Re: [Dime] Alissa Cooper's Discuss on draft-ietf-dime-rfc4006bis-08: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Wed, May 23, 2018 at 10:43:20AM -0500, Ben Campbell wrote:
> 
> 
> > On May 23, 2018, at 10:07 AM, Alissa Cooper <[e-mail]> wrote:
> > 
> >>>> 
> >>>> = Section 15.1 =
> >>>> 
> >>>> "Redirect-Server-Address AVP: the service-provider may embed
> >>>>      personal information on the subscriber in the URL/I (e.g. to
> >>>>      create a personalized message)."
> >>>> 
> >>>> This seems like a bad idea that, if it's going to be mentioned, should be
> >>> recommended against.
> >>>> 
> >>>>> Makes sense.  I would recommend add the sentence "However, this is
> >>> not recommended.”
> >>> 
> >>> It’s also commonly done, isn’t it? I think the point is to mention that the AVP
> >>> is sensitive because people might do this, not to offer permission. There’s
> >>> already text recommending against directly using personal information.
> >>> Would it help to change “may” to “might”? to avoid any semblance of
> >>> “permission”?
> >>> 
> >>> Some of the other AVPs likely carried in the same message are going to have
> >>> personally identifiable information one way or another (i.e. Subscription-ID).
> >>> 
> > 
> > What I was thinking was more that this potentially makes the URLs guessable in such a way that attackers accessing them could obtain personal information about any subscriber whose name they know. Is that not a concern?
> > 
> 
> That’s a very good point. Would it help to add some guidance to make these hard to guess along with the existing text about not adding user identifying information?

That seems worth doing.

Thanks,

Benjamin