Subject: Personal Information in the IETF Datatracker

From: tom petch <[email-masked]>
Date: Wed, 26 Sep 2018 11:22:34 +0000

Mmmm

I got an e-mail with this subject line, from the IETF Secretariat, the
first in three years from them, saying that my personal information
would be deleted unless I gave consent to its ongoing use.  The sort of
e-mail used in phishing attacks.  I would have expected there to be some
announcement about this beforehand but ....

(I did get an e-mail about GPDR but that was four months ago, from the
IETF Administrative Director, and made no mention of me being called on
to do anything; other organisations did call on me to act, and to act
immediately).

So I clicked on the link, entered userid and password to get a message
that there had been a password leak and that I must reset my password.
Mmm even more like a phishing attack

So I request a password reset, get an e-mail with a link, click on it
and enter a userid and a new password.

Anyone else been similarly 'targetted'?

On the surface, it looks allright, but it seems poor security practice
for this to come out of the blue, encouraging us to get into bad habits.

Tom Petch

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 26 Sep 2018 12:47:30 +0100

Hi Tom,

> to do anything; other organisations did call on me to act, and to act
See email with subject "Heads-up Regarding GDPR Consent Request Emails" 
on September 20th.
> Anyone else been similarly 'targetted'?
I believe this is a legitimately sent email.
> for this to come out of the blue, encouraging us to get into bad habits.

Best Regards,

Alexey

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 26 Sep 2018 08:51:45 -0300

My spam filter probably filtered that email for me (as I didn't got it), so is the data being deleted and will need to create the account again?

Or there is an alternative way to "accept" by login into the datatracker?

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de tom petch <[email-masked]>
Fecha: miércoles, 26 de septiembre de 2018, 8:23
Para: ietf <[email-masked]>
Asunto: Personal Information in the IETF Datatracker

    Mmmm

    

    
    
    Tom Petch

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: Riccardo Bernardini <[email-masked]>
Date: Wed, 26 Sep 2018 14:11:13 +0200

I, too, received this e-mail, but on my work account ([email-masked]
or [email-masked]).  I followed the link, but it says that my
e-mail is not known.... Funny.

On Wed, Sep 26, 2018 at 1:52 PM JORDI PALET MARTINEZ <jordi.palet=
[email-masked]> wrote:

> My spam filter probably filtered that email for me (as I didn't got it),
> so is the data being deleted and will need to create the account again?
>
> De: ietf <[email-masked]> en nombre de tom petch
> <daedulus@btconnect..com>
>     for this to come out of the blue, encouraging us to get into bad
> habits..
>
>     Tom Petch
>
>
>
>
>
> This electronic message contains information which may be privileged or
> confidential. The information is intended to be for the exclusive use of
> the individual(s) named above and further non-explicilty authorized
> disclosure, copying, distribution or use of the contents of this
> information, even if partially, including attached files, is strictly
> prohibited and will be considered a criminal offense. If you are not the
> intended recipient be aware that any disclosure, copying, distribution or
> use of the contents of this information, even if partially, including
> attached files, is strictly prohibited, will be considered a criminal
> offense, so you must reply to the original sender to inform about this
> communication and delete it.
>
>
>
>

---

From: Ladislav Lhotka <[email-masked]>
Date: Wed, 26 Sep 2018 14:16:06 +0200

> that there had been a password leak and that I must reset my password.

This didn't happen to me, my username and password just worked.

Lada

-- 
Ladislav Lhotka
Head, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 26 Sep 2018 15:21:47 +0200

Hi Jordi,

On 2018-09-26 13:51, JORDI PALET MARTINEZ wrote:
> My spam filter probably filtered that email for me (as I didn't got
> it), so is the data being deleted and will need to create the account
> again?
> 

You should be able to just log in to the datatracker, go to your account
info page (https://datatracker.ietf.org/accounts/profile/) and look over
the information.  Then scroll to the bottom, click on the checkbox next
to ' I hereby give my consent ...' and submit.

Best regards,

	Henrik

> De: ietf <[email-masked]> en nombre de tom petch <daedulus@btconnect..com>
>     for this to come out of the blue, encouraging us to get into bad habits..
>     
>     Tom Petch
>     
>     
> 
> 
>

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 26 Sep 2018 15:29:16 +0200

Hi Riccardo,

> e-mail is not known.... Funny.

In your case, things are a bit more complex.  The datatracker knows of your
email <[email-masked]>, but you don't have a login.  This
means that the information in your account is derived from submitted drafts
and other IETF work.

In order to inspect the data, please create a login for yourself by using
the login creation service at https://datatracker.ietf.org/accounts/create/,
using the email known to the datatracker, <[email-masked]>.
The login will be automatically connected to your personal information, and
you will be able to inspect and update your information, and give consent.

