Re: [secdir] [Jmap] Secdir last call review of draft-ietf-jmap-core-12

[Ned Freed <[e-mail]>]

> It may be the first such mechanism we've standardized, but it's certainly not
> the first time we've contemplated push notification of email delivery. Consider
> RFC5435 (the Sieve notify extension), published just about 10 years ago this
> month. Among other things, it contains extensive discussion of security
> considerations surrounding push notification.

Not really. The security considerations, while extensive, do not cover
traffic analysis of notifications pushed directly to the client, which is
the main concern here. And neither do the other RFCs defining specific sieve
notification mechanisms.

This is likely because all of the mechanisms we were standardizing have a
different set of security issues. Indeed, almost all of the considerations
covered in RFC 5435 et al. are orthogonal to the current case, which is why I
didn't suggest citing RFC 5435 et al. in the current document.

				Ned