Re: [apps-discuss] Alissa Cooper's Discuss on draft-ietf-appsawg-sieve-duplicate-07: (with DISCUSS and COMMENT)

[Stephan Bosch <[e-mail]>]

Hi Alissa,

On 6/25/2014 12:58 PM, Alissa Cooper wrote:
> "The list of unique IDs used for duplicate tracking can include
> privacy-sensitive information, such as Message-ID values, content of
> subject lines, and content extracted from message bodies. Implementations
> SHOULD protect that information, by obscuring it through hashing (see the
> note at the end of Section 3.2) and/or by storing it with a level of
> access control equivalent to that of the messages themselves.
>
> These measures will not prevent an entity that has access to the duplicate
> tracking list from querying whether messages with certain Message-ID
> values were received. As this operation is the essence of the "duplicate"
> test, this cannot be prevented, and may violate the expectations of the
> user. For example, a user who downloads or deletes a message may expect
> that no record of it remains on the server, but that will not be true if
> its Message-ID is persisted on the server in the duplicate tracking list.
>
> It's notable, however, that server logs will often store the information
> present on the duplicate tracking list anyway, and probably would expose
> plaintext Message-IDs for a much longer period than this mechanism would.
> Users of email services that intentionally delete such logs with the
> intent of limiting traceability should be made aware that use of the
> duplicate tracking mechanism re-exposes this information for the duration
> of the expiry interval. In those situations, a shorter default expiry may
> also be appropriate since users of these services may be willing to trade
> off a more limited retention of the duplicate tracking list information
> against the fact that every duplicate will not necessarily be eliminated
> with a shorter expiry."

Applied in -08. But I made the final paragraph a bit shorter.

Regards,

Stephan.