RE: [Sipping-emergency] Comment about Charter [no privacy?]

hi james, 

every document will have to address both privacy and security
considerations. the geopriv requirements draft gives a number of guidelines
but more work is needed when you apply it to an actual using protocol (such
as sip). the fact that you have pseudonyms is nice but still there are some
places where user names show up. for example, end-to-end security mechanisms
provide the recipient a way to authenticate you (and authorizate you based
on your authenticated identity) but if you want to experience anonymity then
the authorization functionality at the recipient is certainly more
difficult. 

ciao
hannes

  _____  

From: James Winterbottom [mailto:winterb@nortelnetworks.com] 
Sent: Freitag, 29. Oktober 2004 08:32
To: James M. Polk; sipping-emergency@ietf.org
Subject: RE: [Sipping-emergency] Comment about Charter [no privacy?]

Hi James, 

Doesn't "draft-ietf-geopriv-pres-02" suggest that a location
server/generator is able to transmit a location to a location recipient, be
that the target itself, or someone else. I believe that this is also covered
in RFC-3693 GeoPriv Requirements. In order to be able to transmit a
location, one must first be able to determine it!!! For the purposes of
transmitting location pseudonyms are also used, so I am not sure where the
tying to a user name comes in.

What was submitted by me is a set of requirements that the authors believe
need to be satisfied in order to meet the needs of emergency service
providers. There has been no discussion of not using or varying the existing
GeoPriv rulesets.

Cheers 
James 

-----Original Message----- 
From: sipping-emergency-bounces@ietf.org
[mailto:sipping-emergency-bounces@ietf.org
<mailto:sipping-emergency-bounces@ietf.org> ] 
Sent: Friday, 29 October 2004 3:07 PM 
To: sipping-emergency@ietf.org 
Subject: [Sipping-emergency] Comment about Charter [no privacy?] 

All 

In reading the charter for our new ECRIT BOF, I don't see mention of 
privacy concerns wrt the ability to track an endpoint based on some Loc 
Info Server (LIS) always knowing where that endpoint is (if nomadic or 
mobile), or tying a user(name) to a particular endpoint (regardless of what 
type it is). 

I thought privacy was agreed upon to be mentioned as a consideration? 

I know at least Jonathan and I brought it up, and I think I remember Jon 
agreeing to this consideration. 

We do not want to ignore the retention and distribution rules we so 
carefully built into the PIDF-LO 

cheers, 
James 

                                ******************* 
                 Truth is not to be argued... it is to be presented 

_______________________________________________ 
Sipping-emergency mailing list 
Sipping-emergency@ietf.org
https://www1.ietf.org/mailman/listinfo/sipping-emergency
<https://www1.ietf.org/mailman/listinfo/sipping-emergency>  