Musing on SIP and SPAM

[Michael Thomas <[e-mail]>]

Ok, into the fray. I've written a couple of blog posts on the subject 
which go into more detail of what I've been thinking. Basically, after 
much searching through the STIR/SHAKEN stuff I finally figured out that 
sip:[e-mail] was out of scope. And I mean, it took me a *long* time 
figure that out reading problem statements, requirements, etc. What my 
blog post wonders about is whether STIR/SHAKEN is solving the wrong 
problem. That is, it's trying to solve the e.164 spoofing problem via 
tel: uri and sip: uri's with embedded telephone numbers. This is an 
incredibly complex and fraught problem, so i have to ask whether it's 
even worth it? Telephony is pretty much all SIP these days, even to 
mobile phones with SIPoLTE, there's not much point to stick with e.164 
addresses as identifiers if it's SIP end to end or SIP end to almost the 
end with POTS termination. Since STIR/SHAKEN can't do much of anything 
with actual PSTN onramp/offramp based spam, it makes me wonder why we 
are holding onto mostly dead technology's vestiges. The future seems to 
me that a sip:[e-mail] URI would be the future, but the did not 
solve for that. It's not like people *like* e.164 based identity, and 
mostly it's hidden from you on mobile phones anyway. Being one of the 
authors of DKIM (rfc 4871, etc) it has always occurred to me that 
something DKIM-like could work for SIP and actually hacked a version of 
my DKIM code to prove the point on a SIP stack in about 2005.

https://rip-van-webble.blogspot.com/2020/02/sip-what-about-from-header-no-love.html

Now being the dutiful engineer that I am, I decided to have an argument 
with myself and ask whether we both (STIR/SHAKEN and SIP-DKIM) are 
wrong. That is, is telephony as we know it essentially dying. The Covid 
pandemic has really put that into focus with services like Zoom in the 
limelight which as far as I know doesn't use SIP. Maybe none of them 
have an inter-provider problem like the PSTN does. So maybe the right 
solution is to do nothing, or do just the STIR/SHAKEN stuff because 
"Something Must Be Done".

https://rip-van-webble.blogspot.com/2020/04/on-second-thought-sip-security.html

Mike

PS: hi all, long time! missed y'all and hope you're keeping safe :)