Re: [Insipid] Pre-WGLC INSIPID Session-ID Review Comments

["Paul E. Jones" <[e-mail]>]

Christer,


>I would use different wording. Something like:
>
>"The call-id often reveal personal, device, domain or other sensitive 
>information associated
>with an end-user, which is why intermediaries, such as proxies and 
>session border
>controllers alter the call-id. In order to ensure the integrity of the 
>end-to-end
>session identifier, it is constructed in a way which does not reveal 
>such information,
>removing the need for intermediaries to alter it (except as described 
>in this section)."

This is OK, though it removes the "MUST NOT" in the paragraph that I 
think is important.  How about this slight variation?

"The Call-ID often reveal personal, device, domain or other sensitive 
information associated with a user, which is why intermediaries, such as 
proxies and session border controllers, sometimes alter the Call-ID.  In 
order to ensure the integrity of the end-to-end Session Identifier, it 
is constructed in a way which does not reveal such information, removing 
the need for intermediaries to alter it.  As such, intermediaries MUST 
NOT alter the UUID values found in the Session-ID header, except as 
described in this section."

Paul