Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[Tim Wicinski <[e-mail]>]

I would drop that whole third sentence, and mention sending such reports
may contain PII.
The document can refer the reader to non-IETF documents for information,
but in general
we do technical standards, and stay away from policy decisions in standards
track documents.


tim


On Mon, Dec 28, 2020 at 10:57 AM Michael Thomas <[e-mail]> wrote:

>
> On 12/28/20 7:48 AM, Todd Herr wrote:
>
>  not a lawyer, but providing A with some information about a message that
> A sent to X seems different, from a privacy perspective, than providing A
> with some information about a message impersonating A that B sent to X, and
> I thought perhaps the generic warning might mention this distinction, if
> possible. Something like:
>
> Security considerations
>
> Failure reports provide detailed information about the failure of a
> single message or a group of similar messages failing for the same
> reason. They are meant to aid domain owners to detect why failures
> reported in aggregate form occured. It is important to note these
> reports can contain either the header or the entire content of a
> failed message, AND THAT THE DOMAIN OWNER RECEIVING THE
> REPORTS MAY NOT BE THE ORIGINATING PARTY FOR THE MESSAGE(S)
> REFERENCED IN THE FAILURE REPORTS. IN ANY CASE, THEY may contain
> personally identifiable information, which should be considered when
> deciding
> whether to generate such reports.
>
>
>
> This is a tempest in a tea pot. This is an issue with the originating
> domain and nobody else. They can send it to a third party even if the url
> lists them to receive the report first.  The receiving domain can't know
> what they will do with the report, and the originating domain has already
> seen the mail in clear text before it was sent. IETF should stay out of the
> business of being nannies that it has no way to enforce.
>
> Mike
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc
>