Subject: Re: [lamps] HP Issue - Obfuscation of Header Fields

From: Jonathan Hammell <[email-masked]>
Date: Fri, 2 Oct 2020 14:43:16 -0400

I agree with only obfuscating the Subject and only when Encryption is
applied.  I also agree with Russ that it should be optional (at the
sender's discretion) since it does make managing email more difficult.
I prefer "[...]" versus "...".

I support recommending that a new Message-ID is generated if Subject
obfuscation is used.  However, I am curious if any MUAs use the
subject in support of message threading, resulting in unrelated
messages displayed as related.  From a simple test, Gmail does not;
but I believe that the IETF MailArchive might (likely in combination
with matching other HFs) because I have sent message list replies as a
new message with a Subject and Body extracted from the daily digest
and the tool surprisingly threaded it to the original message
correctly.  (A great bit of engineering work there!)

Jonathan

On Wed, Sep 30, 2020 at 5:22 PM Russ Housley <[email-masked]> wrote:
>
> The thing I recall is that we only want to obfuscate the Subject.  I recall someone suggested "Encrypted Message".  Also, the obfuscation should be at the senders discretion.
>
> Russ
>
>
> > On Sep 30, 2020, at 4:17 PM, Bernie Hoeneisen <[email-masked]> wrote:
> >
> > Below a summary of the issue on 'Obfuscation of Header Fields'. If anybody wishes to discuss this topic further or does not agree with the conclusion, please speek up within the next 10 days!
> >
> > cheers,
> > Bernie
> >
> >
> > Text from slide:
> > - Should we recommend any specific format for obfuscation?
> >  e.g.
> >  - Subject: ...
> >  - Subject: [...]
> >  - Date: Thu, 01 Jan 1970 00:00:00 +0000 (UTC)
> >    - Impact to certificate checking?
> >  - Date: <set to Monday 9am of the same week>
> >  - Message-ID: <a new randomly generated Message-ID>
> >  - From: Obfuscated <[email-masked]>
> >  - To: Obfuscated <[email-masked]>
> >
> > - Impact to Spam filtering?
> >
> >
> > Conclusion at IETF-108 (as I understood):
> >
> > - Only specify obfuscation if encryption is applied
> > - Only recommend obfuscation for the Subject HF, but not for
> >  Date HF, From HF, To HF
> >
> > We did not discuss about whether or not to recommend a new Message-ID for the Outer Message, as the Message-ID often leaves a trace to the originator host. Unless there are strong reasons not to do so, I'd be in favour of recommending a new randomly generated Messsage-ID. Any opinions on this?
> >
> > _______________________________________________
> > Spasm mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/spasm
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Bernie Hoeneisen <[email-masked]>
Date: Wed, 14 Oct 2020 00:25:37 +0200 (CEST)

The latest (not yet published) version regarding Obfuscation reads as 
follows:

   For further Data Minimization, the value of the Subject Header Field
   SHOULD be obfuscated as follows:

   ~~
   * Subject: [...]
   ~~

   and it is RECOMMENDED to replace the Message-ID by a new randomly
   generated Message-ID.

   In addition, the value of other Essential Header Fields MAY be
   obfuscated. Also further (non-Essential) Header Fields MAY be
   obfuscated, though simply not adding those to the Outer Message Header
   Section SHOULD be preferred over obfuscation. Header Fields not
   obfuscated should contain the same values as in the Original Message.

Any objections or suggestions to change this text?

cheers
  Bernie

--

http://ucom.ch/
Modern Telephony Solutions and Tech Consulting for Internet Technology