Subject: Re: [Asrg] AOL vs the Internet -- Are they opting out? (fwd)

From: "Alan DeKok" <[email-masked]>
Date: Sun, 27 Jul 2003 08:51:44 -0400

Dave Crocker <[email-masked]> wrote:
> AD>   When I roam cross-country,
> 
> how about cross-world?

  I fail to see how the net changes when I roam inter-country, as
opposed to intra-country.  The authentication & other network
protocols I use are the same.  In many cases, I use the services of
the same global company.

  The only things which change are local implementations.

> how about with a laptop, using pop/smtp, rather than web user interface
> to your home email application?
> 
> how about when connected to a remote network, such as a clients?
> 
> Or from a hotel, using your laptop?

  Any problems with those activities come ONLY from poor or inadequate
local implementations.

> The problem with requiring prior consent to the delivery of email is not
> about users logging in to their email service.  Is about senders
> "logging in" to recipients, before they can send mail to them.

  Which is a situation I've never proposed or supported.

  I have repeatedly said that it's the problem of the local network to
verify its users, and to ensure that their behaviour satisfies the
local AUP (i.e. consent).  It's the problem of the local network to
coordinate AUP/consent for any roaming user with that users home
domain.  It's the problem of the local network to make that consent
available to the rest of the net, so that they can use it, if they so
desire.

  The end result is that the "recipient" of an email has to do minimal
work, in order to verify consent.  The recipient can easily gain
enough information about the identity of the sender, in order to make
informed decisions as to whether or not to accept the message.

  In contrast, your position paradoxically requires the very thing you
appear to oppose.  NOT enforcing local consent, and NOT exposing that
consent to the network, means that the recipient MUST perform ALL of
the work of authenticating the sender, by applying content filters,
white lists, key signing, challenge-response, etc.  i.e. The sender
must effectively "log in" to the recipient, and satisfy expensive
authentication methods.

  This result is what boggles my mind about the position of "roaming
users MUST be able to send messages from anywhere, claiming to be
anyone."  It's an a priori requirement that the recipient must perform
all of the work to establish consent, and the sender must perform no
work.  So the sender does whateever the heck he wants, and the
recipient is forced to deal with it.  Where's the "consent framework
for communication"?

  The fact is that current issues related to roaming & consent are
largely issues of implementation.  The information exists and can be
used.

  Alan DeKok.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Sun, 27 Jul 2003 08:42:43 -0700

Alan,

AD>   I fail to see how the net changes when I roam inter-country, as
AD> opposed to intra-country.  The authentication & other network
AD> protocols I use are the same.  In many cases, I use the services of
AD> the same global company.

In many cases, one can not. This changes the issues for authentication
and inter-administration authorization.  Different access services
employ different rules.  Sometimes the rules collide.

AD>   The only things which change are local implementations.
>> Or from a hotel, using your laptop?

AD>   Any problems with those activities come ONLY from poor or inadequate
AD> local implementations.

That is a facile, but not very useful response.  First it contains no
substantiation of such a dismissal, and second it ignores the realities
that users experience.

AD>   In contrast, your position paradoxically requires the very thing you
AD> appear to oppose.  NOT enforcing local consent, and NOT exposing that
AD> consent to the network, means that the recipient MUST perform ALL of
AD> the work of authenticating the sender, by applying content filters,
AD> white lists, key signing, challenge-response, etc.

My "position" is to pay attention to the vagaries and needs of the real-world,
rather than assume that we can operate things simplistically.

That sort of "position" tends to work far better for getting viable
services that people will actually agree to.

AD>  i.e. The sender
AD> must effectively "log in" to the recipient, and satisfy expensive
AD> authentication methods.

AD>   This result is what boggles my mind about the position of "roaming
AD> users MUST be able to send messages from anywhere, claiming to be
AD> anyone."

