Re: [secdir] Secdir last call review of draft-ietf-jmap-core-12

[Tero Kivinen <[e-mail]>]

Kurt Andersen (IETF) writes:
> On Thu, Jan 3, 2019 at 4:04 AM Tero Kivinen <[e-mail]> wrote:
> 
>     Reviewer: Tero Kivinen
>     Review result: Has Issues
>    
>     This document also has quite a lot of privacy concerns which are not
>     addressed by it. For example email delivery and event notifications can
>     leak lots of information even to passive attackers.
> 
> How is this any different than the risks present in current mechanisms
> (websockets, HTTP, MAPI, IMAP, etc.)? I don't see this as a new risk being
> introduced by the JMAP protocol.

There is some similarities and differences. For example http does not
have built in event notification system. In most of the other
protocols the event system notification system is built on top of the
other protocol running over for example http.

Here if I understood correctly the event notifications are generated
automatically and application writer using generic JMAP server backend
might not even have any control how those events are generated and
when they are generated. Because of this I think this issue belongs to
the JMAP protocol document.

The main difference with event notification system is, that it is not
between the two peers running the JMAP protocol, or two parties
running some external API connected to JMAP. It involves the third
party, i.e., the party where the notifications are sent to. 

Also the examples given in the document talk about mail, calendar,
contacts etc, which all are data related to privacy and where there
are lots of privacy issues, so clearly this JMAP is designed to be
used in environments where privacy concerns are important, but still
it is silent about them. 

>     Of course sharing mailboxes between multiple users (one of the
>     examples given in 1.6.2), has lots of privacy issues. 
> 
> Again, this is not a new risk being introduced by JMAP. It seems unfair to
> saddle the JMAP protocol with the responsibility of documenting a comprehensive
> set of privacy and security risks for bad or risky behaviours that have been a
> wide part of common practice for decades.

If you provide example of bad and risky behaviours in your document,
you need to also include the warnings about it. Thats why I did
suggested you using different example (i.e., shared work calendar,
shared between co-workers, or shared calendar between family members).

And if you write protocol that can be used to do all kind of things
you should really write comprehensive set of privacy and security
risks inherintly associated with the JMAP protocol, and also include
some generic warnings about common mistakes that users of JMAP can do. 
-- 
[e-mail]