Re: [lamps] HP Issue: Bcc Handling

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2020-10-02 10:33:10 -0400, Russ Housley wrote:

> Please take a look at RFC 5322, Section 3.6.3.  The proposed direction
> seems to be consistent, but you probably want to cite this section.

Thanks for this pointer, Russ.  Bcc is a surprisingly tricky thing to
get right in all cases.

In addition to the guidance in the section you cite, there are unusual
tricks or special cases that responsible MUAs will want to do to deal
with Bcc in "Sent" folders and "Drafts" folders (the semantics of these
folders in most MUAs are subtly different from other folders, and from
each other).  Also, there are some subtleties when dealing with Bcc for
encrypted e-mail (regardless of header protection) -- i've added a note
in the to-do list in https://gitlab.com/dkg/e2e-mail-guidance to try to
flesh those out.

But after some discussion with Alexey and Bernie, i think we're reaching
the conclusion that as complex as the work around Bcc is, it's pretty
much orthogonal to protected headers -- if you are doing the right thing
with Bcc already, you're likely going to do the right thing with Bcc
when generating a message with protected headers and Bcc.  (Conversely,
a MUA that screws up Bcc isn't likely to magically get it right because
they're implementing protected headers)

I'll make an edit to the header protection draft that simplifies the
text about Bcc, includes the reference you mention above, and otherwise
doesn't drag the draft into too much detail.

        --dkg