The error of this sort of consent model is that it requires global
enforcement of network access identification and that it be used to
substantiate author identity. This a) ignores a variety of valid ISP
business models that do not permit that correlation, b) ignores the fact
that identification does not ensure legitimate behavior, and c)
identification does not ensure enforceability.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 27 Jul 2003 14:20:14 -0400

Dave Crocker <[email-masked]> wrote:
> substantiation of such a dismissal

  ... and as such, reminds me of previous messages in this thread.

  Still, it's not that difficult to figure out.  Someone has issues
roaming, but doesn't have issues when not roaming.  Is the problem the
Internet as a whole?  No, that hasn't changed.  Is it their local
machine?  No, that hasn't changed.  Is it their home ISP?  No, that
hasn't changed either.

  Ergo, it must be the only item in their use of the network which is
different: the ISP they're using while roaming.

>, and second it ignores the realities that users experience.

  What realities?  I've already addressed the fact that ISP's have
broken implementations, and don't communicate or enforce consent.
These issues should be addressed.  Beyond that, I haven't seen you
bring up any additional "realities" that users experience.

> rather than assume that we can operate things simplistically.

  You've proven that both of us can come up with facile and not useful
responses.  So?

> substantiate author identity.

  I'm confused as to whether that's a tautology or a non sequitor.

  "users roaming globally require global enforcement of identity".
Yes, so?  How else can they roam globally?  There's no requirement to
use SSN's or passport #'s as identifiers.  Instead, we currently have
near-random user names.

  People can have more than one identity.  Look in your wallet, I'll
bet you've got 3-4 pieces of plastic, each with a ~10 digit identity.

> This a) ignores a variety of valid ISP business models that do not
> permit that correlation,

  There are ISP business models which perform *no* authentication of
users on their network?  And which make no statement about their
consent to behaviours of those users?  Which do not make those users
accountable for any of their actions?

  The fight against such ISP's is mainly a legal one: criminal
indictments.  There's little the net can do to fight them, other than
simple disconnection.

> b) ignores the fact that identification does not ensure legitimate
> behavior, and c) identification does not ensure enforceability.

  Identification ensures accountability.  Accountability ensures that
recipients can choose to enforce consent for accountable senders.
Senders who are not accountable for their behaviour cannot, by
definition, establish a consent framework for communication with a
recipient.

  I think you hit the nail on the head, there.  Establishing mutual
consent is NOT about ensuring "legitimate" behaviour, and it's NOT
about enforcing that behaviour.  It's about the sender being able to
make statements about his behaviour, and the recipient being able to
choose to stop communicating with the sender when his actions don't
match his words.

  As an attempt to reach a common ground, I will state explicitely
that a network BCP SHOULD say that ISPs MUST permit their users to
exchange or enforce consent.  This means exchanging consent with home
domains for roaming users, not blocking port 25, or other stupid local
"filters" which don't help the spam problem, but which prevent normal
network communication.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 28 Jul 2003 22:21:48 +0200

Dave,

> employ different rules.  Sometimes the rules collide.

Why? Even roaming users access their POP3/IMAP Mailboxes from everywhere.
   Request for Comments: 2554, March 1999
       SMTP Service Extension for Authentication
is four years old. The concept of SMTP after POP is even older.
Authorization shouldn't be that problem.

> substantiation of such a dismissal, and second it ignores the realities

The reality is that we all suffer. Without pressure and making public
solution that are state-of-the-art for almost 4 years to help the users
add pressure to their provider or even just tell them there ARE
solutions despite what their ISP claims, nothing will change.

And in the end it always breaks down to "you get what you pay for".
One can't expect to get the quality of a Porsche for the price of a
Volkswagen Beetle. In the "real world" everyone understands this
concept. But in the Internet there is "anarchy" and "everything is
possible" and of course it has to be free :/ And with everything that gets
restricted there are a few that are unhappy. However I'd guess that
if no "remote" mailserver would accept emails from dialin IPs at most 1%
of all Internet users would recognize the change at all (besides the drop
of the virus/spam rate that is).

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"