Re: [apps-discuss] update to rfc5965

[Dave Cridland <[e-mail]>]

Murray S. Kucherawy wrote:





It strikes me that putting a specific password in a standards document
is unlikely to fly.  It might be better to include a new media type
parameter to indicate the password used to create the encrypted form.


I would worry that the same problem Franck's trying to workaround here
would resurface. That is, scanners would read "inside" the ZIP. Of
course, maybe they would anyway with a specific media type and a known
password.

I don't think that a fixed password in this instance is wrong, given
the purpose of the encryption is not actually to encrypt, per-se.

I have to wonder if there's an alternative, like a media type that is
itself defined as base64 encoded, but I note Franck's statement that a
ZIP with a known password is the deployed workaround; standardizing
this running code seems like the simplest option.

Dave.