Am 12.03.20 um 19:51 schrieb Salz, Rich:
> This mail begins a one-week working group last call on
> https://datatracker.ietf.org/doc/draft-ietf-acme-email-smime/?include_text=1
(hopefully not to late ...)
Hello @all,
I became aware of a privacy problem once an ACME instance will implement this
draft: CT logs.
Usually the space of local parts for a domains email addresses is private.
Enumeration is impossible and unwanted.
But CT logs change some assumptions people may have...
On the other side the problem isn't really new.
Similar applies to the hosts available inside a domain.
Similar applies to DNSSEC signed domains. But at least there is an option to
make a zone-walk harder: NSEC3
Is this at least a point to be mentioned in the drafts security section?
Andreas
_______________________________________________
Acme mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/acme
