Re: [Extra] Secdir last call review of draft-ietf-extra-imap4rev2-24

Daniel Migault <daniel.migault@ericsson.com> Wed, 20 January 2021 18:22 UTC

Return-Path: <daniel.migault@ericsson.com>
X-Original-To: extra@ietfa.amsl.com
Delivered-To: extra@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B0613A11B5; Wed, 20 Jan 2021 10:22:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.35
X-Spam-Level:
X-Spam-Status: No, score=-2.35 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.25, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WPrcfCDz8Vlh; Wed, 20 Jan 2021 10:22:18 -0800 (PST)
Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2049.outbound.protection.outlook.com [40.107.220.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B8893A11B6; Wed, 20 Jan 2021 10:22:17 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=S0+igAr8foh6zqlVJV0oaLufXVBGCg4+Ud1Qc7umCL1644wyvWKyxBQwb38paQDbFBMqYVBNKapOAEmm0Ak17P6lFS72cXfAXM8iOK4+T7XFp0D2rjWNCO8OOSISKEeroKoGKtRUAqV2ahNj4BletJLLm7vI55uiKVHEnomWgb5a7FKNTo8O08Rl1LDuWxLC2FNHhKR9vu1iA8GDtpFQ79JiQu17KhFl7J7d0I/DvOoqGwUJiGYTuLqq9y0SNrk5tGtVEoN+qjCTHNbAIvJ67RV5u4kJz3qoMHV14i6IqcO6S+srmVIgSqPcewxUpt9ofvZQ+eNKMKLn7YaHLZePRQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MEO3CUHPFCpmt0LfX2T5d+4QiR0GEqXudOrTiEzGMD8=; b=eNqiI+TUjhE4kubK0UaYiD3BmR9I53oRZ7AndMNVzDhTaI98FvY/s/jC5W9Uf8Klk3SKh8rkrTrfTf/UPB6HLMG0AmHO07/qOnH5OaWtgouE7+sjEnIPnDyaZDS5NMvdNXrOs8TlP5PR+rrV3UYhclCtz3peGKQDnduYehPCT05fOtY9sBezOPpWmoI9CBx1Mys1VGO5Vk1pc6Eb0VpT4sVgc/E0AowfAmBstNL6c3QoJIJCpMyKCwSQw/5b3rplNmz2TWL7YcX3ON2H2YVMRnPARrEyg2FW/bZX5UJvudJH6o5QV7mG/2J1rsJ5oFBe7YwU/990LjV51tYYIxK+HA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MEO3CUHPFCpmt0LfX2T5d+4QiR0GEqXudOrTiEzGMD8=; b=X0OphG7tLHyTeor0x7WG/8OYN2cVKcnTz9Cy5YU0dItaV79OcwyFk3G8qVK1DR5CmRtlsYfQao62WvoWhWaEmGfyAhtMlZan9UyjYIJDSaR+cu0yOmjxhmqlv4kheTDRqnINeV2qMQRfMpFUUwpE25ZcVoX8mioNEnLgtRxeUQQ=
Received: from DM6PR15MB2379.namprd15.prod.outlook.com (2603:10b6:5:8a::16) by DM6PR15MB4005.namprd15.prod.outlook.com (2603:10b6:5:294::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3784.11; Wed, 20 Jan 2021 18:22:16 +0000
Received: from DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::a9f9:326f:8cfb:157b]) by DM6PR15MB2379.namprd15.prod.outlook.com ([fe80::a9f9:326f:8cfb:157b%7]) with mapi id 15.20.3763.014; Wed, 20 Jan 2021 18:22:16 +0000
From: Daniel Migault <daniel.migault@ericsson.com>
To: Alexey Melnikov <alexey.melnikov@isode.com>, "secdir@ietf.org" <secdir@ietf.org>
CC: "draft-ietf-extra-imap4rev2.all@ietf.org" <draft-ietf-extra-imap4rev2.all@ietf.org>, "extra@ietf.org" <extra@ietf.org>, "last-call@ietf.org" <last-call@ietf.org>
Thread-Topic: Secdir last call review of draft-ietf-extra-imap4rev2-24
Thread-Index: AQHW7osBCZRYcejh/kaFOg7r/oDlOqovTFtxgAF6oICAAA4TNQ==
Date: Wed, 20 Jan 2021 18:22:16 +0000
Message-ID: <DM6PR15MB2379B58281E066E4523B1404E3A20@DM6PR15MB2379.namprd15.prod.outlook.com>
References: <161106792581.26552.4563982290675643872@ietfa.amsl.com> <99082ebc-318b-5c4d-a9e6-b3893ab99c0d@isode.com> <DM6PR15MB2379AD34B141FD5015D25E86E3A30@DM6PR15MB2379.namprd15.prod.outlook.com>, <ecbc01e4-4a84-4a5b-e7be-e87c7897a01c@isode.com>
In-Reply-To: <ecbc01e4-4a84-4a5b-e7be-e87c7897a01c@isode.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: isode.com; dkim=none (message not signed) header.d=none;isode.com; dmarc=none action=none header.from=ericsson.com;
x-originating-ip: [96.22.11.129]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: fe2391ab-e7bb-4b04-7630-08d8bd7050cb
x-ms-traffictypediagnostic: DM6PR15MB4005:
