[Sml] Re: Adoption call for draft-happel-structured-email-trust-04

[Lisa Dusseault <[e-mail]>]

I'm in favour of adopting this document as a WG document though I can't see
why it's not a section of the main framework document.  It's in such
conversation with the work in that document and should be. I'd be even more
in favour of merging.  I also think the expired use cases document is
necessary to understand this.

Comments on the material itself:

I don't think the work on including and passing around secrets in email
(section 4.5) is mature or necessary.  It's very tempting to try to improve
the security of a system while we try to standardize it but I don't think
this is it.  It adds a lot of concerns about how the secrets are generated
and by whom.  If the attacker can guess how invoice numbers are generated
and then use those to build trust, this just adds even more security
concerns.  This may be more mature than I know in some implementations or
designs out there, but I can't tell from this document and I don't think
it's needed.

The plan to use Trusted Senders and the user's address book  to establish
trust (section 4.1) is not a good one.  The list of email addresses I send
to is NOT the list of email addresses I trust - there are many false
positives as well as false negatives.  It opens paths for targeted
attacks:  once a user is convinced to email a recipient (even to protest
something!  Even to complain or report a security issue!) now the recipient
KNOWS who has them in their address book and can try sending them a
structured mail involving fraud. Address books are  merged and populated
from multiple sources and not all those sources can be equally trusted.
Again, I don't think this is necessary.  Email recipient software already
decides how much parsing of an email to do and what to do with the results,
whether to add an event to somebody's calendar or offer an affordance to
use the parsed data.

Lisa

On Sat, Jul 26, 2025 at 12:31 AM Alexey Melnikov <[e-mail]>
wrote:

> Dear WG Participants,
>
> This email starts a two week Call For Adoption for "Trust and security
> considerations for Structured Email" (
> https://datatracker.ietf.org/doc/draft-happel-structured-email-trust/) as
> a starting point for a WG document.
>
> Please respond with your feedback, whether positive or negative, by the
> end of August 10, 2025. In your feedback, please be clear which comments
> need to be addressed before adoption and which comments can be resolved
> once adopted. (Full reviews are also welcome at this point, but please
> label comments appropriately)
>
> Reminder: This only constitutes a call for adoption of the document in its
> current form as a starting point for WG output.
>
> Best Regards,
>
> Alexey, as a co-chair
>
>
> --
> Sml mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>