Subject: [Sip] sacham-sip-media-privacy

From: "Cullen Jennings" <[email-masked]>
Date: Fri, 29 Jul 2005 12:29:06 -0400

Few comments about this draft...

I would change the feature tag from the name "privacy" to "viewers" (it
could still have the values of user, organization, public). Privacy refers
to another header in SIP that does not have much relation to what you are
doing here and this will confuse the issue greatly and cause this to get far
more security review than you wish it to get.

In section 6, you argue that recording is somehow different than say coping
the media onto a speaker - I don't really buy this - a caller might want a
call recorded or not. The recording is associated with an endpoint. I don't
buy some of the logic in here.

I'm not sure I understand how the SDP is going to work without multiple
rounds like preconditions work. Say and invite has an offer with nothing in
SDP. Then answer wants to request that the required viewer is user. How do
you do that? I think you can work this out but a bunch more is needed. Have
a look at the preconditions stuff.

I think you should address the problems with people just ignoring all this.
Say I had a phone that allowed me to set the "I am alone" flag so that even
when I was on speakerphone mode it would allow "user" level calls. I suspect
I would just set it to that and leave it there.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 30 Jul 2005 06:08:22 -0400

Cullen,

thanks for the helpful comments. Some responses inline.

> more security review than you wish it to get.

Good suggestion, although 'viewer' does imply something about video.

> buy some of the logic in here.

We were motivated by the legal distinction between real-time listening 
and recording. I believe many jurisdictions restrict recording in 
various ways (e.g., requiring mutual consent or mandating "beep" or 
"this call may be recorded for quality assurance" indications), while 
speaker phones are not subject to such restrictions. I think this makes 
some sense - a permanent record has different privacy implications than 
human overhearing.

> a look at the preconditions stuff.

This definitely needs more work; we discussed preconditions internally, 
but didn't quite get this done in time.

> I would just set it to that and leave it there.

This indeed relies on cooperation of end users, similar to other 
indications such as the GEOPRIV handling indications. It makes it easy 
to do the right thing and, somewhat more strongly, may encourage 
compliance since it creates an electronic record of my wishes, rather 
than a "he said - she said" situation.

More grist for the security considerations section...

Henning