x-microsoft-antispam-prvs: <DM6PR15MB400557148B4DB8F10FCED2FDE3A29@DM6PR15MB4005.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: PFKxMv8WyveqjET9E0t0xwIqV287zDkocc/gX6CI9C/LBIz9JMlmRFy+PWGZR+nhamBqIo1Tos0flXFlA8qHJB6BRv9R78vERbwZERQmzuGMmdDQGAfvSXONXcN7Xg1AcwAEdRs0BKvmESgdH0ht/OzdJY6rrBmddwVC7SOVVjgkFxOVS5Z7CGbZ0cvVLeg7ul+L3PvV6cPFo+ql8iTKNLlspkvzeVSlHzt6qDRx9gwCKbf64G6E9Yibn+NgbgZtsLlj4IBKTz18nuVRoeEftqrICxIkcFSvK4aIdgyBR+QB7FtDIjXbmAe0G/b8TlLnr7yKD8oSpesLgQXEnry2bMrIpxTdrmEJ7HG+OqPvZnlxVB1p6RHQuSfErEdGFjG/vG3jnz02KpaPkLg/6qKUHA==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR15MB2379.namprd15.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(346002)(366004)(396003)(39860400002)(54906003)(64756008)(19627405001)(52536014)(66476007)(66446008)(5660300002)(2906002)(7696005)(316002)(91956017)(26005)(33656002)(76116006)(44832011)(186003)(66946007)(8936002)(71200400001)(66556008)(83380400001)(9686003)(86362001)(55016002)(110136005)(8676002)(478600001)(53546011)(6506007)(4326008); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: =?us-ascii?Q?Y3ndetPOyLqhXL0b+dGtwiXWJXyEVs52cJ1YLf5JedOBiXwluDcSCUpz/GUP?= =?us-ascii?Q?sIXuUlJiTl1N2RJN46G0uwJ7ZigT7MkHvuYDMjbfBLbFrda6sa0LEm1Ct4K2?= =?us-ascii?Q?Dg7seXFjMwnxW19+GRoamQTH0j0gDx/x95ZbZ6cQkyohFqaixT2NRZLUxHra?= =?us-ascii?Q?0HtfgxbDLnfURIt2tV0gpXPSez6TIuVM9c+PpFSvoDqvZRfqS8tv0TNaZt/0?= =?us-ascii?Q?qFlJFF34AJ24doTnegQhgZEewfkPSs491v4WpVaFMvUzQ5fhKZj9vR+Qn9OF?= =?us-ascii?Q?P5E+la12tv9oOszEJiRca35Qw634L15iQFtA0k0p3lqWYFl2morEWUy74ehr?= =?us-ascii?Q?wfnqHXRUudne8wsdhA1Duf0m79JXZ07JSJWGhERYvA54u9Qfwg+Px3MpemC/?= =?us-ascii?Q?OIcnpUAQI7/bH/dATFrLEoeixBrrKfKyTIp8kD1AnXQ6X4NWO+Q6oGnq5ztG?= =?us-ascii?Q?7+aopdhSvGAkJxvjI38NbzYm1NASbtKjpVUOkTkpdv6Bf45uMECrgOruclcg?= =?us-ascii?Q?D/Itjz1LaDeXUqAaMR7MqLbCYkAtbHxPyiiGhEkOvy3n/moD7Q0KHtEW1RAu?= =?us-ascii?Q?4XhnHRFHZaTJr/4aKrJ4Oe0lUrEy3OqWhfxK5I5uxY/iWNtyexnXvVlg2klE?= =?us-ascii?Q?5PZhpSpZFnM3fNZhMAuuSPcQwFHVvM07vDkI+E2WfQdUoT0FpaYmN8kQxkCr?= =?us-ascii?Q?LeRLBld2enDGZ2DCI1++gL9LTDnVpUlTWSjAVQ/0+kEzNrm0BwTzqD2tmdDn?= =?us-ascii?Q?LPHfiLYbelVKZ5Js8GW21jIPO+/N8RDqu4ZCRLKwVSTR79A7Sm2Ja43NuY1z?= =?us-ascii?Q?Nl0RA+W50JVN8X57MTQRb5hkOO37Bqp6Skgkj0WcdfizNxQ9RWNP9vnNpVVm?= =?us-ascii?Q?Pw3G7mnheITt6mvG+hQlRFtOpk6GtIY+eG0+1LCiw3mJgZ/8upPMg05CLMYa?= =?us-ascii?Q?H9JjUO6C0PX7nVNenJfby6QuOcxCHiygeKOa5tlJJBk=3D?=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_DM6PR15MB2379B58281E066E4523B1404E3A20DM6PR15MB2379namp_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM6PR15MB2379.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fe2391ab-e7bb-4b04-7630-08d8bd7050cb
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jan 2021 18:22:16.1913 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: qvc0XjKhL4fPpueZwekY7JnI1x+8qc8Bo0Dz9kCudO2nCRIsTuLDTo9j+moHaPNOWhy/BxJU3h60QOaxn6oOpEvU1+phxnV561eKBJ6ZAac=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR15MB4005
Archived-At: <https://mailarchive.ietf.org/arch/msg/extra/9iIJuvztG97_6k-wH8mg18AScAY>
Subject: Re: [Extra] Secdir last call review of draft-ietf-extra-imap4rev2-24
X-BeenThere: extra@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Email mailstore and eXtensions To Revise or Amend <extra.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/extra>, <mailto:extra-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/extra/>
List-Post: <mailto:extra@ietf.org>
List-Help: <mailto:extra-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/extra>, <mailto:extra-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Jan 2021 18:22:20 -0000

