Subject: e-mail password reminders discontinued

From: IETF Chair <[email-masked]>
Date: Mon, 18 May 2015 22:45:50 +0300

As you know, the IETF uses the Mailman package to manage our
mailing lists. One of the features of Mailman is that it generates a
password reminder once a month and sends it to every email 
address in the system. This email is to advise you that we had to 
discontinue the mailman password reminders.

We have had an earlier discussion about this, and there were a few
people who wanted to see the reminders continue, and at that point
we turned them back on. They were causing operational difficulties,
however, which have led us to disable them again. We also hoped
that we would be able to make the setting a per-subscriber option.
However, this turned out to not be possible in Mailman. I apologize
for any inconvenience that this may cause.

The Mailman passwords are emailed in plain text, which is
generally considered a poor practice from a security standpoint.
In addition, each month when tens of thousands of reminder emails
are distributed, one or more ISPs temporarily block or rate-limit
email traffic coming from the IETF mail servers in response to the
mass mailing of these reminders.  

Users can still receive their passwords from the system on request
by visiting the information page of any subscribed list. Visit 
https://www.ietf.org/mailman/options/<list name>, enter your email
address, and click remind.

Let us know if we can do something to improve your mailing list
experience, be it about password reminders or other things.

Jari Arkko, IETF Chair

---

From: Randy Bush <[email-masked]>
Date: Mon, 18 May 2015 10:11:31 -1000

> This email is to advise you that we had to discontinue the mailman
> password reminders.

thank you

randy

---

From: "Niels Dettenbach (Syndicat IT & Internet)" <[email-masked]>
Date: Tue, 19 May 2015 09:06:45 +0200

Am 18. Mai 2015 21:45:50 MESZ, schrieb IETF Chair <[email-masked]>:
>However, this turned out to not be possible in Mailman.
This is correct, but from a pure technical viewpoint this will be easier to solve with the new version of mailman 3 (which is a groundbreaking rewrite of mailman) and much more transparent to extend or modify in functionality if "required".

But the new mailman version is still - compared to the technical step behind - very "new" / young - so it may take still some time to find most mailman installations out there migrated to the new mailman.

btw: From my (very) personal view i did not require any password reminders from mailing lists...

hth a bit,
cheerioh,

Niels.
-- 
Niels Dettenbach
Syndicat IT & Internet
http://www.syndicat.com

---

From: Tony Finch <[email-masked]>
Date: Tue, 19 May 2015 10:04:23 +0100

Niels Dettenbach (Syndicat IT & Internet) <[email-masked]> wrote:
> >We also hoped that we would be able to make the setting a
> >per-subscriber option. However, this turned out to not be possible in
> >Mailman.

> This is correct, but from a pure technical viewpoint this will be easier
> to solve with the new version of mailman 3 (which is a groundbreaking
> rewrite of mailman) and much more transparent to extend or modify in
> functionality if "required".

Mailman 3 cannot do password reminders at all - it doesn't store
passwords in cleartext.  Hooray! at long last.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Trafalgar: Northerly 5 to 7, occasionally gale 8. Rough or very rough. Mainly
fair. Good.

---

From: IETF Chair <[email-masked]>
Date: Tue, 19 May 2015 12:48:13 +0300

Niels,

> But the new mailman version is still - compared to the technical step behind - very "new" / young - so it may take still some time to find most mailman installations out there migrated to the new m…

Thanks for the update! Perhaps we can consider this at some point.

Jari

---

From: tom petch <[email-masked]>
Date: Tue, 19 May 2015 15:33:16 +0100

----- Original Message ----- 
From: "IETF Chair" <[email-masked]>
To: "IETF Announcement List" <[email-masked]>
Cc: "IETF" <[email-masked]>
Sent: Monday, May 18, 2015 8:45 PM
Subject: e-mail password reminders discontinued

> experience, be it about password reminders or other things.

It's a shame.  The value of the reminder was not the password, but a 
confirmation that I was still subscribed to the lists that I thought that I 
was subscribed to, and had not been unsubscribed due to some dark art of the 
mailing list processes - which has happened to me on more than one occasion.

