Re: [Jmap] Secdir last call review of draft-ietf-jmap-core-12

[Barry Leiba <[e-mail]>]

Hm.  I don’t see that.  All you get in response to the IDLE command is the
same stuff you get from the NOOP command or from any other IMAP command:
untagged FETCH and EXPUNGE responses.  Technically, they’re not actually
responses to the command: they’re unsolicited messages in the IMAP protocol.

What security considerations should there be for IDLE that are beyond those
for NOOP (that is, IMAP itself?

Barry

On Tue, Jan 8, 2019 at 12:58 AM Ned Freed <[e-mail]> wrote:

> > Ned Freed <[e-mail]> wrote:
> > >
> > > AFAICT it's different in the sense that this is the first push email
> > > notification mechanism we have standardized.
>
> > What about RFC 2177 IMAP IDLE?
>
> IDLE is an odd mix of pull and push. I don't think it really meets the
> criteria
> for a pure push mechanism, although on futher consideration I suppose with
> some
> persistance and careful observation of multiple IMAP streams you could
> perform
> this sort of traffic analysis on it.
>
> That said, the fact that the security considerations section in RFC 2177
> says in its entirety:
>
>   There are no known security issues with this extension.
>
> is pretty disturbing regardless. At a minimum an IDLE stream leaks
> information
> about a particular mailbox's activity, even when uncorrelated with incoming
> messages.
>
>                                 Ned
>