Thanks for the response!
Yours,
Daniel
________________________________
From: Alexey Melnikov <alexey.melnikov@isode.com>
Sent: Wednesday, January 20, 2021 12:31 PM
To: Daniel Migault <daniel.migault@ericsson.com>om>; secdir@ietf.org <secdir@ietf.org>
Cc: draft-ietf-extra-imap4rev2.all@ietf.org <draft-ietf-extra-imap4rev2.all@ietf.org>rg>; extra@ietf.org <extra@ietf.org>rg>; last-call@ietf.org <last-call@ietf.org>
Subject: Re: Secdir last call review of draft-ietf-extra-imap4rev2-24


Hi Daniel,


On 19/01/2021 20:46, Daniel Migault wrote:
Hi Alexey,

Thanks for your response. Please find some clarifications/responses.
Thank you for the followup. My responses below.

Yours,
Daniel

________________________________
From: Alexey Melnikov <alexey.melnikov@isode.com><mailto:alexey.melnikov@isode.com>
Sent: Tuesday, January 19, 2021 12:46 PM
To: Daniel Migault <daniel.migault@ericsson.com><mailto:daniel.migault@ericsson.com>; secdir@ietf.org<mailto:secdir@ietf.org> <secdir@ietf.org><mailto:secdir@ietf.org>
Cc: draft-ietf-extra-imap4rev2.all@ietf.org<mailto:draft-ietf-extra-imap4rev2.all@ietf.org> <draft-ietf-extra-imap4rev2.all@ietf.org><mailto:draft-ietf-extra-imap4rev2.all@ietf.org>; extra@ietf.org<mailto:extra@ietf.org> <extra@ietf.org><mailto:extra@ietf.org>; last-call@ietf.org<mailto:last-call@ietf.org> <last-call@ietf.org><mailto:last-call@ietf.org>
Subject: Re: Secdir last call review of draft-ietf-extra-imap4rev2-24

Hi Daniel,

Thank you for your review. My replies below. I removed some of your
comments that I need to think a bit more and will reply to them separately.

