<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi Kyle,</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I like the convenience of the feature but I'm very concerned about its security implications.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
The current email infrastructure is improving but still brittle as an authorization channel.</div>
<ol style="margin-top: 0px; margin-bottom: 0px; list-style-type: decimal;" data-editing-info="{"applyListStyleFromLevel":false,"orderedStyleType":1}" start="1">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role="presentation" class="elementToProof">It's not a secure channel offering easy let alone default end-to-end encryption.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role="presentation" class="elementToProof">Forging the senders identity may still be easy depending on domain configuration and enforcement policies.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role="presentation" class="elementToProof">Workitem ID is not a secret value.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role="presentation" class="elementToProof">Time-limited token if used is not a secret value once transmitted in plaintext over email. Moreover the necessary validity window in the approval context is drastically different from password resets and similar
features.</div>
</li><li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role="presentation" class="elementToProof">Mailboxes remain among the most attacked resources online.</div>
</li></ol>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
There are multiple industry bodies explicitly warning against relying on email alone for authorization decisions.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
The service providers offering email-based approval should make these limitations clear.<br>
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I would not use this feature given the current state of email security and would discourage clients from doing so without a thorough risk assessment.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Best Regards,</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Arnost</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> on behalf of Kyle Chau via midPoint <midpoint@lists.evolveum.com><br>
<b>Sent:</b> Monday, February 2, 2026 3:35 PM<br>
<b>To:</b> midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc:</b> Kyle Chau <kylechaukccs@gmail.com><br>
<b>Subject:</b> [midPoint] Feature Request - Email Approval</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Dear MidPoint team,</div>
<div><br>
</div>
<div> I am interested in implementing an email approval feature as my individual contribution to the project. Would you please provide some insight on whether this suggestion would be accepted as a core feature? The implementation, from my understanding, involves
the following:</div>
<div>
<ul>
<li>A sample message template that crafts the email approval content.</li><li>A new task type for enabling and scheduling the mailbox processing.</li></ul>
</div>
<div> I can contribute to the design and development of this feature for the next six months. </div>
<div><br>
</div>
<div> You may refer to the following for a high-level illustration on the proposal. Thank you.</div>
<div><br>
</div>
<div> Do let me know if you have any questions.</div>
<div><br>
</div>
<a href="https://github.com/KyleChaukccs/docs/blob/master/midpoint/features/planned/email-approval.adoc" originalsrc="https://github.com/KyleChaukccs/docs/blob/master/midpoint/features/planned/email-approval.adoc">https://github.com/KyleChaukccs/docs/blob/master/midpoint/features/planned/email-approval.adoc</a>
<div><br>
</div>
<div>Best Regards,</div>
<div>Kyle</div>
</div>
</div>
</body>
</html>