Subject: Re: Who are we accrediting?

From: Meng Weng Wong <[email-masked]>
Date: Thu, 1 Jul 2004 01:06:25 -0400

On Thu, Jul 01, 2004 at 01:59:06AM -0000, John Levine wrote:
| 
| I realize that opinions differ, but I would like to see a scheme like
| CSV that uses an IP address to identify an MTA, and handle individual
| messages using something like Domain Keys that authenticates the
| message itself rather than a probably shared message source.  
| 

If Domain Keys signs messages at the MTA, the mix of good
and bad mail you mentioned will all acquire a DK signature.

Used in such a fashion, DK and SenderID both authenticate
the probably shared message source.

If we turn to per-user PGP, we end up with the same problem,
just shifted one level up: viruses will read secret keys and
keysniff passphrases, so PGP signatures emanating from an
owned machine are worth nothing also.

---

From: John Levine <[email-masked]>
Date: 1 Jul 2004 05:53:14 -0000

>and bad mail you mentioned will all acquire a DK signature.

That entirely depends on the MTA's policy.  If I set up my MTA to sign
messages, I'd only sign the ones that I had some reason to trust,
e.g., the sender AUTHed when it injected the message and it's a domain
I know.  Or, of course, a sufficiently robust sender like an internal
mailing list server could sign them itself and my MTA just passes them
along.  But the point is that senders get to decide what messages they
will vouch for, rather than recipients trying to guess from ever more
complex SPF-ish descriptions what mail is good and what mail isn't.

>If we turn to per-user PGP, we end up with the same problem,

If we want PGP, we know where to find it.  We all know about its
key distribution problems, so unless I'm missing something, nobody's
proposing it for MARID or son-of-MARID.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Dave Crocker <[email-masked]>
Date: Fri, 2 Jul 2004 12:19:50 +0800

John,

>>I think checking the HELO *alone* is not an adequate solution to the
>>problem set.  I don't think CSV alone is enough to be effective
>>against spam coming from big ISPs, where good and bad mail may flow
>>from the same MTA.

JL> With any MTA of any size, you're going to get a mix of good and bad
JL> mail.

JL> A fairly fundamental question is whether we consider that to be a fact
JL> of life that MTA operators can't control, or we consider MTA operators
JL> to be responsible for the mail that they send, and evalute them in
JL> view of their entire mail stream.

To re-use some text from a parallel posting of mine:

DC> CSV vets an entire MTA session.  It accredits the MTA based on the
DC> operator of that MTA.
DC>
DC> Current whitelist and blacklist services focus on the MTA network, ie,
DC> the operator of the MTA.  So CSV provides a standardizing mechanism
DC> for existing practise.
DC>
DC> The limitations of that practise are demonstrated every day, but so
DC> are the benefits.

In other words, whatever its limitations, it is already viewed as
having field-tested utility.

JL> I realize that opinions differ, but I would like to see a scheme like
JL> CSV that uses an IP address to identify an MTA,

It recently occurred to me that we should add support for direct IP
Address accredition, if only as a transitional mechanism to facilitate
adoption by those already using IP Addresses based accreditation.
I've already started discussion with my co-authors.

I believe domain-name based accreditation has better economies of
scale and better stability, but it's clear where the current installed
base for this model is...

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>