On 19/01/2021 14:52, Daniel Migault via Datatracker wrote:
> Reviewer: Daniel Migault
> Review result: Has Nits
>
 [snip]
>
> [ ... ]
>
>     $Phishing  The $Phishing keyword can be used by a delivery agent to
>        mark a message as highly likely to be a phishing email.  An email
>        that's determined to be a phishing email by the delivery agent
>        should also be considered a junk email and have the appropriate
>        junk filtering applied, including setting the $Junk flag and
>        placing in the \Junk special-use mailbox (see Section 7.2.3) if
>        available.
>        If both the $Phishing flag and the $Junk flag are set, the user
>        agent should display an additional warning message to the user.
>        User agents should not use the term "phishing" in their warning
>        message as most users do not understand this term.  Phrasing of
>        the form "this message may be trying to steal your personal
>        information" is recommended.  Additionally the user agent may
>        display a warning when clicking on any hyperlinks within the
>        message.
>
> <mglt>
> I tend to believe that phishing is now
> (unfortunately) known by most users.
> I have the impression that UI is always a
> difficult problem, and I am wondering if such
> recommendations are still valid or if that is
> a legacy statement. I do not have strong
> feeling about what to do, so I leave it to
> you, but is interested in your opinion.
This text matches the original registration of the $Phishing keyword. I
have seen some modern email clients still following this advice, so I
think it is useful. Which part of it do you find outdated?

<mglt>

Just to be clear that was just a comment. In the following sentence,
"""
User agents should not use the term "phishing" in their warning
message as most users do not understand this term.
"""
I was questioning  "as most users do not understand this term" and tend to believe that most users have heard what phishing means. So I am wondering if the user the message is being shown does not translate to itself: "Oh yeah they mean phishing".  Again just some random thoughts from my part.
Sorry, I was staring at this text so much that I stopped noticing it. Now that you pointed this out I think removing this sentence makes sense.

</mglt>
 [snip]
>
> The section mentions that repeated attempts
> for a password associated is detected,
> somehow prevented. It may also worth
> mentioning that with a large number of login
> (known or guessed),
> an attacker may try to guess a login
> associated to a small number of commonly
> known weak passwords ( password
> spraying). I believe it might worth being
> mentioned, that correlating failed attempts
> worth also being mentioned.
Fair enough. Can you suggest some text?

<mglt>
Maybe something around these lines:

An IMAP server SHOULD report any authentication failure and analyze the attempt with regard to a password brute force attack as well as a password spraying attack. Accounts that matching password spraying attacks MUST be blocked and request to change their passwords and only password with significant strength SHOULD be accepted.
I edited this slightly. Thank you for the suggestion.
</mglt>

> Maybe that goes a bit too far in the purpose
> of recommendations, but it might may sense to
> recommend strong random passwords used in
> conjunction of passwords wallets or the use
> of mutually authenticate TLS.
>
> </mglt>
>
>
> <mglt>
> One question I would have - and with very
> little opinion on it - is how vulnerable IMAP
> parsing is to injection. I usually see the
> use of JSON as a big advantage toward
> this, but I would be happy to known
> your opinion on it.
Can you give me an example, as I am not sure what do you mean by
injection in this case?

<mglt>
I do not have specific example in mind. My question was if there are known ways to inject some commands in a specific field or if some parsers checks have been relaxed to enable interoperability.
I can't think of any. IMAP is either using octet-counted literals or strict syntax (LIST-like). Syntax is quite regular and easier than XML (IMHO).

</mglt>

> I also have the impression that injections
> can be performed via the web interface, so a
> web front end should be carefully considered
> and IMAP server may not believe they are
> always immune behind a web front end and
> still require to follow the best practises.
>
> </mglt>

Best Regards,

Alexey