem.

The "From" field has a defined way of be challenged, but the "Referred-By"
does not. Any arguments that these are the same problem are misguided.

/a

> -----Original Message-----
> From: Rosen, Brian [mailto:[email-masked]]
> Sent: Monday, April 22, 2002 10:43
> To: 'Michael Thomas'
> Cc: 'Ben Campbell'; [email-masked]; Adam Roach; 'Elwell, John';
> [email-masked]; Robert Sparks; [email-masked]
> Subject: RE: [Sip] REFER security options - removing Referred-By
> 
> 
> Well, since it's okay to put George Bush's name in the FROM header,
> it's got to be okay to put Kofi Anann's admin's name in the 
> Referred-By
> header.  If Mr. Annan accepts the forged FROM, he will accept the
> forged referral.  
> 
> These headers are (presently) un-authenticated.  We don't DO anything
> with them (presently) other than show them in a GUI.  It's useful to
> do that.  I'll accept an authentication mechanism some day, but
> an un-authenticated field is useful.
> 
> Brian
> 
> > -----Original Message-----
> > From: Michael Thomas [mailto:[email-masked]]
> > Sent: Monday, April 22, 2002 11:31 AM
> > To: Rosen, Brian
> > Cc: 'Ben Campbell'; [email-masked]; Adam Roach; 'Elwell, John';
> > [email-masked]; Robert Sparks; [email-masked]
> > Subject: RE: [Sip] REFER security options - removing Referred-By
> > 
> > 
> > Rosen, Brian writes:
> >  > Y'know, sometimes I (personally, not as chair) think we take
> >  > the security argument just a little too far.
> >  > 
> >  > Sure, I can finagle the From, but Referred-By is the header
> >  > I want to use in my GUI.  I'll attach no more credence to it
> >  > then I get from FROM unless it's authenticated, but it's damn
> >  > useful to display to a user.
> > 
> >    So you're saying that it's OK for me to be able
> >    to just put Kofi Anann's admin's name in the
> >    Referred-by header, so that I can get through
> >    his screening so we can chat about my thoughts
> >    on San Francisco annexing Canada?
> > 
> >    Groovy.
> > 
> > 		    Mike
> > 
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> > 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Ben Campbell" <[email-masked]>
Date: Mon, 22 Apr 2002 16:36:35 -0500

Now as I see it, we have a couple of camps--one is a group of people who
believe referred-by without authentication is still useful, and presumably
not _too_ harmful. A second, perhaps smaller but pretty vocal, group says
that referred-by without some authentication mechanism is dangerous.

So, to return to Robert's root question: We obviously have a lot of
discussion left on referred-by. So, can we separate the problem, move
forward the refer draft _without_ referred-by, and continue working on a
referred-by mechansism we can all agree on? I have not seen anyone argue to
scrap referred-by altogether (although that seems to be a common strawman.)

Or in otherwords, is refer so useless without referred-by that we should
block the draft until we can close this discussion?

> From: Adam Roach [mailto:[email-masked]]
> Sent: Monday, April 22, 2002 4:26 PM
> To: 'Rosen, Brian'; 'Michael Thomas'
> Cc: Ben Campbell; [email-masked]; Adam Roach; 'Elwell, John';

---

From: Sean Olson <[email-masked]>
Date: Mon, 22 Apr 2002 14:49:06 -0700 (PDT)

Is it conceivable that a future Referred-By:
mechanism would deviate significantly from
what is currently in the draft? What will be
the impact for those who have implemented the
Referred-By: mechanism already?

/sean

=====
Sean Olson <[email-masked]>

__________________________________________________
Do You Yahoo!?
Yahoo! Games - play chess, backgammon, pool and more
http://games.yahoo.com/

---

From: "Victor Paulsamy" <[email-masked]>
Date: Mon, 22 Apr 2002 15:47:13 -0700

Take an example of full-mesh conferencing. In that, A and B are talking.
Now, C calls B. B decides to confer with C & A, hence sends REFER to, say, C
with "Refer-To:A". To C, "Referred-By:B" is useful because, it signals
"conference" mode.

Regards,

--victor

Victor Paulsamy               E-mail: [email-masked]
Senior Software Engineer      Phone : 650.930.1339 (Direct)
Zapex Technologies, Inc.      Phone : 650.930.1300 (Main)
Mountain View, CA 94043       Fax   : 650.930.1399

---

From: AC Mahendran <[email-masked]>
Date: Mon, 22 Apr 2002 16:14:07 -0700

B  can add C into the conference without REFERing it to A.

Anyway, I support the idea of leaving the specification as is (i.e without 
removing the Referred-By header). However, we should definitely work 
(later) on providing extensions for authentication of the Referred-By UA.

thanks,
-AC

---

From: "Victor Paulsamy" <[email-masked]>
Date: Mon, 22 Apr 2002 16:21:54 -0700

> B  can add C into the conference without REFERing it to A.
True. However, I'm talking about full-mesh conference, where each entity is
maintaining both sip and rtp relations with each other.

--victor

---

From: Robert Sparks <[email-masked]>
Date: 23 Apr 2002 08:20:16 +0200

Referred-By should not be used to make that association.
Look at the discussion of Join in draft-sipping-cc-framework-00.

RjS

---

From: [email-masked]
Date: Tue, 23 Apr 2002 08:46:31 +0200 (MEST)

Ben,

In order to take into account :
-existing implementations,
-situations where authentication is not a problem,
-"real-life" constraints : CPU & Memory consumption and infrastructure needs
-rules applied for other SIP headers/fields (FROM, ...)
-opinions expressed in that thread,
-...

I think it is fair to let Referred-by in the draft and propose _LATER_ an  
OPTIONAL true authentication mechanism.

I hope this view will satisfy every body over there.

Best Regards,

Patrick

---

From: "Dean Willis" <[email-masked]>
Date: Wed, 24 Apr 2002 12:32:27 -0500

Ok, here's how this cascade started, I think.

I asked Robert to extract Referred-By from the REFER draft and publish
it as a separate draft. This does not imply that Referred-By is being
abandoned, just that it will be pursued as a separate effort. 

Why?

Because Referred-by is a 450 message (count 'em) rat-hole, and we need
REFER for other stuff like NOW.

This is an application of the time-honored technique of "divide and
conquer", and it's time to do some conquering.

Thank you!

--
Dean