Re: [apps-discuss] Webfinger discussion

['Andrew Sullivan' <[e-mail]>]

On Tue, Mar 27, 2012 at 12:15:21PM -0400, Paul E. Jones wrote:
> We'll add text along those lines to the next draft.  Any other security
> considerations we should note?

I wish I had something more intelligent to say than, "Is anyone [else]
worried about the aggregation of this information amd what it does to
the security profile of the aggregated things?"  Note this isn't
exactly the privacy issue, though there's that.  As nearly as I can
tell, one natural use case (or anyway, something people said) was that
you can aggregate information across services so that, for instance,
it would be easy to tell about the relationships among me@service1,
me@service2, and me@service3.  If I'm misunderstanding (this happens a
lot, note, so don't be afraid to point and laugh), please correct me.

If I understood correctly, it seems to me that disclosing something
about the relationship of these three accounts is in effect a new
disclosure, and that it offers potential for analysis (and therefore
attacks) that might not have been available given the individual
accounts alone.  But beyond that hand-wavy unease, I haven't the tools
to say anything really sensible.  Maybe there's some sort of secdir
guidance for this sort of thing?  (Note that I'm not a security guy,
and I don't play one on TV either.  This is just the sort of thing
they warned me about when I was a kid, and I think that's why I have
the heebie-jeebies about this.  Maybe I'm just superstitious.)

Thanks for putting up with the hand-waving (which will stop now),

A

-- 
Andrew Sullivan
[e-mail]