[secdir] Review of draft-ietf-xcon-common-data-model-27.txt

Tero Kivinen <kivinen@iki.fi> Fri, 27 May 2011 12:08 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <19935.37953.301024.987227@fireball.kivinen.iki.fi>
Date: Fri, 27 May 2011 15:08:33 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: iesg@ietf.org, secdir@ietf.org
Cc: draft-ietf-xcon-common-data-model.all@tools.ietf.org
Subject: [secdir] Review of draft-ietf-xcon-common-data-model-27.txt
Precedence: list

This is re-review of the draft I already reviewed at 2011-03-03. The
current draft contains some small changes done since, but I do not
think it solves the issues I raised in my previous review:

1) The confidentiality is not mandatory even in the cases where the
   database contains sensitive elements (passwords), it is only
   SHOULD.

2) The privacy issues is not covered enough. The current version added
   specific pointer to the section 11.2 of RFC5239, but that only
   covers one very small privacy issue, i.e. anonymous access. It does
   not cover gathering sensitive privacy information in the database,
   i.e. who participated which conferences and with whom.

My previous review can be found in
http://www.ietf.org/mail-archive/web/secdir/current/msg02482.html 
-- 
kivinen@iki.fi

[secdir] Review of draft-ietf-xcon-common-data-mo… Tero Kivinen
Re: [secdir] Review of draft-ietf-xcon-common-dat… Tero Kivinen
Re: [secdir] Review of draft-ietf-xcon-common-dat… Oscar Novo
[secdir] Review of draft-ietf-pppext-trill-protoc… Paul Hoffman
Re: [secdir] Review of draft-ietf-xcon-common-dat… Tero Kivinen