Re: [Sip] Enrollment in SIP services (and should we undeprecatebasic auth)

[Michael Thomas <mat@cisco.com>]

Robert Sparks writes:
 > I see no value at all to resurrecting BASIC.
 > 
 > If you are wanting to provide a shared secret and punt all of the
 > security responsibilities to the transport layer, then express that
 > secret in its native form (plaintext for a password). Anything else
 > you do wastes cycles and encourages people to make bad assumptions
 > about the level of protection they are getting (increasing the risk
 > that it would get foolishly used outside the environment you intended
 > to punt to).

Er, that's what basic does. The reason that the
password is in uuencode format is, I'd assume, to
provide the ability to ship binary passwords, not
security through obscurity.

		 Mike
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip