Subject: Re: [Enum] E.164 communication assumptions/requirements

From: "Stastny Richard" <[email-masked]>
Date: Tue, 19 Jul 2005 10:54:46 -0400

I am not quite sure where this discussion is leading to?
 
We are discussing here carrier ENUM.
 
Valdiation in User ENUM has been discussed and solved
years ago, there are commercial implementations out.

-richard

________________________________

Von: enum-bounces at ietf.org im Auftrag von Thomas Jauch
Gesendet: Di 19.07.2005 11:39
An: Ray Anderson
Cc: enum at ietf.org; tim at bango.com
Betreff: Re: [Enum] E.164 communication assumptions/requirements

On 7/19/05, Ray Anderson <ray at bango.net> wrote:
> At 22:06 18/07/2005, Thomas Jauch wrote:
> >Ray,
> >
> >Are you speaking about Public ENUM or Carrier ENUM? Don't forget the
> >User Opt-In requirenment in Public ENUM! And how would you "verifying
> >who "owns" an E.164 number" without a WHOIS database in place? WHOIS
> >would be even a bigger nightmare, from a privacy point of view, than
> >publishing name based URIs in connection with a phone number...
> >
> >Regards,
> >
> >Tom
>
> Our requirement is to be able to determine who "has control" of a "phone
> number".
> We plan to use ENUM to help us determine this by asking the user who claims
> to own
> a phone number to do something with ENUM that means that somebody who controls
> that bit of the E.164 numberspace has given them control over that number.
>
> So, if I claim to own +441223472778 I might be asked to change the email
> address in the
> ENUM record to banana at bango.com   If I can do that, it is assumed I am "all
> powerful"
> with respect to that number.  The whole ENUM project should be causing
> E.164 owners
> to put into place varying levels of verification systems that we can
> piggyback on top of.
>

If I understand you correctly you would like to use such a method as
described during a sign-up process, to make sure that the person who
signs-up is the owner of the number?

So you assume that every of your future customers would have choosen
already an ENUM registrar, proven his identity, published at least an
some sort of data into ENUM, etc. before he signs-up for your service?

When would you check the change made to the endpoint in the process of
signing-up? What about the TTL? Do you expect that the customer to
wait until the changes are visible to you and you could confirm the
ownership?

If you ask for a change of the email address, would you provide an
email account? What happens with the emails distributed to that
address during the "ownership check"? Does your customer have to log
into this new account and, after he has changed the email address back
to his personal email address, forward all incoming emails to his
personal email address?

Aren't there other ways like sending an SMS message to the handset
including a verification code, which your future customer has to enter
into a form within a given time frame? Do you consider this method as
not secure because a handset could have been stolen?

Tom

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Bernie Hoeneisen <[email-masked]>
Date: Wed, 20 Jul 2005 08:18:12 -0400

On Tue, 19 Jul 2005, Stastny Richard wrote:
Valdiation in User ENUM has been discussed and solved
years ago,
Validation is solved in User ENUM? I'd say at most part of it...
cheers,
 Bernie
_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum