Subject: [Tzdist] Security Considerations: Is TLS security sufficient

From: Daniel Migault <[email-masked]>
Date: Thu, 21 Aug 2014 17:52:54 +0200

Hi,

The draft mentions that security is provided by TLS. This model is fine as
long as I trust the server I am connected to. However, if we consider the
root provider as legitimate (IANA for example), a TLS communication would
provide integrity check. On the other hand, we have no mean to check that
the alternate providers have not alterate/modified the time zone data.

Wouldn't it be more appropriated to have integrity check mechanisms within
the data.

The charter mentions

  - The time zone data will be based on the Time Zone Database
  (http://www.iana.org/time-zones) but must be able to include any source
  of time zone data.

So working on the data format seems out of scope. However if a secure data
format may be designed in the future. TLS will not be needed for integrity
protection. but only for confidentiality or privacy issues. Similarly to
DNS, it would make sense to have both secure or unsecured transport layer
depending on your goals.

-- 
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58

---

From: Cyrus Daboo <[email-masked]>
Date: Thu, 21 Aug 2014 12:56:41 -0400

Hi Daniel,

> DNS, it would make sense to have both secure or unsecured transport layer

Whilst that is true from a security standpoint, there is also the aspect of 
privacy - sending requests in the clear can expose personal details. In 
particular, it might be possible to track a person's whereabouts (in very 
broad terms) by seeing what time zones their device is asking for (assuming 
a device that refreshes time zones when it detects it has moved to a 
different region). It can also expose who a user might be scheduling with 
(again in a broad "regional" sense), assuming a calendar client refreshes 
time zone data for active calendar events.

Of course, such tracking using time zones would be very broad in scope, and 
there are far more precise ways to do the same, so we may decide that is 
not a big issue (or at the very least make the privacy concerns of not 
using SSL very clear).

-- 
Cyrus Daboo