Subject: Re: [Rucus] SPIT Documents: Resubmission Useful?

From: David Schwartz <[email-masked]>
Date: Mon, 9 Mar 2009 12:36:27 +0200

Hi Saverio

I wasn't referring to getting the EG approved (not sure that is  
possible :)) just stating that I liked Hannes's doc.

If I have to seriously think about how to get the EG (or better yet  
WG) off the ground - Perhaps if we focus on where there is pain TODAY  
(vishing?)

This is a link to a whitepaper written for the National Consumer  
League on phishing. Now while this is completely email oriented their  
conclusions (no real news - actually) can guide us as well.

http://www.nclnet.org/news/2006/Final%20NCL%20Phishing%20Report.pdf

pp 49.

"In the case of Phishing, lack of strong mutual authentication and the  
use of shared
secrets may be the primary reasons Bad Guys continue to utilize the  
technique. They can pretend to be your
bank or a trusted entity you do business with and unless you’re an  
expert, it’s very hard for you to tell the site
isn’t real. You type in your secrets (your credentials) and the Bad  
Guys later play them back to the entity and
pretend to be you. Adding a “second factor” like a one time password  
will not help you recognize the site is
spoofed and it can still be replayed by the Bad Guy via a classic man- 
in-the-middle attack.
These issues call for a strategy which makes it easier for users to  
assess whether they are on the correct site
(i.e., stronger mutual authentication) and moves away from using  
shared secrets to authenticate (e.g., username
and password). Using Public Key Cryptography, where the “private key”  
stays private and only the “public
key” is exchanged over the Internet, is one way to take away the prize  
sought by the Phisher. "

Note that the attached appendix is quite illuminating as well.

D.

On Mar 9, 2009, at 11:55 AM, Saverio Niccolini wrote:

> I like Hannes document as well and we took as a reference for
> several improvements here from an implementation perspective
> anyway:
> I still do not see how such a document would help us in getting
> the EG approved... which is what we were aiming at...
>
> Do you have thoughts on this?
> Saverio
>
> ============================================================
> Dr. Saverio Niccolini
> Manager, Real-Time Communications Group
> NEC Laboratories Europe, Network Research Division
> Kurfuerstenanlage 36, D-69115 Heidelberg
> Tel.     +49 (0)6221 4342-118
> Fax:     +49 (0)6221 4342-155
> e-mail:  [email-masked]
> ============================================================
> NEC Europe Limited Registered Office: NEC House, 1 Victoria
> Road, London W3 6BL Registered in England 2832014
>
>
>
>
>> -----Original Message-----
>> From: David Schwartz [mailto:[email-masked]]
>> Sent: 09 March 2009 10:42
>> To: Thomas Froment
>> Cc: Hannes Tschofenig; Dan Wing; Martin Stiemerling; Henning
>> Schulzrinne; Saverio Niccolini; Jonathan Rosenberg; [email-masked] 
>> ;
>> [email-masked]; [email-masked]
>> Subject: Re: SPIT Documents: Resubmission Useful?
>>
>> Hi Hannes and sorry for taking so long to get back to you on this.
>>
>> While I agree in principle with Dans assessment that most of these
>> ideas should just be allowed to perish (for now) I would contend that
>> the one exception is the framework document that you had set out to
>> write.
>>
>> Regardless of the eventual solution it is clear that many players or
>> entities will have to work in concert and your framework doc began to
>> address just that.
>>
>> Just my 2 cents,
>>
>> D.
>>
>>
>>
>> On Mar 9, 2009, at 11:33 AM, Thomas Froment wrote:
>>
>>> Hannes Tschofenig wrote:
>>>> Hi all,
>>>> We have worked on a couple of documents related to tackle spam and
>>>> unwanted
>>>> communication. The topic stalled a bit after the RUCUS BOF.
>>>> I am not sure whether there isn't really a problem with SIP spam at
>>>> the
>>>> moment or whether the interest in this topic has completely
>>>> vanished in the
>>>> IETF.
>>>> Does it makes any sense to resubmit our documents or todo anything
>>>> else?
>>>> Your feedback is appreciated.
>>> Hi Hannes,
>>>
>>> I would be in favor of resubmitting the documents on SPIT policies
>>> because I personnally think this is one
>>> the important piece to fight SPIT without having to address the
>>> endless question of SPIT *detection* (which is probably
>>> out of IETF scope by the way).
>>>
>>> That being said, I don't plan to work on it,  and I won't attend
>>> IETF meetings anymore in a near future, so, not sure
>>> this will help the topic moving forward at IETF...
>>>
>>> Thomas
>>>
>>>
>>>
>>>
>> ______________________________________________________________________
>>> This email has been scanned by the MessageLabs Email Security  
>>> System.
>>> For more information please visit http://www.messagelabs.com/email
>>>
>> ______________________________________________________________________
>
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________