Subject: [Uta] Alissa Cooper's No Objection on draft-ietf-uta-smtp-require-tls-07: (with COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Thu, 21 Feb 2019 06:07:26 -0800

Alissa Cooper has entered the following ballot position for
draft-ietf-uta-smtp-require-tls-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-uta-smtp-require-tls/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I support Benjamin's first three DISCUSS points.

I feel like there are some fairly significant UI implications of adding this
option to the mix of other tools for transport-level encryption support, given
that this is supposed to operate on a message-by-message basis. Can you explain
how this is expected to work? I have this concern generally but also in
relation to this:

"REQUIRETLS users SHOULD be made aware
   of this limitation so that they use caution when sending to mailing
   lists and do not assume that REQUIRETLS applies to messages from the
   list operator to list members."

I can't figure out how this requirement is expected to be met in practice.

---

From: Jim Fenton <[email-masked]>
Date: Tue, 26 Feb 2019 12:16:04 -0800

With respect to the UI implications, there are several ways that I can
picture REQUIRETLS being invoked. The most likely is that the MUA would
have a ruleset of domains or addresses for which REQUIRETLS should be
specified when submitting the message. These would be domains that the
user has some reason to expect REQUIRETLS to work. For example, a
traveling reporter or dissident might want REQUIRETLS when sending
messages to their own organization, so that their mail would not be
subject to MITM if they're in a place where that is done (Tunisia seems
to be the classic example). Another way to do this might be to add a
button to the UI to cause the message to be sent with REQUIRETLS, but
this of course increases complexity and requires that the user
understand the difference between end-to-end message body encryption and
per-hop transport encryption.

Ben Campbell also pointed out the sentence regarding mailing lists. This
awareness should be achieved through education (people need some
explanation to understand how to use REQUIRETLS). The normative SHOULD
probably should be in lowercase.