[discussion] Privacy issue (bug 3280)
Hello Koha users & developers, The bug 3280 fixes a problem in cart sending in opac : the behaviour has changed, and for security reason, it will be possible only for logged-in users. A question has also been raised : we could also add the IP address of the sender in the mail that Koha sent. Do you think : 1- we could 2- we should 3- we shouldn't (and why) I start arguing = I think we should, and in France, I think it's a legal issue, you must be able to answer any legal request from a court (9-11, thank you :\ ) It's right we have the username, but the IP address is a good complement -- Paul POULAIN http://www.biblibre.com Expert en Logiciels Libres pour l'info-doc Tel : (33) 4 91 81 35 08
Make it a syspref, so it can work for all jurisdictions. Problem solved. Chris Paul Poulain <paul.poulain@biblibre.com> wrote: Hello Koha users & developers, The bug 3280 fixes a problem in cart sending in opac : the behaviour has changed, and for security reason, it will be possible only for logged-in users. A question has also been raised : we could also add the IP address of the sender in the mail that Koha sent. Do you think : 1- we could 2- we should 3- we shouldn't (and why) I start arguing = I think we should, and in France, I think it's a legal issue, you must be able to answer any legal request from a court (9-11, thank you :\ ) It's right we have the username, but the IP address is a good complement -- Paul POULAIN http://www.biblibre.com Expert en Logiciels Libres pour l'info-doc Tel : (33) 4 91 81 35 08 _____________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Op 03-07-12 17:17, Paul Poulain schreef:
I start arguing = I think we should, and in France, I think it's a legal issue, you must be able to answer any legal request from a court (9-11, thank you :\ )
There are probably some jurisdictions where you /must not/ give away the IP address, too. Also, it's trickier if your koha server is behind a reverse proxy (by no means impossible though.) -- Robin Sheat Catalyst IT Ltd. ✆ +64 4 803 2204 GPG: 5957 6D23 8B16 EFAB FEF8 7175 14D3 6485 A99C EB6D
Make it optional at most (syspref), off by default. Greg ---------------------- On 07/03/2012 11:17 AM, Paul Poulain wrote:
Hello Koha users & developers,
The bug 3280 fixes a problem in cart sending in opac : the behaviour has changed, and for security reason, it will be possible only for logged-in users. A question has also been raised : we could also add the IP address of the sender in the mail that Koha sent. Do you think : 1- we could 2- we should 3- we shouldn't
(and why)
I start arguing = I think we should, and in France, I think it's a legal issue, you must be able to answer any legal request from a court (9-11, thank you :\ ) It's right we have the username, but the IP address is a good complement
IP address is not sufficiently rigourous to identify and individual or even a location (TOR network and all that). It's routinely mis-used as such an identifier. I don't see any benefit to adding it to Koha's outgoing emails, since it cannot be relied upon, and it could put people at risk of ill-advised legal sanction. If there is a strong use case for it, it would need to go behind a syspref, with the default value set to "disable". But personally I don't think it's worth including. -Ian On Tue, Jul 3, 2012 at 1:37 PM, glaws <glawson@rhcl.org> wrote:
Make it optional at most (syspref), off by default.
Greg ----------------------
On 07/03/2012 11:17 AM, Paul Poulain wrote:
Hello Koha users & developers,
The bug 3280 fixes a problem in cart sending in opac : the behaviour has changed, and for security reason, it will be possible only for logged-in users. A question has also been raised : we could also add the IP address of the sender in the mail that Koha sent. Do you think : 1- we could 2- we should 3- we shouldn't
(and why)
I start arguing = I think we should, and in France, I think it's a legal issue, you must be able to answer any legal request from a court (9-11, thank you :\ ) It's right we have the username, but the IP address is a good complement
_______________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
Ian Walls <koha.sekjal@gmail.com>
IP address is not sufficiently rigourous to identify and individual or even a location (TOR network and all that). It's routinely mis-used as such an identifier. I don't see any benefit to adding it to Koha's outgoing emails, since it cannot be relied upon, and it could put people at risk of ill-advised legal sanction.
If there is a strong use case for it, it would need to go behind a syspref, with the default value set to "disable". But personally I don't think it's worth including.
