Re: [Extra] Ben Campbell's Discuss on draft-ietf-extra-sieve-fcc-08: (with DISCUSS and COMMENT)

[Alexey Melnikov <[e-mail]>]

On Thu, Jan 10, 2019, at 3:29 PM, Ben Campbell wrote:
>> On Jan 10, 2019, at 9:14 AM, Alexey Melnikov
>> <[e-mail]> wrote:>> 
>> Hi Ben,
>> 
>> On Thu, Jan 10, 2019, at 2:56 PM, Ben Campbell wrote:
>>> 
>>> 
>>>> On Jan 10, 2019, at 2:42 AM, Alexey Melnikov
>>>> <[e-mail]> wrote:>>>> 
>>>> Hi Ben,
>>>> 
>>>>> On 9 Jan 2019, at 21:51, Ben Campbell <[e-mail]> wrote:
>>>>> 
>>>>> ------------------------------------------------------------------
>>>>> ---->>>>> DISCUSS:
>>>>> ------------------------------------------------------------------
>>>>> ---->>>>> 
>>>>> Thanks for the work on this. I plan to ballot "yes", but have one
>>>>> item I think>>>>> needs to be discussed first:
>>>>> 
>>>>> The security considerations say that this extension adds no new
>>>>> considerations>>>>> not already present in [RFC5228], [RFC5230], [RFC5435], and
>>>>> [RFC6131]. I'm not>>>>> sure that that is true.
>>>>> 
>>>>> It seems like the ability to insert a copy of message into a
>>>>> mailbox might have>>>>> security and/or privacy considerations.
>>>> 
>>>> Can you give me an idea of what you have in mind here, other than
>>>> putting the user (Sieve script owner) over quota?>>> 
>>> I can’t say that I know what the security considerations might
>>> be; I’m>>> just skeptical that the answer is “no new considerations." The
>>> authors>>> of 5228 thought “fileinto” could be dangerous. Do we know why?
>> 
>> I don't remember now, even though I participated in the discussion.
>> 
>>>> In particular, what are the possible privacy implications?
>>> 
>>> Could there be issues with, say, shared mailboxes?
>> 
>> Possibly. I can write something about this.
>> 
>>> Or storing cleartext for mail that would be sent encrypted?
>> 
>> I can't think of how this is going to be possible. Sieve
>> notifications/vacation replies can disclose private information from
>> Sieve script owner, but storing such messages doesn't leak any more
>> information (ignore shared folders, I agree this might be an issue),
>> because such messages will be stored in one of owner's mailboxes .> 
> Doesn’t that make the safety of storing the message dependent on
> having reasonable protections for the owner’s mailboxes?IMAP access already requires TLS, so all message retrieval is already
over encrypted channel.
If you meant something else, can you please elaborate?
>> 
>>> I suspect the answers may be more IMAP related than sieve
>>> related, but>>> even that might suggest citing something IMAP related.
>> 
>> Best Regards,
>> Alexey
>