Hi Cyrus,
On 2009-10-13 17:16, Cyrus Daboo wrote:
> Hi Brian,
> Thank you for your review. Sorry I have been busy on other subjects
> these last few weeks and am only now getting around to replying.
>
> --On September 21, 2009 10:34:33 AM +1200 Brian E Carpenter
> <[email protected]> wrote:
>
>> Major issues:
>> -------------
>>
>> I would have liked to see a bit more emphasis on privacy issues in the
>> Security Considerations. In particular, shouldn't there be a fairly
>> strong SHOULD obligation on clients to implement TLS and use it by
>> default? The way the text is written, a client running with no TLS and no
>> HTTP Basic authentication appears to be allowed.
>
> There are cases where public address books (or a public address service)
> can be used, and there is no absolute requirement that TLS be used in
> such cases (or maybe the IESG has a requirement that no plain text
> whatsoever can be sent in any protocol).
>
> That said I would be OK with adding the following to the end of the
> first paragraph in Security Considerations:
>
> Clients SHOULD use TLS whenever possible.
>
> Is that sufficient?
I would be happy with that; it's probably something to be checked with
the WG since it's a change in normative requirements.
>
>> On the same lines,
>>
>> Clients MAY choose to warn users when they create address data in a
>> public address book, copy or move address data into public address
>> books, or change access privileges in such a way as to expose address
>> data to unauthenticated users.
>>
>> Why isn't that a SHOULD?
>
> I am a little nervous about putting such a requirement on a client.
> First of all, what does it really mean to "warn" a user? An alert, an
> icon, a noise? Does it happen only the first time they do an action, or
> each time? SHOULD seems a little strong when the nature of the warning
> is really going to be implementation dependent.
>
> That said, if there is consensus for this change, it may be necessary to
> explain a little more what "warn" means.
Yes, that is a problem. I'm not a privacy expert, but it does seem like
something that could one day end up as bad news. ("XYZ Corporation revealed
private data for 27,000 customers, FCC investigation alleges. We just
followed the IETF standard, says XYZ spokesman.") I think it needs a
little thought.
Thanks
Brian
_______________________________________________
Gen-art mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/gen-art
