Re: [secdir] Secdir last call review of draft-ietf-jmap-core-12

[Tero Kivinen <[e-mail]>]

Barry Leiba writes:
> I think that advice to use TLS whenever possible is the extent of
> what makes sense to say here.

Using TLS does not help here, as this attack is traffic analysis
attack, and you can do traffic analysis even when all the traffic is
encrypted. The current draft already says that all request MUST use
TLS.

> As to shared folders, that is neither “bad” nor “risky”: it’s necessary for
> many use cases.  For example, IETF itself uses shared IMAP folders to serve up
> our mailing lists.  Help desks will use a shared inbox for, say, 
> [e-mail], to allow multiple agents to handle questions and
> complaints, while maintaining accountability (each agent has a separate login,
> so their activity is tracked).

Agreed. I was not saying it is bad or risky, but the none of the
examples you gave are not really examples of

  ... if another user is sharing their mail with the logged in
   user, ...

All of those are examples of user gaining access of group account
(which is also mentioned). So my comment was that two individual users
sharing their individual mails with each other is not really that
common, and has much more privacy concerns than it help desk having
shared inbox. Sharing calendar entries also has privacy concerns, but
most people do understand them better and calendars provide ways of
separating private / public entries already.

So, I think changing the text:

   A single set of credentials may provide access to multiple accounts,
   for example if another user is sharing their mail with the logged in
   user, or if there is a group account.

to something like this:

   A single set of credentials may provide access to multiple
   accounts, for example if another user is sharing their work
   calendar information with the logged in user. Another example of
   cases where access to multiple accounts can be useful is when
   logged in user can also access shared group account mailbox (for
   example it help desk inbox).

would make the text better. 
-- 
[e-mail]