Best regards,

	Henrik

>>     that there had been a password leak and that I must reset my password..

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 26 Sep 2018 15:34:54 +0200

Hi Tom,

> See email with subject "Heads-up Regarding GDPR Consent Request Emails" 

Note, this went out on ietf-announce; not on this list.

> I believe this is a legitimately sent email.

It is.  In any case, if you're even slightly doubtful, just manually go
to the IETF datatracker, log in, look over your information, etc.

>> for this to come out of the blue, encouraging us to get into bad habits.

I would agree.  We did try, by sending out the heads-up, though ,:-}

	Henrik

---

From: "Marco Davids (Private)" <[email-masked]>
Date: Wed, 26 Sep 2018 15:42:33 +0200

On 26/09/2018 13:22, tom petch wrote:

> I got an e-mail with this subject line, from the IETF Secretariat

> On the surface, it looks allright

Did it contain DMARC, SPF and DKIM protection of any kind?

-- 
Marco

---

From: John C Klensin <[email-masked]>
Date: Wed, 26 Sep 2018 10:35:55 -0400

Henrik,

Two observations, the first in the "in case we ever need to do
something like this again" category.   

First, I'm glad it is possible to do this by logging into one's
account.  Giving phishing concerns, it would be good to include
an explicit instruction in the note that, as an alternative to
clicking links in an email message, one can do that.   Perhaps
not a big deal and almost certainly not worth going back and
trying to re-doing things at this point, but worth keeping in
mind as good practice.

Second...

--On Wednesday, September 26, 2018 15:29 +0200 Henrik Levkowetz
<[email-masked]> wrote:

>> I, too, received this e-mail, but on my work account
>> ([email-masked] or [email-masked]).  I
>> followed the link, but it says that my e-mail is not
>> known.... Funny.
> 
> In your case, things are a bit more complex.  The datatracker
> knows of your email <[email-masked]>, but you
> don't have a login.  This means that the information in your
> account is derived from submitted drafts and other IETF work.

I got a large number of messages, some addressed to addresses
that probably appear in RFCs but that I have not actively used
in a decade or two.  My plan had been to respond only to the one
associated with the address I now use in the tracker and just
let the automated processes clear the others as offered/
threatened.

Is that plausible, or do those old addresses have some other
value to the IETF?   In particular, if someone is maintaining a
database that links old addresses to current (or at least newer)
addresses, it would be a pity to have that database damaged by
this cleanup.  IANAL, much less a GDPR specialist, but I have
trouble believing that such a database could compromise personal
privacy if (i) the addresses were already published somewhere,
such as in RFCs, (ii) no information other than the address
mappings was present, and ideally (iii) the database could be
queried only "forward" (i.e., "what is the current address
associated with the old address xxx@yyy ?") and not downloaded
so that "what are all the other addresses belonging to whomever
is now using xxx@yyy ? is hard or impossible to ask.

I also can't give permission for inclusion in an address mapping
database because there are addresses for me in the database for
which I can no longer receive mail (and hence might have missed
even more announcement messages), much less create an account
and log in.

best,
   john

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 26 Sep 2018 11:46:51 -0300

Thanks and done!

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de Henrik Levkowetz <[email-masked]>
Fecha: miércoles, 26 de septiembre de 2018, 10:22
Para: JORDI PALET MARTINEZ <jordi.palet=[email-masked]>, "[email-masked] Discussion" <[email-masked]>
Asunto: Re: Personal Information in the IETF Datatracker

    Hi Jordi,

    
    Best regards,
    
    	Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 26 Sep 2018 17:00:55 +0200

Hi John,

> trying to re-doing things at this point, but worth keeping in

Good point.  We'll be repeating the consent request to people who
have not given it before the deadline; in order to do better next
time I've added this at the end of the email template:

   In case you prefer to not follow any email links, due to phishing
   considerations, please just go to the datatracker and use the menu
   entries to log in or check the help pages  The links above are provided
   for your convenience, but it works just as well to go the datracker
   manually and do what's needed.

(Thoughts on the wording are welcome.)

> even more announcement messages), much less create an account

You only need to do one login, and check one personal information
page; that page will list all the email addresses associated with
you and your drafts.  You will be able to mark any of them which
are not in active use as not active.  Giving consent to storing
your information will leave all records intact, but email addresses
which are not marked active will not be used to try to contact you,
but only for internal linkage to document author records and similar.

I hope that answers your question?

Best regards,

	Henrik

---

From: Robert Sparks <[email-masked]>
Date: Wed, 26 Sep 2018 10:03:57 -0500

John,

Some responses inline:

> let the automated processes clear the others as offered/
That's reasonable.
> value to the IETF?
If those old addresses came from a role you held or are one of the 
authors of a draft, they have value and won't be removed.

