Structured Email: Trust and security considerations

Introduction Structured email aims to make the content of email messages machine-readable, such that algorithms can help users deal more efficiently with their email. Accordingly, special considerations with respect to security and trust of structured data in emails should apply for such algorithms.

Conventions Used in This Document The terms "message" and "email message" refer to "electronic mail messages" or "emails" as specified in . The term "Message User Agent" (MUA) denotes an email client application as per . The terms "machine-readable data" and "structured data" are used in contrast to "human-readable" messages and denote information expressed "in a structured format (..) which can be consumed by another program using consistent processing logic" . The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Types of security concerns This section discusses security and privacy concerns that may be raised when introducing structured data into email messages.

Formal representation of data Structured email aims to provide a machine-readable version of email content. Hence, the machine-readable information typically won't go beyond what is communicated in the human-readable part of email messages. Accordingly, the major difference is the formal nature of the data, which makes it easier to extract and process. Certain forms of formal data are however already common today, such as (flight) reservation data encoded using barcode or the PKPASS format.

Automated processing Structured data in email messages might users want to create certain automated processing chains. For example, a user might want flight reservations to be automatically added to a travel itinerary application. Such automation could be a custom feature of their MUA or a future extension of the Sieve email filtering language . A related example for abuse in automated processing is calendar spam ().

External references Emails with a text/html body part ("HTML emails"), may contain image resources that link to web servers. Such links can be used for tracking user interaction with their MUA. Similar concerns would apply to structured data types which include image references, such as the cover image of a music album or the teaser image of a news article. In addition, RDF structured data might be impartial by design and include mere references for additional data. Using a "follow your nose" approach, tools can try following URL references to obtain further structured data concerning a resource. For example, a piece of structured data about a news article could opt to reference the article's authors only by URL. For a meaningful processing of author information, one might try to obtain further data using that URL.

Content encryption mechanisms

Trust mechanisms

Trusted senders For the case of displaying remote images embedded in HTML emails, MUAs often allow users to manually choose if they trust a certain sender. In addition, such trusted senders may be added to the MUAs address book or a special list therein. Besides mentions in related use cases (/) this mechanism is currently not standardized.

Sender signatures

Domain signatures

Transaction identifiers Part of the simplicity of email is the fact that just the email address is required to reach out to a recipient. This however puts burden on the recipient to discern if a message is legitimate or abusive. Recipient-generated transaction identifiers aim to pass a certain secret to the sender, which helps to prove legitimacy. One such approach are one-time email aliases, which are generated for a single transaction or series of transactions. Structured email by itself might also help define special types of structured data that could help to manage and communicate transaction identifiers more easily. Open issues * Message id?

Categories of use cases Certain types of structured data might need to be kept more secure than others. For instance, the structured data representation of a music album shared by a friend would not contain major personal information, while e.g., medical records or financial statements certainly would.

Implementation guidelines

Processing structured data MUAs SHOULD consider structured data in incoming email messages only if: * The sender is trusted (e.g., part of the user's address book) and the messsage either contains a valid personal or domain signature * The message is part of an ongoing thread with a trusted sender If none of those criteria is fulfilled, MUAs should fallback to alternative presentations (e.g., "text/html" or "text/plain" of such message). Open isues * Github

Inlining data Strucutured data included in an email message should be self-contained. This means that a MUA should be able to provide meaningful user interaction also without loading additional referenced resources from the web. Open issues * Github

Implementation status < RFC Editor: before publication please remove this section and the reference to > This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in . The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist. According to , "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit".

Structured Email plugin for Roundcube Webmail The plugin will currently use the "trusted sender" feature of Roundcube to determine if structured data should be processed.

Security considerations Security considerations are core subject of this document itself.

Privacy considerations Privacy considerations are core subject of this document itself.

IANA Considerations This document has no IANA actions at this time.