Re: [MORG] Discuss and Comment positions on draft-ietf-morg-list-specialuse-05

[Alexey Melnikov <[e-mail]>]

Adrian Farrel wrote:

>Hi,
>
>Thanks for the update.
>
>[SNIP]
>
>  
>
>>>Section 7
>>>
>>>      
>>>
>> >  LIST response: There are no security issues with conveying special-
>> >  use information to a client.
>>    
>>
>>>Really. Doesn't the exchange of information imply that there is
>>>potential to intercept the information. Knowledge of the message store
>>>usage may be valuable to someone attempting to access messages.
>>>      
>>>
>>If someone can tap into the IMAP stream, this extra bit of information
>>(which will much of the time be guessable from the mailbox name
>>anyway) is the least of anyone's concern.  I don't believe there are
>>any security issues here beyond what exist in IMAP in the first place.
>> I certainly don't think it's the case that *this* is what will push
>>someone over the edge to using TLS, where it was OK not to use TLS
>>before.    
>>
>
>A way to handle this is to point it out. It is not the document authors' job in
>this sort of case to tell the deployer what to do. But it is the their job to
>say, look, when you are doing this new feature you are increasing your exposure
>and if that worries you, you need to do the security stuff.
>
>That is, IMHO, it is not the authors' position to say how likely this is to tip
>someone into using TLS. Just set out the facts and point out that TLS exists and
>let people decide for themselves.
>
I negotiated some text with Barry on this.