Re: [stir] Permitted spoofing

Guess this is MITM is the next VoIP issue to come up.

Both way authentication is not considered for VoIP because service providers are trusted by default. ;-)

DANE WG with their DNSsec approach might be a solution for this MITM issues as well?

BTWY:
We had nasty routing issues in pure PSTN as well. There the MITM could pretend being a fixed network operator instead of a mobile operator to "optimize" their business case on termination fees.

Willi

On 11.06.2013, at 18:12, Dave Crocker wrote:

> On 6/11/2013 6:03 AM, Rosen, Brian wrote:
>> MITM is a potential problem, which would be desirable to cut off, but it's not the stated problem we're trying to solve.
>> 
>> There may be some number of service providers in the path that are tolerant of the problem, but not really complicit.
> 
> 
> This could have a pretty substantial effect on design choices.
> 
> For example, session-based SSL authentication -- that is, without server validation (certs) -- permits MITM, which seems to be often/generally acceptable in terms of actual practice, although rhetoric claims otherwise.
> 
> But in general, I've had the impression that any effort at authentication or confidentiality comes with an expectation of resistance to MITM compromises.
> 
> d/
> 
> -- 
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.ietf.org/mailman/listinfo/stir
> 