Tom Petch

---

From: Paul Wouters <[email-masked]>
Date: Tue, 19 May 2015 10:51:34 -0400 (EDT)

> mailing list processes - which has happened to me on more than one occasion.

You remember which mailing lists you are on from the top of your head,
and then notice when you NOT get an email from that list on the 1st?

Your brain is clearly superior to mine :)

Paul

---

From: Dave Aronson <[email-masked]>
Date: Tue, 19 May 2015 11:13:21 -0400

> mailing list processes - which has happened to me on more than one occasion.

https://www.ietf.org/mailman/options/ietf includes an option labeled
"Get password reminder email for this list?".  So, it looks like the
admins have not fully disabled it.  Have you tried enabling that as an
individual?  Maybe they've disabled the cron job that actually does
the sending, though, or some other admin method that doesn't remove
the interface.

Alternately, perhaps the list management software could send a simple
heartbeat instead.  AFAIK mailman doesn't have such a feature, but you
could send in a patch and see if the project will accept it....

-Dave

-- 
Dave Aronson, consulting software developer of Codosaur.us,
PullRequestRoulette.com, Blog.Codosaur.us, and Dare2XL.com.

---

From: John Kristoff <[email-masked]>
Date: Tue, 19 May 2015 10:14:26 -0500

On Tue, 19 May 2015 15:33:16 +0100

> mailing list processes - which has happened to me on more than one occasion.

I once worked alongside a team that found themselves supporting a
particularly unreliable system.  For a reason that I've now forgotten,
this team decided to create a test to verify the system was still
responsive and send out an alert via a paging system if it was still
operational.  This was run every hour, twenty-four hours a day.

I thought this was a ridiculous situation and when I conveyed what was
going on to a witty friend, this friend equated it to how one might
use the emergency system (911 in the U.S.).  "So... I should call 911
every hour and say to them, 'I'm OK, just letting you know.  If you
don't hear back from me in an hour please send help!'".

I can't help but think the use of a mailing list password reminder is in
a way similar to my exaggerated example.  As another colleague once
told me, don't look at it as a "backup" problem, look at it as a
"restore" problem and your whole perspective, and likely your solution
changes to better address the challenge you're faced with.  There
may be another, perhaps better way to solve this particular
problem.  :-)

John

---

From: Huub van Helvoort <[email-masked]>
Date: Tue, 19 May 2015 17:50:23 +0200

> operational.  This was run every hour, twenty-four hours a day.

This is still applicable to mobile phones.
I see zillions of people turning on their mobile every five minutes
or so, just to check that is is still working...

> may be another, perhaps better way to solve this particular

Why not send only a list reminder, without the password.
And for each list a link to the listinfo page where one
can unsubscribe or retrieve the password if necessary.

Regards, Huub.

-- 
*****************************************************************
               请记住，你是独一无二的，就像其他每一个人一样

---

From: David Morris <[email-masked]>
Date: Tue, 19 May 2015 10:55:43 -0700 (PDT)

> can unsubscribe or retrieve the password if necessary.

I am one of the folks who appreciates a monthy subscription
reminder. As they all arrive at about the same time, I get
an inventory of my subscriptions AND can review for missing
subscriptions as well as subscriptions that don't apply.

I never needed and never wanted the password reminder part
of the email. It was a stupid security breach. But many
of my lists, not managed by mailman, send subscription
reminders each month.

---

From: Nico Williams <[email-masked]>
Date: Tue, 19 May 2015 13:30:08 -0500

> generally considered a poor practice from a security standpoint.

These are low-value secrets.  It doesn't matter if they go over e-mail
in cleartext.

What really matters though is that users be able to access the features
that these passwords have enabled thus far:

 - unsubscribing

 - changing one's subscribed address
   (this is incredibly useful, since mailman allows mass-changing the
   subscribed address, so if one is subscribed to 50 IETF lists and one
   needs to change the subscribed address, a single change will suffice
   for all, instead of having to do 50 manual changes)

 - accessing moderation and other manager features (for list
   owners/moderators)

These operations can't be made much harder than they are now.  I, and I
suspect most everyone else, WILL NOT keep a password database for these
passwords, and we won't memorize them either.

