Re: [Insipid] WG Review: INtermediary-safe SIP session ID (insipid)

[Gonzalo Camarillo <[e-mail]>]

Hi,

yes, as I mentioned in a different email earlier today, the dates of the
existing milestones will be updated by the chairs as soon as the new
charter is approved.

With respect to explicitly mentioning "two" documents in the charter, I
did not like that particular wording either because it is confusing.
However, some people felt strongly about mentioning the number of main
documents the WG is working on for some reason. As you pointed out,
while the group will *focus* on designing the two mechanisms, they will
also produce the requirements documents. However, the requirements are
not considered to be the focus of the WG. If somebody proposes better
and clearer text, I will be happy to edit the charter proposal accordingly.

Regarding privacy, the WG will of course consider privacy whenever it is
relevant. The charter just identifies certain areas explicitly because
it is very clear that they will have privacy implications. Again, if
somebody wants to provide text that is clearer, that would be great.

Thanks,

Gonzalo


On 29/09/2013 5:14 PM, SM wrote:
> Hi Gonzalo,
> 
> Thanks for bringing this up.
> 
> At 06:18 29-09-2013, Gonzalo Camarillo wrote:
>> note that as a result of this rechartering, the milestones will be the
>> following:
>>
>> Dec 2012 Requirements and use cases for new identifier sent to IESG
>> (as informational)
>>
>> Feb 2013 Specification of the new identifier sent to the IESG (PS)
> 
> The above milestones are in the past.  I suggest updating the dates if
> the work items are still due or removing them is they have already been
> delivered.
> 
>> On 27/09/2013 7:08 PM, The IESG wrote:
>> > This group will focus on two documents:
> 
> The proposed charter discusses about two documents whereas there are
> four milestones.
> 
>> > The first document will specify a SIP identifier that has the same aim
>> > as the From-tag, To-tag and Call-ID conjunction, but is less likely to
>> > be mangled by intermediaries.  In doing this work, the group will pay
>> > attention to the privacy implications of a "session ID", for example
>> > considering the possibility to make it intractable for nodes to
>> > correlate "session IDs" generated by the same user for different
>> > sessions.
> 
> It is not clear whether the working group would have to pay attention to
> privacy implications for the last two work items.  Does the privacy
> implications cover the work items, wherever it is relevant, or examples
> of "session ID" only?
> 
> Is the privacy implications only about correlation?  I am asking the
> question as correlation is only one of the privacy-specific threats
> identified by the IAB?
> 
> Regards,
> -sm