We just purchased JIRA to handle our support issues, and were surprised there's no separate permissions for attachments. Our support issues always involve binary files containing usernames and passwords. Our customers need to be able to attach these files in order for us to solve their support problem, but, since those files contain usernames and passwords, they must not be viewable by other users.

Ideally we'd be able to configure it so that users could upload and view their own attachments, but not attachments for support issues created by others.