Subject: [VCARDDAV] vcards and privacy

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 21 Apr 2011 10:09:57 -0600

<hat type='individual'/>

The security considerations section of the base spec doesn't mention
that certain information might be useful to potential attackers in real
life.

For example, a combination of BDAY (draft-ietf-vcarddav-vcardrev) and
BIRTHPLACE (draft-li-vcarddav-vcard-id-property-extensions) and some
possible future extensions like MOTHERSMAIDENNAME and FIRSTPET and so on
could be used to construct a fairly useful profile for the purpose of
identity theft or unauthorized access to user accounts.

As another example, ADR properties and GEO properties / params might
contain detailed location information about an individual. Perhaps it
might be helpful to check RFC 3693 for similar considerations.

Do folks here think we need to say anything about such issues?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 21 Apr 2011 18:07:57 +0100

>Do folks here think we need to say anything about such issues?
Sure. Do you want to suggest some text ;-)?

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 21 Apr 2011 12:41:52 -0600

> Sure. Do you want to suggest some text ;-)?

I will, but first I want to see if people care. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Barry Leiba <[email-masked]>
Date: Fri, 22 Apr 2011 12:09:29 -0400

> I will, but first I want to see if people care. :)

I, for one, don't much care.  I don't object to the inclusion of that,
but consider that the whole purpose of vCard is to provide a way to
disseminate personal information.  So it's all quite obvious.

But, as I say, if someone proposes some text, I'm fine with including it.

Barry

---

From: Barry Leiba <[email-masked]>
Date: Fri, 22 Apr 2011 12:10:14 -0400

> disseminate personal information.  So it's all quite obvious.

Adding: I actually did consider this also, in my vCardrev review, and
decided not to say anything.

Barry

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 22 Apr 2011 10:12:05 -0600

> But, as I say, if someone proposes some text, I'm fine with including it.

I suppose you're right that it's close to obvious. Further, the task of
wordsmithing the text might devolve into bikshedding. So I'll leave it
alone.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Cyrus Daboo <[email-masked]>
Date: Fri, 22 Apr 2011 12:38:47 -0400

Hi Barry,

> But, as I say, if someone proposes some text, I'm fine with including it.

+1

-- 
Cyrus Daboo