Re: [Sip] draft-state-sip-relay-attack-00

[Theo Zourzouvillys <theo at crazygreek.co.uk>]

On Sat, Mar 7, 2009 at 10:39 PM, Hadriel Kaplan <HKaplan at acmepacket.com> wrote:

> And email has been getting less spam and phishing and viruses ever since.

SIP also has one major advantage than email does: we've not *yet* got
the same penetration that SMTP did when it started really suffering.
Although I do see exactly the same apathy to the problem in voice
service providers and network operators now that I did in ISPs 10
years ago: "not a problem yet, can't afford to spend time on that".

> If the open SIP providers don't employ some counter-measures for spoofing, user authentication, and service control, then they will when the issues crop up.

It's difficult to do *that* much: a lot of the counter-measures need
support from the endpoint vendors for various features.  A look at the
quality (or even existence) of mutual TLS and related things in almost
all UAs speaks loads on their interest in such matters!

> But anyway, that's why I want a SIP Identity mechanism that actually works, fwiw.

i'll give 10 pounds (of the Great British variety) and a bottle of
sheppy's finest Somerset cider to whoever comes up with such a thing.

 ~ Theo