You can help make sure they are correctly associated with your 
datatracker account by looking at the list of addresses the datatracker 
knows for you - they're displayed on the page you get using the "Account 
Info" link in the menus. (Which, for convenience, is at this URL 
<https://datatracker.ietf.org/accounts/profile/> after you log in.)

If you received mail for addresses that aren't showing on that page, 
please add them there.

If you get an error while trying to do so, there's data cleanup we need 
to do manually. If that occurs, please send email to Henrik and me with 
the addresses it won't let you add.

>   In particular, if someone is maintaining a
> this cleanup.
Agreed, and the datatracker _does_ map from old addresses to current 
ones. (If it has no other reason to select an active address, such as 
knowing a specific address to use for a role, it will use the address 
marked Primary. Similarly it will use the address marked Primary in the 
place of any message that would have gone to an inactive address.)
> IANAL, much less a GDPR specialist, but I have

---

From: tom petch <[email-masked]>
Date: Wed, 26 Sep 2018 15:21:45 +0000

----- Original Message -----
From: "Marco Davids (Private)" <mdavids=[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 26, 2018 2:42 PM

> Did it contain DMARC, SPF and DKIM protection of any kind?

spf=pass
dkim=none

as below

Tom Petch

Received: from VE1EUR02FT025.eop-EUR02.prod.protection.outlook.com
 (2a01:111:f400:7e06::204) by AM4PR07CA0001.outlook.office365.com
 (2603:10a6:205:1::14) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1185.10 via
Frontend
 Transport; Mon, 24 Sep 2018 17:15:50 +0000
Authentication-Results: spf=pass (sender IP is 4.31.198.44)
 smtp.mailfrom=ietf.org; btconnect.com; dkim=none (message not signed)
 header.d=none;btconnect.com; dmarc=pass action=none
header.from=ietf.org;
Received-SPF: Pass (protection.outlook.com: domain of ietf.org
designates
 4.31.198.44 as permitted sender) receiver=protection.outlook.com;
 client-ip=4.31.198.44; helo=mail.ietf.org;
Received: from mail.ietf.org (4.31.198.44) by
 VE1EUR02FT025.mail.protection.outlook.com (10.152.12.109) with
Microsoft SMTP
 Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.20.1185.13 via Frontend Transport; Mon, 24 Sep 2018 17:15:50 +0000
...
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: IETF Secretariat <[email-masked]>
Subject: Personal Information in the IETF Datatracker
X-Test-IDTracker: no
X-IETF-IDTracker: 6.84.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID:
<[email-masked]>
Date: Mon, 24 Sep 2018 10:15:48 -0700
Return-Path: [email-masked]

---

From: tom petch <[email-masked]>
Date: Wed, 26 Sep 2018 15:21:45 +0000

----- Original Message -----
Sent: Wednesday, September 26, 2018 2:34 PM

Hi Tom,

<tp>

Henrik

Thank you for the follow-up.  I am subscribed to the ietf-announce list
but have no recollection of seeing such an e-mail.  I do receive all
e-mail on that list and filer them into three folders but can see no
sign in any of them; and given that I am in Europe, references to GDPR
catch my eye.  So, puzzlement remains except that my ESP has an
aggressive view of spam and tells me that its policy is confidential - I
find, for example, that it will expunge any e-mail I send that makes
reference to the 'IGP that is not OSPF', now serviced by the lsr working
group so aggressive filtering is my best explanation to date.

I think, too, that I was surprised to see what the datatracker held on
me; not much, nothing I would regard as risky, but I probably would not
have guessed that such information was being held.  One up for GDPR:-)

Tom Petch

>> for this to come out of the blue, encouraging us to get into bad
habits.

Henrik

---

From: Robert Sparks <[email-masked]>
Date: Wed, 26 Sep 2018 10:32:58 -0500

Fwiw, the heads up was here:

<https://mailarchive.ietf.org/arch/msg/ietf-announce/8M1CJw_XwuAOAfxSAbeINSyBjTs>

RjS

---

From: John C Klensin <[email-masked]>
Date: Wed, 26 Sep 2018 11:54:30 -0400

--On Wednesday, September 26, 2018 17:00 +0200 Henrik Levkowetz
<[email-masked]> wrote:

>> First, I'm glad it is possible to do this by logging into
>> one's account.  Giving phishing concerns, it would be good to
>> include an explicit instruction in the note that, as an
>> alternative to clicking links in an email message, one can do
>> that.   Perhaps not a big deal and almost certainly not worth
>> going back and trying to re-doing things at this point, but
>> worth keeping in mind as good practice.
> 
> Good point.  We'll be repeating the consent request to people
> who have not given it before the deadline; in order to do
> better next time I've added this at the end of the email
> template:
> 
>    In case you prefer to not follow any email links, due to
> phishing    considerations, please just go to the datatracker
> and use the menu    entries to log in or check the help pages
> The links above are provided    for your convenience, but it
> works just as well to go the datracker    manually and do
> what's needed.
> 

I think that is excellent.  Three small editorial suggestions:

(i) drop "any" from "any email links".  It isn't the point.