I'm not opposed to not e-mailing these passwords periodically, or even
not e-mailing them at all, as long as there's a way to access the above
features without having to memorize these silly passwords.  Forcing
users to go through a password reset every time will do, but note that
that's pretty much the same thing as... sending passwords in cleartext
in e-mail!

The one security-relevant difference between e-mail list password reset
and e-mail list password reminders is that password reset tokens
generally expire.  Both are utterly low-value, neither requires
cryptographic protection.

If all you're doing is no longer mailing these _periodically_, then
that's OK, and if it helps operationally, so much the better.  But
please don't bill this as a great security improvement -- it's not.

Nico
--

---

From: Jari Arkko <[email-masked]>
Date: Wed, 20 May 2015 14:46:34 +0300

FYI, here is a bit more detail regarding the issues we encountered:

The main issue:

> What we discovered is that it's not possible, in Mailman, to turn this off for everyone whilst still allowing individuals to selectively turn it back on.  We had thought that was the case initially, but it turned out Mailman doesn't behave that way.  This is why we're back in this position now.

History of events:

> 1. There was a discussion and decision to move the default to “do not send”
>  
> 2. The change was implemented, and we assumed that people can edit their settings
> 
> We turned the "send reminders" but to "off" for every individual subscriber.  They were able to turn them on again through the Mailman admin interface.  We also changed a Mailman setting that was supposed to make this the default for new subscriptions to new or existing lists.
> 
> We found out that the default setting did not work, which is to say that new subscriptions to lists were enabled for password reminders by default.
> 
> 3. Some months later, in 2014, another setting was changed but accidentally caused the reminders to not be sent despite settings otherwise
> 
> The setting was supposed to turn the password reminder default to off by list.  This was thought to turn off the default option, but still allow users to turn them on. What actually happened is that this turned the password reminders for every member of that list, regardless of their individual option.
> 
> 4. The setting was reverted
> 
> We turned that bit back off on the lists, so that individuals who had opted for automatic reminders would get them again.
> 
> 5. Subscriber growth
> 
> In the meantime, while all of the above was transpiring, we were gathering new subscriptions to various lists.  When the reminders processed after the configuration change, tens of thousands of reminders were sent.
> 
> What we have discovered through this process is that there is a key element missing in Mailman, and that is the ability to make the "send password reminders" bit default to off for new subscriptions. The result of this is that if we go through and do a mass reset of those settings, we will still over time build up a very large group of automatic reminders, with all the concomitant issues that come from bulk mailing tens of thousands of reminders.  ISOC encountered the same issues and ended up turning off the automatic reminders.

---

From: Nico Williams <[email-masked]>
Date: Wed, 20 May 2015 10:58:25 -0500

On Wed, May 20, 2015 at 02:46:34PM +0300, Jari Arkko wrote:
> > What we discovered is that it's not possible, in Mailman, to turn
> > this off for everyone whilst still allowing individuals to
> > selectively turn it back on.  We had thought that was the case
> > initially, but it turned out Mailman doesn't behave that way.  This
> > is why we're back in this position now.
> 
> [...]

OK, but note this has nothing to do with security.

Also, the answer to my question is: on-demand password reminders (e.g.,
for changing subscription options) thankfully still works.

Nico
--

---

From: tom petch <[email-masked]>
Date: Thu, 21 May 2015 09:30:53 +0100

---- Original Message ----- 
From: "Paul Wouters" <[email-masked]>
To: "tom petch" <[email-masked]>
Cc: "IETF" <[email-masked]>
Sent: Tuesday, May 19, 2015 3:51 PM
 On Tue, 19 May 2015, tom petch wrote:
>> confirmation that I was still subscribed to the lists that I thought that 
>> I was subscribed to, and had not been unsubscribed due to some dark art 
>> of the mailing list processes - which has happened to me on more than one 
>> occasion.
>

I very much doubt that.

I keep the previous month's reminder e-mail so when a new one arrives, I 
open the old and the new in two separate panes and scroll down both. 
Comparing two lists for equality is within the scope of even a 'bear of 
little brain'.  This does of course rely on the mail server not rearranging 
the list to some supposedly superior sort order but, happily, the mail 
server is not tempted to do that.

