Thanks Mike! I've tried to incorporate these into section 10 of the next draft, which should be posted in time to review it in 2 weeks.
Cheers,
Smith
/**
Smith Kennedy
HP Inc.
*/
On May 22, 2026, at 7:54 AM, Michael Sweet <msweet at msweet.org> wrote:
CAUTION: External Email
Smith,
Some thoughts on security/privacy:
1. Firmware should be cryptographically signed
2. Firmware downloads should be protected in transit (i.e. HTTPS/TLS)
3. Any identifiers used to authorize access to and/or track downloads and installations of new firmware should be limited to the Printer and not the Printer's owner, organization, etc. IOW, "this is a valid Example Corp Laser Printer 2000 with SN 12345 that is entitled to receive firmware v2.0" - this allows the vendor to broadly know what version(s) of firmware are in use, whether there have been issues installing new firmware, etc. but not to know that Alice hasn't updated the firmware in her Printer for the last 18 months.
4. Firmware Repositories can potentially combine Printer identity information with IP addresses, routing info, etc. to determine the identity of owners (privacy consideration for using OTA updates...)
I know we don't want to dig too deep with this, and I certainly don't want to provide a roadmap for abusing OTA updates, but it seems appropriate to outline some of the risks and highlight best practices...
On May 21, 2026, at 4:32 PM, Kennedy, Smith (Wireless & IPP Standards) via ipp <ipp at pwg.org<mailto:ipp at pwg.org>> wrote:
Hi there,
For IPP Firmware Update Extensions v1.0, does anybody have any recommendations for items to list in the "Security and Privacy" and "Implementation Considerations" sections? I'd like to get that before I produce my next draft, which will be ready for our IPP WG meeting June 18.
Cheers,
Smith
/**
Smith Kennedy
HP Inc.
*/
_______________________________________________
ipp mailing list
ipp at pwg.orghttps://www.pwg.org/mailman/listinfo/ipp
________________________
Michael Sweet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.pwg.org/pipermail/ipp/attachments/20260630/ff2a4b7c/attachment.html>