Re: Message-ID, privacy and uniqueness
Arnt Gulbrandsen <[email protected]> Tue, 30 Jun 2026 12:58:48 +0000
| Newsgroups | gmane.mail.mutt.devel |
|---|---|
| Message-ID | <[email protected]> |
--3c9d98ae-9efe-443c-830a-6deedd0467f3-1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, a bit of latency here, sorry about that. I think the responses indicate that Mutt should use low-entropy localpart= s in its message-id. A couple of people strongly think so, and nobody = disagrees strongly. The original issue was about the domain, which currently leaks what may = be private information. For example, Message-id: <20260630abcd@arnts-imac= >=C2=A0may reveal: * that I use a Mac, even though Macs are verboten at my workplace (I'm = just making this up) * that I sent the message from my office even though I promised my wife = not to work that late (I'm making up this too, honest) My suggestion was to change the domain to a constant, @message-id.mutt.or= g or something like that, which stops revealing the hostname but also = reduces the entropy of the message-ids and thus increases the chance = that two different mutt users might send a message with the same = message-id. I suggested to raise the amount of entropy in the localpart = to guard against that. I think it's clear that we aren't going to increase the amount of = entropy in the localpart. Should we still guard against the hostname = information leak, or just accept that as a non-ideal state of things? Arnt June 6, 2026 at 12:29 AM, "Steffen Nurpmeso" <[email protected] = mailto:[email protected]?to=3D%22Steffen%20Nurpmeso%22%20%3Csteffen%40sd= aoden.eu%3E > wrote: >=20 > P.S.: >=20 > Kevin J. McCarthy wrote in > <ahtuEwmXBaWgsbdr@qinghai>: > |On Fri, May 29, 2026 at 10:47:04AM +0200, Arnt Gulbrandsen wrote: > |>However, the sending domain isn't conveniently available at that = spot=20 > |>in the code. > | > |It could easily be made available. > ... > |I think Steffen's use of From in his reply below, or git send-email's= =20 > |usage, e.g.: <[email protected]> which uses the = "@"=20 > |in the From address as the delimiter between id-left and id-right = are=20 > |friendlier, and with the full email address give a nice uniqueness=20 > |partition, even for "gmail" addresses. > | > |The only worry I have for Steffen's approach, is that even though = '%' is=20 > |technically allowed in id-right, the rfc recommends a domain name, = and=20 > |some spam filters may be adverse to the '%' because of that. I think=20 > |the git approach is a bit cleaner. > ... >=20 > But we are both "broken" if the email contains quoted-strings. > git creates > git.st"en(ey)[email protected] > for > email =3D s"t\"e"n(ey)[email protected] > and that from only short looking does not seem right. >=20 > (I myself struggle for my beloved 5322/IMF parser, because > i "simply requote" local-parts which contain quotes, but i do not > think this is right either. I think local-parts are f...ed up. > And i think what they do to make it international is bad bad hack, > but that aside. (I would simply do some magic trigger thing like > they did for the IDNA i hate, or what is used for UTF-8 BOM, you > know, three full bytes of "entropy", or even more!, if that > someone has for real i cannot help it.)) >=20 > But the thread convinced me to include further formats to only > generate the domain name of the actually used "from" address. > (For the simply MUA i maintain.) >=20 > Ciao! >=20 > --steffen > | > |Der Kragenbaer, The moon bear, > |der holt sich munter he cheerfully and one by one > |einen nach dem anderen runter wa.ks himself off > |(By Robert Gernhardt) > --3c9d98ae-9efe-443c-830a-6deedd0467f3-1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE html><html><head><meta http-equiv=3D"Content-Type" content=3D"t= ext/html; charset=3Dutf-8"></head><body><div>Hi,</div><div><br></div><div= >a bit of latency here, sorry about that.</div><div><br></div><div>I = think the responses indicate that Mutt should use low-entropy localparts = in its message-id. A couple of people strongly think so, and nobody = disagrees strongly.</div><div><br></div><div>The original issue was = about the domain, which currently leaks what may be private information. = For example, <span style=3D'font-family: "DejaVu Sans Mono", "DejaVu LGC = Sans Mono", "Bitstream Vera Sans Mono", "Lucida Console", Monaco, = monospace;'>Message-id: <20260630abcd@arnts-imac></span>=C2=A0may = reveal:</div><ul><li>that I use a Mac, even though Macs are verboten at = my workplace (I'm just making this up)</li><li>that I sent the message = from my office even though I promised my wife not to work that late (I'm = making up this too, honest)<br></li></ul><div>My suggestion was to = change the domain to a constant, @message-id.mutt.org or something like = that, which stops revealing the hostname but also reduces the entropy of = the message-ids and thus increases the chance that two different mutt = users might send a message with the same message-id. I suggested to = raise the amount of entropy in the localpart to guard against that.</div>= <div><br></div><div>I think it's clear that we aren't going to increase = the amount of entropy in the localpart. Should we still guard against = the hostname information leak, or just accept that as a non-ideal state = of things?</div><div><br></div><div>Arnt<br><br></div><p>June 6, 2026 at = 12:29 AM, "Steffen Nurpmeso" <<a href=3D"mailto:[email protected]?to=3D= %22Steffen%20Nurpmeso%22%20%3Csteffen%40sdaoden.eu%3E" target=3D"_blank" = tabindex=3D"-1">[email protected]</a>> wrote:</p><blockquote>P.S.:<br= ><br>Kevin J. McCarthy wrote in<br> <ahtuEwmXBaWgsbdr@qinghai>:<br>= |On Fri, May 29, 2026 at 10:47:04AM +0200, Arnt Gulbrandsen wrote:<br> = |>However, the sending domain isn't conveniently available at that = spot <br> |>in the code.<br> |<br> |It could easily be made available.= <br> ...<br> |I think Steffen's use of From in his reply below, or git = send-email's <br> |usage, e.g.: <[email protected]&= gt; which uses the "@" <br> |in the From address as the delimiter = between id-left and id-right are <br> |friendlier, and with the full = email address give a nice uniqueness <br> |partition, even for "gmail" = addresses.<br> |<br> |The only worry I have for Steffen's approach, is = that even though '%' is <br> |technically allowed in id-right, the rfc = recommends a domain name, and <br> |some spam filters may be adverse to = the '%' because of that. I think <br> |the git approach is a bit = cleaner.<br> ...<br><br>But we are both "broken" if the email contains = quoted-strings.<br>git creates<br> git.st"en(ey)[email protected]<br>for<br>= email =3D s"t\"e"n(ey)[email protected]<br>and that from only short = looking does not seem right.<br><br>(I myself struggle for my beloved = 5322/IMF parser, because<br>i "simply requote" local-parts which contain = quotes, but i do not<br>think this is right either. I think local-parts = are f...ed up.<br>And i think what they do to make it international is = bad bad hack,<br>but that aside. (I would simply do some magic trigger = thing like<br>they did for the IDNA i hate, or what is used for UTF-8 = BOM, you<br>know, three full bytes of "entropy", or even more!, if = that<br>someone has for real i cannot help it.))<br><br>But the thread = convinced me to include further formats to only<br>generate the domain = name of the actually used "from" address.<br>(For the simply MUA i = maintain.)<br><br>Ciao!<br><br>--steffen<br>|<br>|Der Kragenbaer, = The moon bear,<br>|der holt sich munter he cheerfully = and one by one<br>|einen nach dem anderen runter wa.ks himself off<br>|(= By Robert Gernhardt)</blockquote><div><br></div></body></html> --3c9d98ae-9efe-443c-830a-6deedd0467f3-1--