Subject: The subject line leakage problem

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 17 Dec 2001 10:34:39 -0800

All,

	One of the ongoing problems with people using PGP is that people put
confidential information in the mail subject lines, eg:

Subject: Proposed purchase of Excite@Home
Subject: Your STD test results
Subject: Planned head count reduction

	etc.

So over the years there have been plenty of fixes involving CMS encrypted
attributes etc. which gets into the rat hole of what other headers to add
in.

So instead of that how about the following fix:

1) A Best Current Practice Draft that says
2) Clients SHOULD offer users the option of replacing the subject line on
confidential messages and carrying the subject as the first line in the body
of the message.

So the above message would become

Subject: Confidential
Subject: Confidential
Subject: Confidential

And when opened we get something like:

Subject: Confidential

Subject: Proposed purchase of Excite@Home

Alice, 
	Yadda Yadda Yadda ....

	So, no need for any modification of existing specs, complete
backwards interop and the bug in the spec gets fixed.

		Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 17 Dec 2001 13:07:36 -0800

At 10:34 AM -0800 12/17/01, Hallam-Baker, Phillip wrote:
>	One of the ongoing problems with people using PGP

Or S/MIME, which is the topic of this mailing list :-)

>  is that people put

Just to be clear: you are talking about leaking headers in 
*encrypted* messages, not signed messages, I assume.

>confidential messages and carrying the subject as the first line in the body

A few thoughts:

1) That only covers the subject; you might want to cover other 
headers that have valuable information.

2) That prevents the headers from being automatically processed.

Instead, how about encouraging the use of multipart/mixed which 
starts with text/rfc822-headers. Any headers in that first part are 
to replace the same headers on display only.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Cyrus Daboo <[email-masked]>
Date: Mon, 17 Dec 2001 17:56:30 -0500

--On Monday, December 17, 2001 1:07 PM -0800 "Paul Hoffman / IMC" 
<[email-masked]> wrote:

> Instead, how about encouraging the use of multipart/mixed which starts
> with text/rfc822-headers. Any headers in that first part are to replace
> the same headers on display only.

I think a better solution is to encapsulate the original message as a 
message/rfc822 part within an outer message, whose headers can be arbitrary 
(within the bounds of rfc2822). Then the recommendation would be for 
clients to present the embedded message/rfc822 part as the 'real' message 
to the user when the message/rfc822 is at the top-level of the MIME 
structure. This also has the advantage that it makes it easier to store the 
original message (header and content), throwing away the outer header, if 
needed, without having to 'reconstruct' it from the multipart/mixed, 
text/rfc822-headers .... construct you suggest.

-- 
Cyrus Daboo