Subject: [hrpc] MEDUP: New non-WG mailing list to fix privacy/usability issues (in, e.g., email, XMPP)

From: Hernâni Marques (p≡p foundation) <[email-masked]>
Date: Fri, 1 Feb 2019 18:49:07 +0100

Dear HRPC folks

I just want to inform you that Alexey (area director ART, CC) kindly
created us a mailing list, which explicitly mentions HRPC work with RFC
8280 as a guiding document (by some of its principles) to achieve
privacy in a usable, interoperable and decentralized manner (e.g., for
email & XMPP):

Sign up here:

https://www.ietf.org/mailman/admin/medup/members/list

MEDUP = {Missing Elements for Decentralized and Usable Privacy}

Description:

"This list is for discussions of enhancements to application protocols
for usable privacy.

RFC 8280 has identified and documented important principles in such as
Data Minimization, End-to-End and Interoperability in order to enable
access to Human Rights. While (partial) implementations of these
concepts are already available, today's applications widely lack Privacy
support that ordinary users can easily handle.

In MEDUP these issues are addressed based on Opportunistic Security (RFC
7435) principles. Updates/usage clarifications to application level
protocols such as email and XMPP are in scope."

As soon as some more people are subscribed, Bernie & me will bring up
some discussions on pretty Easy privacy (pEp) drafts, where also
(increasingly) practical software already exists and which is designed
and implemented along the lines described above, even thought we might
be missing elements or need to change some of them in order to better
meet the principles we strive for.

By that, the list is of course open to contributions of other projects
with similar goals, which -- discussing with each other -- can find the
best solutions in protocols and formats to meet important HRPC
principles for usable privacy. That's also the reason why the list name,
spelled out, is immediately descriptive. :)

Greets & nice WE!

Hernani

-- 
p≡p foundation: https://pep.foundation/

---

From: Hernâni Marques (p≡p foundation) <[email-masked]>
Date: Fri, 1 Feb 2019 18:55:07 +0100

> https://www.ietf.org/mailman/admin/medup/members/list

Oups, wrong link (too many tabs, sorry xD):

https://www.ietf.org/mailman/listinfo/medup

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 5 Feb 2019 14:35:10 +0100 (CET)

Hello Hernani,

I think that easy end-to-end email encryption is overdue and I welcome any effort to get there. However, now speaking as a major email server software vendor, I would like to understand better the scope of this initiative; the charter says that updating "application level protocols such as email" (which by the way is not clear in itself, since there is no "email" protocol but there are several) is in the scope of this mailing list, which however is not an IETF working group (is it expected to lead to one?).

Now, if you want to update IMAP, there's already an IETF WG (EXTRA) that does that, not to mention the JMAP WG if you prefer JMAP. There's nothing for SMTP as far as I know, but even in that case I am sure there would be many other parties that would need to join such a discussion, and they are definitely not on HRPC. Also, the IRTF already has PEARG for more speculative discussion, and its charter includes these matters.

Bottom line: I am happily joining the mailing list, but I would like to understand what's the plan, and how this differs from all these other efforts up to the point of requiring yet another mailing list that I have to subscribe to :-)

Ciao,

>     Il 1 febbraio 2019 alle 18.49 "Hernâni Marques (p≡p foundation)" < [email-masked] mailto:[email-masked] > ha scritto:
> 
> 
>     Dear HRPC folks
> 
>     _______________________________________________
>     hrpc mailing list
>     [email-masked] mailto:[email-masked]
>     https://www.irtf.org/mailman/listinfo/hrpc
> 

-- 
Vittorio Bertola
Head of Policy & Innovation

Cell: 	+39 348 7015022
Direct Chat: 	vittorio.bertola https://chat.open-xchange.com/direct/vittorio.bertola
Email: 	[email-masked] mailto:[email-masked]

Twitter: @openexchange http://twitter.com/openexchange - Facebook: OpenXchange https://www.facebook.com/OpenXchange - Web: www.open-xchange.com http://www.open-xchange.com
Open-Xchange AG, Hohenzollernring 72, 50672 Cologne, District Court Cologne HRB 95366
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin
Chairman of the Board: Richard Seibt

European Office:
Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718
Managing Director: Frank Hoberg

US Office:
Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA

Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.

---

From: "Bernie Hoeneisen (bernhard.hoeneisen AT ucom.ch)" <[email-masked]>
Date: Thu, 7 Feb 2019 21:14:06 +0100 (CET)

Dear Vittorio

> Hello Hernani,

As your questions are mainly related to IETF process, Hernani asked me to 
answer your email.

> I think that easy end-to-end email encryption is overdue and I welcome 
> any effort to get there. However, now speaking as a major email server 
> software vendor, I would like to understand better the scope of this 
> initiative; the charter says

I presume you are refering to the Maling list description (as there is 
no charter for MEDUP at this point in time).

> that updating "application level protocols such as email" (which by the 
> way is not clear in itself, since there is no "email" protocol but there 
> are several) is in the scope of this mailing list,

With respect to email MEDUP includes mainly RFC822 or rather its latest 
successor: https://tools.ietf.org/html/rfc5322

> which however is not an IETF working group (is it expected to lead to 
> one?).

We are working on a BoF proposal with the intention to form an IETF 
Working Group.

> Now, if you want to update IMAP, there's already an IETF WG (EXTRA) that 
> does that, not to mention the JMAP WG if you prefer JMAP.

MEDUP is not specific to IMAP.

> There's nothing for SMTP as far as I know,

MEDUP is not specific to SMTP either.

> but even in that case I am sure there would be many other parties that 
> would need to join such a discussion, and they are definitely not on 
> HRPC.

Feel free to inform other parties about this mailing list as you deem 
useful.

> Also, the IRTF already has PEARG for more speculative discussion, 
> and its charter includes these matters.

The PEARG list has been informed already.

> Bottom line: I am happily joining the mailing list, but I would like to 
> understand what's the plan, and how this differs from all these other 
> efforts up to the point of requiring yet another mailing list that I 
> have to subscribe to :-)

Please find more information on:
- https://mailarchive.ietf.org/arch/msg/medup/mbrbhFekt_srXShzpCa4RiXgPbY
- https://mailarchive.ietf.org/arch/msg/pearg/oBjgAwG3_eoR6tpLQGTE_9OggzQ
The former also includes a list of Internet-Drafts describing the MEDUP 
challenges.

You may also want to visit https://pep.foundation to find more 
information on the topic.

Hope that helps!

cheers,
  Bernie