Re: [Ietf-message-headers] Provisional Registration for "Wrong-Recipient" mail header

[Simon Josefsson <[e-mail]>]

David Weekly <david=[e-mail]> writes:

> Header field name: Wrong-Recipient
> Protocol: mail
> Status: provisional
> Author: David Weekly <[e-mail]>
> Specification:
> https://datatracker.ietf.org/doc/draft-dweekly-wrong-recipient/
>
> Current intent is to attempt to develop the above draft I-D into an RFC
> with IETF, am just beginning that process.
>
> This is a "cousin" to List-Unsubscribe (RFC 4021) and List-Unsubscribe-Post
> (RFC 8058) meant to allow an email reader to explicitly indicate they are
> the wrong recipient of an email from a service.
>

Interesting.

There should be discussion about the potential for security problems for
a user if she follows the link in the header: the user will leak to the
service that she has received and read the e-mail.  This design may lead
to an attack where malicious sites sends e-mails with this header, and
unsuspecting users will click the button to avoid future such e-mails,
and the malicious site has learned that this is a valid e-mail address
read by a human (with a modern e-mail client that supports this
feature).

The draft doesn't say what the client should do with the response from
the POST.  Is this to be displayed in a browser?  Or merely as a
background POST from the MUA?  Users would want some form of feedback
after pressing that button.

/Simon