(ii) add "with any of your identities" to "to log in".

(iii) Do you want to point people to help pages or more directly
to their profiles?

By the way, while I think the IETF should be setting an
extra-good example, the fact that the links in the message are
pointing to datatracker.ietf.org and not, e.g., to
www.random-site.example does provide moderately good assurance
that nothing evil is going on... to the point that this is a bit
of a tempest in a teapot.  So, while I think the above is a good
idea, I also think that strong criticisms for you for not
including it would be a bit out of line.

>> in a decade or two.  My plan had been to respond only to the
>> one associated with the address I now use in the tracker and
>> just let the automated processes clear the others as offered/
>> threatened.
>...

> You only need to do one login, and check one personal
> information page; that page will list all the email addresses
> associated with you and your drafts.  You will be able to mark
> any of them which are not in active use as not active.  Giving
> consent to storing your information will leave all records
> intact, but email addresses which are not marked active will
> not be used to try to contact you, but only for internal
> linkage to document author records and similar.
> 

Together with Robert's response, it does.

FYI, I was interested in another case, which is that the RFC
Editor database contains an (entirely appropriate warning) about
old addresses not working (that warning might be in the
datatracker too.. don't remember).  If someone is trying to
contact, e.g., a document author, knowing the mapping from older
to a current/primary addresses would be a significant benefit,
at least if the information is sufficiently controlled.  But
that is really a different problem for a different day.

best regards,
   john

---

From: Hector Santos <[email-masked]>
Date: Wed, 26 Sep 2018 14:08:40 -0400

> Did it contain DMARC, SPF and DKIM protection of any kind?

The ietf.org domain has a hard (-ALL) reject SPF transport policy but 
a relaxed (p=none) DMARC payload policy.

Generally, a passed hard SPF policy is all that is needed as it 
indicates the ietf.org distributed mail did get transported from an 
ietf.org owned machine.

A failed SPF result could mean instant rejection at the SMTP online 
level depending on whether the IETF mail processor delays honoring SPF 
rejects immediately or until the payload is received in order to check 
DMARC.  However, it should not be depending on DMARC as SPF can stand 
on its own without DMARC, especially for domains with an hard -ALL SPF 
policy.  Overall, depending on your receiver, you would never see this 
a failed SPF message or its put into some spam box.  I would trust the 
IETF announcement message.

As a side note, now that the ietf.org list manager is performing 
5322.From rewrites for member submissions who do have DMARC 
p=reject/quarantines policies (like forfun.net, isdg.net, yahoo.com 
and others), it is using a new 5322.From address domain dmarc.ietf.org 
which does not have a DMARC record or policy.  Unless it was was 
intentionally done this way, the dmarc.ietf.org domain should match 
the ietf.org DMARC policy or even probably use a p=reject hard policy 
since it did resign and rewrite the 5322.From domain.

-- 
HLS

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 26 Sep 2018 22:24:46 +0200

Hi John,

> (i) drop "any" from "any email links".  It isn't the point.

Fixed.

> (ii) add "with any of your identities" to "to log in".

Actually, there is only one login per person, so this should not
change.

(At least that's the case unless you have two independent person
records, which could happen if for instance one draft would give
your name as A. Nonymous <[email-masked]> and another would use
A.B. Nonymous <[email-masked]> -- then each of those might have one
login of its own.  Cases like that we merge together when we discover
them.)

> (iii) Do you want to point people to help pages or more directly

I think the links given currently are sufficient indication of where
people could go.  I'm removing the mention of help pages from the
text above, for the revised consent request email.

Thanks!

	Henrik

---

From: Mark Andrews <[email-masked]>
Date: Thu, 27 Sep 2018 09:07:44 +1000

On a related issue I got two emails and when I tried to add the second email as a alternate
I get "Email address [email-masked]' is already assigned to account 'None' (Mark Andrews)”

Is there a way to consolidate them without manual intervention?

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 27 Sep 2018 13:35:36 +0200

Hi Mark,

> Is there a way to consolidate them without manual intervention?

No, sorry.  But I've merged them now; you should see all email addresses
when you check your information.

Best regards,

	Henrik