Tom Petch

---

From: tom petch <[email-masked]>
Date: Thu, 21 May 2015 09:38:00 +0100

---- Original Message ----- 
From: "John Kristoff" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, May 19, 2015 4:14 PM
 On Tue, 19 May 2015 15:33:16 +0100
>> I

You might want to look at the use of application protocols that the IETF has 
developed, particularly those in the operational area, such as SNMP or 
Netconf, where you will find terms such as 'keepalive' or 'heartbeat' or 
synonyms thereof.  Strangely, the concept of saying
'I am OK just letting you know' and having the other end of the session 
respond likewise seems to be have found widespread use within the IETF.

Of course, when using IPX over a physical LAN, such considerations are 
mostly unnecessary but for the unreliable Internet, such protocols seem 
pervasive.

Tom Petch

---

From: tom petch <[email-masked]>
Date: Thu, 21 May 2015 17:52:43 +0100

Running on a backup computer, I get a certificate mismatch message when I 
try to access the datatracker using the link from the IESG page and a 
warning that I really should not proceed to this dangerous website.

Indeed, the website is datatracker.ietf.org and the certificate  *.iab.org

Has something changed, or is this just a configuration quirk (Internet 
Explorer) on my backup system?

Tom Petch

---

From: Yoav Nir <[email-masked]>
Date: Thu, 21 May 2015 20:17:06 +0300

> On May 21, 2015, at 7:52 PM, tom petch <[email-masked]> wrote:
> 
> Running on a backup computer, I get a certificate mismatch message when I try to access the datatracker using the link from the IESG page and a warning that I really should not proceed to this dangerous website.
> 
> Has something changed, or is this just a configuration quirk (Internet Explorer) on my backup system?
> 

Is your Internet Explorer old enough to not send SNI?

---

From: Yoav Nir <[email-masked]>
Date: Thu, 21 May 2015 20:18:52 +0300

> On May 21, 2015, at 8:17 PM, Yoav Nir <[email-masked]> wrote:
> 
> 

Which, according to Wikipedia, is equivalent to asking if your backup computer is running XP.

Yoav

---

From: tom petch <[email-masked]>
Date: Fri, 22 May 2015 09:26:00 +0100

----- Original Message ----- 
From: "Yoav Nir" <[email-masked]>
To: "tom petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, May 21, 2015 6:18 PM

> Is your Internet Explorer old enough to not send SNI?

Which, according to Wikipedia, is equivalent to asking if your backup 
computer is running XP.

<tp>

Yoav

Spot on.  I know SNI well but had not realised that it was  lacking from the 
tried and tested, trusty XP (which makes it a good choice for a backup 
system:-).

Tom Petch

Yoav

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 22 May 2015 10:29:22 +0200

Den 22. mai 2015 10:26, skrev tom petch:
> ----- Original Message ----- From: "Yoav Nir" <[email-masked]>
>>> Running on a backup computer, I get a certificate mismatch message
>>> when I try to access the datatracker using the link from the IESG
>>> page and a warning that I really should not proceed to this dangerous
>>> website.
>>>
> Spot on.  I know SNI well but had not realised that it was  lacking from
> the tried and tested, trusty XP (which makes it a good choice for a
> backup system:-).

Just install Chrome on the backup, and this issue will go away :-)

---

From: [email-masked] (Martin Rex)
Date: Fri, 22 May 2015 10:38:38 +0200 (CEST)

tom petch wrote:
> 
>> <[email-masked]> wrote:
>>

For the IETF web sites in question, this explanation is a pretty
lame excuse for the server-side failure to present a reasonable server
certificate.  It's not like the IAB and the datatracker are from
completely seperate competing secretive organtizations that the current
setup would be a vital requirement.

The obvious correct fix would be to obtain one single proper server
certificate that lists the all the necessary hostnames as "SubjectAltNames"
of type dnsName (see rfc2818 Section 3), and then interop would just work,
even for stuff that isn't (heart)bleeding edge technology.  At least 
in the past, interoperability was considered important in the IETF.

-Martin