0

I am considering signing up with a low-cost SIP provider which, according to a current white paper, does not (yet) support SIPS (Secure Session Initiation Protocol). I understand that this means that my SIP user name and password will have to be transmitted unencrypted over TCP whenever my soft phone registers to this provider.

Is this a red flag or a restriction that is fairly common among other (well-reputed) SIP providers as well?

Improve this question

1 Answer 1

Reset to default
2

Actually it is very common to not support SIPS.

user name and password will have to be transmitted unencrypted

SIP uses Digest MD5 for authentication which is a challenge response protocol where the passwords are not transmitted in clear text. Thus cracking the password by sniffing the connection is not possible unless the attacker has access to a huge number of authentications done by the same user. Brute forcing the password is usually more successful.

Using Digest authentication also means that the password need to be stored by the server in clear text or in some equivalent form or reversible encrypted, i.e. the usual one-way hashing is not possible.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .