Re: [Secdispatch] Please help dispatch "Dangerous Labels"

["Salz, Rich" <[e-mail]>]

It's not really about dangerous words (or Carlin's seven naught words), but rather names that have been attributed by other RFC's to have special meaning. Think "[e-mail]" for an email address, for example.  It creates an IANA registry.  It's useful and important, and dispatching to someplace is a tough question.  Nice work, dkg.

On 7/26/22, 11:10 AM, "Daniel Kahn Gillmor" <[e-mail]> wrote:

    I've written a document that tries to establish a registry of labels --
    just DNS labels and e-mail local parts at the moment -- that have
    surprising security properties:

       https://datatracker.ietf.org/doc/draft-dkg-intarea-dangerous-labels/

    The not-so-secret goal of the document is to *discourage* creation of
    new labels like this.  Or, rather, to discourage the creation of systems
    that treat certain "magic" labels as having special properties.

    For example, if the administrators of "example.com" permit Jennifer to
    take control of "mta-sts.example.com", she can change the e-mail
    transport security properties of the entire zone.  Similarly, if the
    admins allow Roberto to have access to the e-mail address
    [e-mail], he can create an X.509 certificate for any host
    in the zone, due to the CA/B Forum's baseline requirements.  Take a look
    at the doc for other examples.

    These dangerous labels are booby-traps for unwary administrators.

    If someone is designing a system that would want to add a label to
    either of the registries that this document designs, it gives us an
    opportunity to try to divert them to using something better, such as a
    .well-known URL, an underscore-prefixed DNS label, or anything more
    principled.

    If anyone knows of other dangerous labels that should be listed here
    (DNS labels, e-mail local parts, or even labels in other categories),
    feel free to reply directly to me, or open an issue or merge request on
    https://gitlab.com/dkg/dangerous-labels/

    But if this document goes forward, it has an explicit ask for IANA to
    create the registries, so it probably would need to culminate in an RFC.
    I have no idea where this document should live within the IETF.

    Suggestions?

            --dkg