I don't either. IP addresses are usually registered to a person (including legal persons like companies) and/or a place (which is inexact because one of my Norfolk IP addresses is incorrectly thought to be in Somerset, while another is somewhere in Yorkshire...), so they're roughly like phone numbers. The Koha user_id is more identifying and more likely to be owned by the person triggering the email. Having Koha send out an IP address in a cleartext email seems like a possible breach of privacy law in some situations, handing over what might be someone else's phone numbers... sorry, IP address numbers. The argument that people need to be able to tell IP addresses to terrorist lawmakers seems unrelated: that information can be logged on the server if wanted. The email recipient and intermediate handlers do not need to know the requestor's IP address under the terror laws I've seen, only where they got it from. So, no IP address, but if you think you must, syspref default disabled. Regards, -- MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op. http://koha-community.org supporter, web and library systems developer. In My Opinion Only: see http://mjr.towers.org.uk/email.html Available for hire (including development) at http://www.software.coop/
At 06:21 PM 7/8/2012 +0100, MJ Ray wrote:
Ian Walls <koha.sekjal@gmail.com>
IP address is not sufficiently rigourous to identify and individual or even a location (TOR network and all that). It's routinely mis-used as such an identifier. I don't see any benefit to adding it to Koha's outgoing emails, since it cannot be relied upon, and it could put people at risk of ill-advised legal sanction.
If there is a strong use case for it, it would need to go behind a syspref, with the default value set to "disable". But personally I don't think it's worth including.
I don't either. IP addresses are usually registered to a person (including legal persons like companies) and/or a place (which is inexact because one of my Norfolk IP addresses is incorrectly thought to be in Somerset, while another is somewhere in Yorkshire...), so they're roughly like phone numbers.
Sorry to jump into this one a bit late ... but I do have a bit of background to security aspects (spammer abuse in particular) to various cgi, perl, php "sendmail" scripts; the bottom line is that there is intrinsically no way of making them fully functional and secure at the same time. And ... I've just discovered that our production Koha 3.6.1 is wide open to this type of exploit; without logging in as a user, I have just spammed 5 of _my_own_ addresses as a "proof of concept." Thank goodness our users appear to be well behaved :=) Some basic thoughts: Hard code the To: address (or at the very least limit programmatically the To: to a single recipient [1].) In Koha, each logged in user has a primary and a single secondary email -- a drop down box "Choose primary/secondary" would stop a spammer. If a genuine user really wanted to send to a new address, modifying the secondary email is trivial (but too time consuming for a spammer who has much easier "targets" than a Koha system.) Do not, under any circumstances, allow a user to enter Cc: or Bcc: Deny, via regex, anything approaching URL format in the "Comments" For the truly paranoid, rate-limiting to say 5 "send carts" per 24 hours would probably not offend genuine users. As a "close the barn door after the horse has bolted" backup, add an X-Originating-IP: [xxx.xxx.xxx.xxx] taken from $ENV{'REMOTE_ADDR'} [or even $ENV{'REMOTE_HOST'} which will be the same if no rDNS.] If you're worried about privacy (and to the best of my knowledge this X-header has never been challenged under privacy laws, and is a de facto industry standard -- e.g. just have a look at any hotmail.com set of headers) the pop-up could say "You're logged in from xxx.xxx.xxx.xxx and this will be recorded in your email; do not click send if this concerns you." Now, I'm off to close this loophole. Best - Paul [1] Example: sub check_email { # Init local var $email_test = $email_add; # reject invalid syntax including multiples, but not type user@[255.255.255.0] if ($email_test =~ /(@.*@)|(\.\.)|(@\.)|(\.@)|(^\.)/ || # or does not conform to basic syntax $email_test !~ /^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z0-9]+)(\]?)$/) { return 0; } else { return 1; } }
The Koha user_id is more identifying and more likely to be owned by the person triggering the email. Having Koha send out an IP address in a cleartext email seems like a possible breach of privacy law in some situations, handing over what might be someone else's phone numbers... sorry, IP address numbers.
The argument that people need to be able to tell IP addresses to terrorist lawmakers seems unrelated: that information can be logged on the server if wanted. The email recipient and intermediate handlers do not need to know the requestor's IP address under the terror laws I've seen, only where they got it from.
So, no IP address, but if you think you must, syspref default disabled.
