Re: [secdir] SECDIR Review of draft-ietf-morg-multimailbox-search-06

[Samuel Weiler <[e-mail]>]

>> If the user specifies some mailbox(es) which she doesn't have access rights
>> to AND some mailbox(es) which she can access, the doc says to IGNORE the
>> ones she can't access.  Wouldn't it be more useful to send an error for
>> those mailboxes rather than silently fail?

> I don't see any value there.
>
> If the user is not permitted access to a mailbox, they don't get the
> information. There might be value sending the notice to an exception
> log, but it does not make much sense to send it to the user's client.
> If the user is trying to maliciously access material they should not,
> what would be the value in telling them?

I'm thinking about this the other way around: if we're dealing with 
the (perhaps more common) case of misconfiguration rather than malice, 
this delivers a poor user experience.  With a silent failure, the user 
is likely to be misled into assuming that no messages matched the 
search.

> The use case that would likely arise for this would be where there 
> are shared folders (e.g. mailing lists) in some sort of hierarchy.

Yep.

-- Sam