Re: Sub/Not Security, Presence service identifiers

"Peterson, Jon" <[email protected]> writes:

> The way the presence service identifier issue was raised in Yokohama
> (following the list mail) was as follows:
> 
> 7. A wrapper for presence information be defined that contains a name
>    that identifies a presence service, and nothing else.
> 
> That was the idea that was opposed there - I imagine you agree that we don't
> need one or those?

Let me give you a full response to the questions you raised later, but
the short summary is that I most certainly do think we need a wrapper
that contains a name that identifies a presence service and also
contains at least a timestamp.  How else are we going to prevent a
replay attack?  My general approach is to do for presence
notifications what we did for instant messaging.

John



  [reminder: [email protected] for non-technical discussions, please]