> On Nov 3, 2017, at 8:10 PM, S Moonesamy <sm+ietf@xxxxxxxxxxxx> wrote: > > Hi Roozbeh, Ben, > At 01:35 PM 03-11-2017, R Atarius wrote: >> Just agreeing with Ben. RFC 5626 highlights that the UA could omit the instance ID for private or anonymous calls. So this is the problem with instance ID and not UUID, MEID, IMEI which have been employed to create the instance ID. > > RFC 5626 was published in 2009. RFC 7258 was published in 2014. Are the Security Considerations the same as in 2009? > The draft says the UAC MUST NOT include a sip.instance tag with the MEID in a request intended to be anonymous, and that the service provider MUST NOT forward it towards the UAS. That seems as relevant today as in 2009 or 2014. It may well be that the guidance in 5626 is not sufficient to guarantee anonymity, but I don’t see how that would change the guidance in this draft. Is there something in particular you would like to see? > The Document Shepherd write-up mentioned "his affiliation". There isn't any information about affiliation in the write-up or in draft-atarius-dispatch-meid-urn-as-instanceid-05. I’m guessing that is because the affiliation change since the shepherd did the writeup. Is there a specific concern there? The writeup does say that the author stated that he was not aware of any IPR, which is our usual standard. Thanks, Ben.
Attachment:
signature.asc
Description: Message signed with OpenPGP