Marking email as private

[impseth]

Greetings,

First time posting so hopefully I'm in the right area. There's one section of my employer that's been using exchange for several years and the plan is to migrate them to zimbra. Which they howl about(sigh). The current impasse is sending private email to people.
I tested it by sharing a folder with someone here and then having them send a private email to me. When they access the email in outlook they are unable to open it but in zimbra's webmail there is no restriction.

Is it possible to do this in zimbra? And if not are there any plans to implement this?
If this has been answered before I apologize, I did a few searches and couldn't find anything.

Thanks

[mtlhead089]

Originally Posted by impseth

I tested it by sharing a folder with someone here and then having them send a private email to me. When they access the email in outlook they are unable to open it but in zimbra's webmail there is no restriction.

Hmmm... I am not sure what you mean by creating a share folder. But, it took me a little looking that with the Outlook Connector to access shares, in Outlook right-click on the menu bar and select "Zimbra Connector". A new bar opens at the bottom labeled "Share Status". Just click on it and it shows the shares that are available for the user. Check off the share that you want to see in the Outlook.

Hope that is what you are needing.

[rib]

What OP is referring to is:
if user A has his inbox shared to user B and user C sends an email to user A

User b can see the first three lines if auto preview is enabled. And can read the message entirely if viewed from webmail - Outlook only lets you see the auto-preview but wont let you open the message.

Seems like a major problem.. find it hard to believe that this is not a supported feature, as I am sure someone would have come accross this by now..


Does anybody know if the above scenario applies to them as well?

[mtlhead089]

Originally Posted by rib

User b can see the first three lines if auto preview is enabled. And can read the message entirely if viewed from webmail - Outlook only lets you see the auto-preview but wont let you open the message.

I have never seen any case of this so I had to look for myself.
Through the admin web gui View Mail of the user in question and right-click on the "Inbox" folder and created a Share to me as a "Viewer" only.
In my web gui I Accepted the share
Started Outlook and up came the 2nd Inbox. Nifty!!

In the past what I would do is export from userA and then import to userB.

Hmmm.... but, I am able to view the entire document as well, not experiencing what you are seeing.

Clicking on Outlook's Help - About Zimbra Outlook Connector for Outlook
It showed up as
Client: 6.0.5817.4
Server: 6.0.4_GA_2040

Oops!

Closed Outlook, uninstalled ZCS Connector for Outlook. Installed the current connector.

Now, it shows up correct;
Client: 6.0.5846.5
Server: 6.0.5_GA_2214 RHEL4

I am using Outlook 2007 on a Windows 7 Enterprise computer with all the latest updates.

Whelp, I still am able to access the shared inbox without any problem.

Do you have a similar setup? Do you have any logs from /opt/zimbra/log/sync.log or mailbox.log?

[rib]

You should be able to view the other shares just fine - its seing the emails that are marked as private that are the problem. Someone looking at a shared calender should not see a message that is marked as private, unless they are the recipient.

[impseth]

Originally Posted by rib

What OP is referring to is:
if user A has his inbox shared to user B and user C sends an email to user A

User b can see the first three lines if auto preview is enabled. And can read the message entirely if viewed from webmail - Outlook only lets you see the auto-preview but wont let you open the message.

That is exactly what is happening. And I agree, this is a major problem. I have a feeling that it just hasn't been done in zimbra yet but I'd still consider it a bug. Certainly a security hole.

[ewilen]

You're talking about the drop-down that appears in the Message Options window, under Sensitivity, right?

I suspect that this is a Microsoft-proprietary feature.

It seems to me that the bug here is Outlook with ZCO is showing the private option instead of suppressing it. There are quite a few standard Outlook features that Zimbra doesn't support. The right thing to do in those cases is to suppress them in the user interface.

I'd suggest opening a bug for ZCO that says "suppress sensitivity options until supported within zimbra". This is a normal if not major bug since users are being fooled into trusting the confidentiality of information when in fact it can be accessed by third parties.

Then open a separate RFE that says "support defining and hiding objects based on Sensitivity". Hidden objects would have to be hidden not only in the web client but also in IMAP, CalDAV, RSS, (etc.)

The problem here, though, is that people are still going to mark emails private and then send them out over the Internet. Outlook users with or without Exchange probably do it all the time, not realizing that (a) if the email is intercepted, it can be read by third parties unless it's also encrypted, and (b) unless the recipient's system, over which they have no control, supports the MS sensitivity option, their mail will be visible to people with whom the recipient shares their Inbox.

[ewilen]

Just did a little research on this. First of all, Calendar already supports Private events, so that should be working even though I remember some issues with CalDAV and/or with iCal specifically.

About marking other objects as private, there are a few interesting entries in bugzilla:

Bug 14265 - Support for private items covers the RFE I suggested.

Bug 13966 - "Private" should not be shown for contacts in ZCO and Bug 13968 - "Private" should not be shown for tasks in ZCO handle suppressing private options for contacts and tasks, but not mail.

[ewilen]

Regarding the Sensitivity header on Mail, I was mistaken at least in part: the header is defined in RFC 4021 as noted in Bug 42147 - Visible notification for messages with Sensitivity header set to Private. But I don't see any standard that requires automatically hiding sensitive messages in shared folders.

Still, I'll added a comment to piggyback on the bug.

[impseth]

Thanks ewilen, wasn't familiar with the bugzilla to try searching there. I'll be sending that off to my people here and hopefully can give zimbra a bit of a nudge to work on that as I see all the comments on those bug pages are from 2007.