| Internet-Draft | Structured Email: Trust and security con | October 2023 |
| Happel | Expires 25 April 2024 | [Page] |
This document discusses trust and security considerations for "structured email" ([I-D.happel-structured-email-00]) and provides recommendations for message user agents on how to deal with structured data in email messages.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 25 April 2024.¶
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Structured email aims to make the content of email messages machine-readable, such that algorithms can help users deal more efficiently with their email.¶
Accordingly, special considerations with respect to security and trust of structured data in emails should apply for such algorithms.¶
The terms "message" and "email message" refer to "electronic mail messages" or "emails" as specified in [RFC5322]. The term "Message User Agent" (MUA) denotes an email client application as per [RFC5598].¶
The terms "machine-readable data" and "structured data" are used in contrast to "human-readable" messages and denote information expressed "in a structured format (..) which can be consumed by another program using consistent processing logic" [MachineReadable].¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This section discusses security and privacy concerns that may be raised when introducing structured data into email messages.¶
Structured email aims to provide a machine-readable version of email content. Hence, the machine-readable information typically won't go beyond what is communicated in the human-readable part of email messages.¶
Accordingly, the major difference is the formal nature of the data, which makes it easier to extract and process. Certain forms of formal data are however already common today, such as (flight) reservation data encoded using barcode or the PKPASS format.¶
Structured data in email messages might users want to create certain automated processing chains. For example, a user might want flight reservations to be automatically added to a travel itinerary application.¶
Such automation could be a custom feature of their MUA or a future extension of the Sieve email filtering language [RFC5228]. A related example for abuse in automated processing is calendar spam ([CalSpam]).¶
Emails with a text/html body part ("HTML emails"), may contain image resources that link to web servers. Such links can be used for tracking user interaction with their MUA.¶
Similar concerns would apply to structured data types which include image references, such as the cover image of a music album or the teaser image of a news article.¶
In addition, RDF structured data might be impartial by design and include mere references for additional data. Using a "follow your nose" approach, tools can try following URL references to obtain further structured data concerning a resource.¶
For example, a piece of structured data about a news article could opt to reference the article's authors only by URL. For a meaningful processing of author information, one might try to obtain further data using that URL.¶
For the case of displaying remote images embedded in HTML emails, MUAs often allow users to manually choose if they trust a certain sender.¶
In addition, such trusted senders may be added to the MUAs address book or a special list therein.¶
Besides mentions in related use cases ([RFC6132]/[RFC6134]) this mechanism is currently not standardized.¶
Part of the simplicity of email is the fact that just the email address is required to reach out to a recipient. This however puts burden on the recipient to discern if a message is legitimate or abusive.¶
Recipient-generated transaction identifiers aim to pass a certain secret to the sender, which helps to prove legitimacy.¶
One such approach are one-time email aliases, which are generated for a single transaction or series of transactions.¶
Structured email by itself might also help define special types of structured data that could help to manage and communicate transaction identifiers more easily.¶
Open issues * Message id?¶
Certain types of structured data might need to be kept more secure than others. For instance, the structured data representation of a music album shared by a friend would not contain major personal information, while e.g., medical records or financial statements certainly would.¶
MUAs SHOULD consider structured data in incoming email messages only if: * The sender is trusted (e.g., part of the user's address book) and the messsage either contains a valid personal or domain signature * The message is part of an ongoing thread with a trusted sender¶
If none of those criteria is fulfilled, MUAs should fallback to alternative presentations (e.g., "text/html" or "text/plain" of such message).¶
Open isues * Github¶
Strucutured data included in an email message should be self-contained. This means that a MUA should be able to provide meaningful user interaction also without loading additional referenced resources from the web.¶
Open issues * Github¶
< RFC Editor: before publication please remove this section and the reference to [RFC7942] >¶
This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in [RFC7942]. The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist.¶
According to [RFC7942], "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit".¶
The plugin will currently use the "trusted sender" feature of Roundcube to determine if structured data should be processed.¶
Security considerations are core subject of this document itself.¶
Privacy considerations are core subject of this document itself.¶
This document has no IANA actions at this time.¶