Subject: RE: [Sipping] Network Asserted Identity: short term requirements

From: "Mark Watson"<[email-masked]>
Date: Wed, 1 May 2002 18:43:07 +0100

Juha writes:
> 
> in that case the network MUST assert the sip uri the user gives, not
> pick one on its own.  if you ignore this basic requirement, 
> your i-d is
> good for nothing.

Well, I'm sorry. Perhaps I should just go outside and shoot myself.

A feature which asserts whatever random uri the user gives is called the
From: field. We are talking about something different. The network should
assert a genuine identity for the user, determined from some reliable
authentication mechanism. If the user has several such identities, then I
agree the user should be able to choose which they want, but this is out of
scope of this draft.

...Mark

---

From: "Zmolek, Andrew (Andrew)" <[email-masked]>
Date: Wed, 1 May 2002 12:06:12 -0600

Juha-

While I do understand your viewpoint, I believe we disagree on the mechanisms and motivations for having separable NAI. You are understandably concerned about what the end-user experience might be and you raise some important considerations for such. That does not diminish the needs of policy domains to attach and authenticate NAI for their own legitimate purposes and it has already been made clear that mixing UAI and NAI mechanisms in the same header is unworkable without forcing a choice between one or the other. Why continue to act is if these are not legitimate requirements?

--Andy

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, May 01, 2002 11:50 AM
> To: Zmolek, Andrew (Andrew)
> Cc: Mark Watson; [email-masked]
> Subject: RE: [Sipping] Network Asserted Identity: short term
> requirements
> 
> 
> Zmolek, Andrew (Andrew) writes:
> 
>  > Could we agree that it is important to balance the rights of
>  > individual policy domain against the rights of individual 
> users that
>  > interact with one or more such policy domains? I think 
> your point is
>  > well taken regarding the right of an individual to assert 
> his or her
>  > identity, but there are also certain obligations (some of them
>  > legally binding) that fall on policy domains for both 
> enterprises and
>  > carriers that of necessity must limit abuse of service and fraud.
>  > 
>  > This is a balancing act of rights and responsibilities and it is
>  > important that no single right trumps all others in all cases or we
>  > won't have a useful or implementable protocol.
> 
> andy,
> 
> you don't seem to understand what i'm saying.  the sip phone 
> on my desk
> has two phone numbers that are legally mine.  when i make a call, i
> press line 1 or line 2 button depending on which number i want to
> calling party to see the call coming from.  in both cases, i use the
> same username and password to identify myself (via digest
> authentication) to the network.  it would make no sense for 
> the network
> to pick one of those numbers as my NAI.  this has nothing to do with
> "obligations" or "abuse".
> 
> -- juha
> 
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP