Subject: [Acme] Remove "contact channel" from threat model?

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 17 Aug 2016 17:07:40 -0700

Our Threat Model section includes a "Contact channel," but with the
removal of recovery options, the spec no longer has anything to say
about what gets sent to contacts. I think we should probably remove it
from the threat model. Any thoughts?

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Thu, 18 Aug 2016 13:53:26 -0700

Here's a PR removing the contact channel from the threat model:

https://github.com/ietf-wg-acme/acme/pull/174

On 08/17/2016 05:07 PM, Jacob Hoffman-Andrews wrote:
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Richard Barnes <[email-masked]>
Date: Fri, 19 Aug 2016 12:36:20 -0400

I hesitate to remove it.  I agree that since we removed contact-based
recovery, it's less central, but since the "contact" field is still there,
CAs will need to consider the risks if they ever use it.