Subject: Re: [Sip] Removal proposal: Password in SIP-URL

From: Christer Holmberg <[email-masked]>
Date: Thu, 01 Nov 2001 08:48:23 +0200

Hi,

>If you are bothering with real security, then use a real authentication
>mechanism. The password in the URI is a mega-cheap, mega-unsecure mechanism.

I couldn't agree more :)

>In any case, as Henning has pointed out, it is in use and therefore can't
>really be deprecated.

So, if the UAS doesn't - for whatever reason - doesn't accept it, what
response code should it use to indicate that? 

Regards,

Christer Holmberg
Ericsson Finland

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 20 Nov 2001 03:36:47 -0500

> -----Original Message-----
> From: Christer Holmberg [mailto:[email-masked]]
> Sent: Thursday, November 01, 2001 1:48 AM
> To: Jonathan Rosenberg
> Cc: Henning Schulzrinne; [email-masked]
> Subject: Re: [Sip] Removal proposal: Password in SIP-URL
> 
> 
> 
> Hi,
> 

If the UAS gets a request with a request URI identifying a resource it
doesn't or won't serve (the password in the r-uri effectively becomes part
of the naming of the resource), a 404 is sent.

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com