Subject: [http-auth] Fwd: Privacy considerations

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 18 Jul 2014 21:37:39 -0400

Hello,

As an FYI, If drafts raise privacy concerns, we need to work on including
those in the Security considerations section.  It will get added before
publication, so we should address this concern in drafts within each WG (if
relevant).  If drafts have a lot of ground to cover, it may require it's
own section.

I read through
https://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update and
think you can add a few sentences to address this as it fits in with the
existing discussion in that section.

Here is some proposed text with examples, please feel free to come up with
better examples or a variant on the text.  I just care that the points are
addressed.

Security Considerations, suggest adding the following at the end of
paragraph 5:
This raises both security and privacy concerns [RFC6973].  If the same
username and password combination is in use to access email accounts or an
account on a health portal, personal information could be exposed.

As for the digest draft, that also discourages it's use as not being a
secure method of authentication, but does say it's stronger than basic
authentication.  As a result, similar concerns should be mentioned in terms
of privacy in this draft as well.

Both drafts already cover the protection of the session in terms of
exposing data and the lack of confidentiality protections, so that should
cover privacy as well (IMO).  If the WG wanted to add text or explicitly
use the terms privacy related information or personal information, that
would not be a bad idea.  In the digest draft, sect 5.2 might be the right
place as it already covers confidentiality concerns with the possible
exposure of information.

Thanks.
-- 

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Julian Reschke <[email-masked]>
Date: Sun, 20 Jul 2014 10:00:35 +0200

On 2014-07-19 03:37, Kathleen Moriarty wrote:
> ...
> username and password combination is in use to access email accounts or
> an account on a health portal, personal information could be exposed.
> ...

Thanks! -> <http://trac.tools.ietf.org/wg/httpauth/trac/changeset/73>

Best regards, Julian

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 20 Jul 2014 09:15:55 -0400

Thanks, Julian!

Looking at this with fresh eyes, could you adjust the last sentence to make
it clear that those are just possible examples and not the full set of
possibilities.  Perhaps the following:

If the same
username and password combination is in use to access other accounts, such
as an email or health portal account, personal information could be exposed.

-- 

Best regards,
Kathleen

---

From: Julian Reschke <[email-masked]>
Date: Mon, 21 Jul 2014 15:17:22 +0200

On 2014-07-20 15:15, Kathleen Moriarty wrote:
> Thanks, Julian!
>
> Looking at this with fresh eyes, could you adjust the last sentence to
> make it clear that those are just possible examples and not the full set
> of possibilities.  Perhaps the following:
>
> If the same
> username and password combination is in use to access other accounts,
> such as an email or health portal account, personal information could be
> exposed.

Sure. <http://trac.tools.ietf.org/wg/httpauth/trac/changeset/74>.

Best regards, Julian

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 21 Jul 2014 09:18:29 -0400

Thank you, that closes out my comments.

-- 

Best regards,
Kathleen