Subject: [secdir] Secdir review of draft-gulbrandsen-imap-response-codes-07

From: "Carl Wallace" <[email-masked]>
Date: Mon, 9 Feb 2009 10:52:53 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

This document defines and documents a variety of IMAP response codes.
The draft looks fine but I have one nit in the security considerations
section.  The first paragraph states "revealing information about a
passphrase to unauthenticated IMAP clients has bad karma".  I suggest
this be changed to "revealing information about a passphrase to
unauthenticated IMAP clients causes bad karma".  It could be expanded to
state that this may result in your own password being revealed as a
karmic payback.