Subject: RE: Private Info in To/From (was RE: FW: [Sip] Comment, SIP Priva cy draft)

From: "Mark Watson"<[email-masked]>
Date: Thu, 11 Apr 2002 16:23:33 +0100

> For the privacy aspect I believe that it can be provided at least for
> anonymity in the To or From, by a standard proxy, but as Johnathan
> stated a B2BUA would be required to provide the topology (IP address)
> hiding at all other levels, and then it would also be required to
> provide the same actions for media. As for the example of content, 

If you want to be compatible with RFC2543 clients, then if you muck with
From/To, you need to change them back in responses. This is not something
which a proxy, as defined in the RFC, would do. That's not to say you
couldn't build a device which looked remarkably *like* a proxy in all
respects apart from this. You might even call it a proxy, but in pedantic
specification terms that would not be correct.

> I believe that, since we have been discussing this in terms of privacy
> as it relates to an SP environment, the responsibility lies 
> with the SP.
> A UA not within an SP realm can assert that they are anyone 
> they want to
> be including anonymous, right? In an authenticated SP environment the
> option for a UA to muck with identity would not be permitted 
> becuase it
> wouldnt authenticate correctly/at all, would it?
> 

As I understand it, From is not used for authentication. A proxy which
authenticates someone uses different fields and is not required then to
check that the From field is 'correct' for the authenticated user. Of course
you *could* do that and it just might be a feature that a Service Provider
would want.

Nevertheless, I would argue that in practice the SP still has some
responsibility for this field, on the grounds that a 'subscriber privacy
service' which did not modify this field would not be regarded as actually
working by the subscriber.

...Mark

---

From: Chris Martin <[email-masked]>
Date: Thu, 11 Apr 2002 14:12:54 -0500

Inline

> Mark Watson wrote:
> If you want to be compatible with RFC2543 clients, then if you muck
> with From/To, you need to change them back in responses. 

Right and this course would be required between client and proxy if this
function were implemented. I agree with you just trying to see if there
were a simple way to do this task.  

> This is not
> something which a proxy, as defined in the RFC, would do. That's not
> to say you couldn't build a device which looked remarkably *like* a
> proxy in all respects apart from this. You might even call it a proxy,
> but in pedantic specification terms that would not be correct.

This is true, maybe a B2BUA could have the anonamizer feature and work
within the policy of the SP realm, since a B2BUA may already performing
additional functions similiar to this. Of course then the proxy will
need to forward outbound requests through the B2BUA. 

> authenticates someone uses different fields and is not required then
> to check that the From field is 'correct' for the authenticated user.
> Of course you *could* do that and it just might be a feature that a
> Service Provider would want.

Ya, I just remembered its in the proxy-auth/auth headers that the
username/pw comes in to play for authentication...

> responsibility for this field, on the grounds that a 'subscriber
> privacy service' which did not modify this field would not be regarded
> as actually working by the subscriber.

Agree.

> ...Mark

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip