Subject: Re: [apps-review] Q on applicability of http://www.ietf.org/id/draft-montemurro-gsma-imei-urn-05.txt

From: S Moonesamy <[email-masked]>
Date: Fri, 01 Oct 2010 23:08:47 -0700

Hello,

At 08:35 29-09-10, Scott Brim wrote:
>If there is an assumption that we are going to start passing around
>IMEIs as general identifiers, then I'm concerned that you are
>engineering a world in which one must reveal permanent identifiers in
>order to communicate.

Yes.

The comments that follows should not be construed as a review of 
draft-montemurro-gsma-imei-urn.

In Section 3.1:

  Registration date:  2006-10-11

Was this namespace registered in 2006?

In Section 8:

   "Revealing the specific software version of the terminal might make
    the terminal more vulnerable to attacks against software that is
    known to contain security holes."

The authors of the draft mentioned that the line is taken from RFC 
3261.  The draft says that:

   "It is therefore RECOMMENDED that the IMEISV is not delivered to
    devices that are not trusted."

The recommendation is different from that of RFC 3261 where the field 
is a configurable option.

Please follow up on apps-discuss if you would like to have wider 
readership from the Applications Area ( 
https://www.ietf.org/mailman/listinfo/apps-discuss ).

Regards,
S. Moonesamy