Regards, -- MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op. http://koha-community.org supporter, web and library systems developer. In My Opinion Only: see http://mjr.towers.org.uk/email.html Available for hire (including development) at http://www.software.coop/ _______________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
--- Maritime heritage and history, preservation and conservation, research and education through the written word and the arts. <http://UltraMarine.ca>, <http://AandC.org> and <http://MarDoc.ca>
Have you looked at the patch in master? The loophole is closed. This thread is about the IP address and it looks to me like we are all converging on a syspref. Chris Paul <paul.a@aandc.org> wrote: At 06:21 PM 7/8/2012 +0100, MJ Ray wrote:
Ian Walls <koha.sekjal@gmail.com>
IP address is not sufficiently rigourous to identify and individual or even a location (TOR network and all that). It's routinely mis-used as such an identifier. I don't see any benefit to adding it to Koha's outgoing emails, since it cannot be relied upon, and it could put people at risk of ill-advised legal sanction.
If there is a strong use case for it, it would need to go behind a syspref, with the default value set to "disable". But personally I don't think it's worth including.
I don't either. IP addresses are usually registered to a person (including legal persons like companies) and/or a place (which is inexact because one of my Norfolk IP addresses is incorrectly thought to be in Somerset, while another is somewhere in Yorkshire...), so they're roughly like phone numbers.
Sorry to jump into this one a bit late ... but I do have a bit of background to security aspects (spammer abuse in particular) to various cgi, perl, php "sendmail" scripts; the bottom line is that there is intrinsically no way of making them fully functional and secure at the same time. And ... I've just discovered that our production Koha 3.6.1 is wide open to this type of exploit; without logging in as a user, I have just spammed 5 of _my_own_ addresses as a "proof of concept." Thank goodness our users appear to be well behaved :=) Some basic thoughts: Hard code the To: address (or at the very least limit programmatically the To: to a single recipient [1].) In Koha, each logged in user has a primary and a single secondary email -- a drop down box "Choose primary/secondary" would stop a spammer. If a genuine user really wanted to send to a new address, modifying the secondary email is trivial (but too time consuming for a spammer who has much easier "targets" than a Koha system.) Do not, under any circumstances, allow a user to enter Cc: or Bcc: Deny, via regex, anything approaching URL format in the "Comments" For the truly paranoid, rate-limiting to say 5 "send carts" per 24 hours would probably not offend genuine users. As a "close the barn door after the horse has bolted" backup, add an X-Originating-IP: [xxx.xxx.xxx.xxx] taken from $ENV{'REMOTE_ADDR'} [or even $ENV{'REMOTE_HOST'} which will be the same if no rDNS.] If you're worried about privacy (and to the best of my knowledge this X-header has never been challenged under privacy laws, and is a de facto industry standard -- e.g. just have a look at any hotmail.com set of headers) the pop-up could say "You're logged in from xxx.xxx.xxx.xxx and this will be recorded in your email; do not click send if this concerns you." Now, I'm off to close this loophole. Best - Paul [1] Example: sub check_email { # Init local var $email_test = $email_add; # reject invalid syntax including multiples, but not type user@[255.255.255.0] if ($email_test =~ /(@.*@)|(\.\.)|(@\.)|(\.@)|(^\.)/ || # or does not conform to basic syntax $email_test !~ /^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z0-9]+)(\]?)$/) { return 0; } else { return 1; } }
The Koha user_id is more identifying and more likely to be owned by the person triggering the email. Having Koha send out an IP address in a cleartext email seems like a possible breach of privacy law in some situations, handing over what might be someone else's phone numbers... sorry, IP address numbers.
The argument that people need to be able to tell IP addresses to terrorist lawmakers seems unrelated: that information can be logged on the server if wanted. The email recipient and intermediate handlers do not need to know the requestor's IP address under the terror laws I've seen, only where they got it from.
So, no IP address, but if you think you must, syspref default disabled.
Regards, -- MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op. http://koha-community.org supporter, web and library systems developer. In My Opinion Only: see http://mjr.towers.org.uk/email.html Available for hire (including development) at http://www.software.coop/ _____________________________________________
Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
--- Maritime heritage and history, preservation and conservation, research and education through the written word and the arts. <http://UltraMarine.ca>, <http://AandC.org> and <http://MarDoc.ca> _____________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz http://lists.katipo.co.nz/mailman/listinfo/koha
participants (7)
-
Chris Cormack -
glaws -
Ian Walls -
MJ Ray -
Paul -
Paul Poulain -
Robin Sheat