Subject: RE: PRA Patent: License for Display in MUAs?

From: "Jim Lyon" <[email-masked]>
Date: Fri, 3 Sep 2004 08:54:54 -0700

On Thursday, September 02, 2004 at 7:38 PM, William Leibzon wrote:

> Microsoft may have misled others that SenderID and PRA algorithm can
be 
> used by MUAs to verify email (because of their dominance in MUA market
on 
> Windows PCs, they need something for MUAs). That is not true.

In spite of William's repeated assertions that it can't be done, we have
built prototypes internally that do exactly that.  They work.

Briefly, the algorithm is:
  1. Grovel through the Received: headers to find the header
     describing the hop where the message entered the current
     organization.
  2. Extract the PRA from the [Resent-] Sender and From headers
     as usual.
  3. Apply the SenderID algorithm.  [Actually, our prototypes 
     used the earlier CallerID algorithm, but the point remains.]

William also implies that Microsoft would intentionally mislead people
to believe that SenderID can be used in MUAs when it cannot.  In the
first place, I resent the insinuation.  In the second place, were such
misleading to occur, it would hurt Microsoft more than anyone else,
precisely because we provide more of the world's MUAs than anyone else.

-- Jim Lyon

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 3 Sep 2004 13:55:45 -0700 (PDT)

> built prototypes internally that do exactly that.  They work.
I assert that it works because you know exactly which mail server your MUA 
is connecting to and for general case MUAs would not work.
 
>      describing the hop where the message entered the current
Received headers have no standartization - there is not RFC requirement 
to add ip address of the client or its EHLO name into the header. How 
this information is entered in received header varies from MTA to MTA
(closest semi-standard is sendmail way of adding data into received).

Same system may add multiple received headers (qmail and postfix do in 
some cases) and there maybe several systems on receiving ISP end before 
email came to MDA, trying to determine which received header to check so 
that it is the one entered by MTA that received mail from external source 
is very hard and will lead to errors and may even cause to choose header 
that was forged by spammer.

>   2. Extract the PRA from the [Resent-] Sender and From headers
In some cases PRA may have changed after received header (for example on 
receiving ISP end, mail was received by gateway, forwarded to intermediate 
system and then forwarded to MDA; forwarding server may have added its own
resent-from header resulting in MUA system checking its own ISP instead of 
external system).

> to believe that SenderID can be used in MUAs when it cannot.
> In the first place, I resent the insinuation.
I apologize if you understood my remarks as meaning that you -intentionally<- 
misled anybody (nor did I ever use those words). I meant that because of
Microsoft MUA share you want algorithm that would work om MUAs and expect 
SenderID  to work there (but not that you knew it would not work there and 
eventhough still said that it would).

> In the second place, were such misleading to occur, it would hurt 
> Microsoft more than anyone else, precisely because we provide more of 
> the world's MUAs than anyone else.
Yes. That is why you should be carefull about trying to apply SenderID 
algorithm in MUAs and understand that there would be great number of 
errors with such approach that might be blamed on MUA programmers. We
should focus MARID efforts on MTA authorization as WG charter said and
in my view doing authorization several email hops after is bad idea.

And while displaying PRA by itself in MUA would not lead to anything bad 
and should probably be done, trying to assert if it was verified or not 
should only be done when you have data indicating that MTA in fact done
such authorization.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 3 Sep 2004 14:23:08 -0700 (PDT)

On Fri, 3 Sep 2004, Jim Lyon wrote:

> > Microsoft may have misled others that SenderID and PRA algorithm can be 
> > used by MUAs to verify email (because of their dominance in MUA market on 

> first place, I resent the insinuation.  

I'm going to apologize again, I never meant to make a statement that somebody
intentionally is doing anything bad as far as SenderID algorithm or its 
implementation in MUA or anywhere else.

I note my original statement said  "Microsoft may have misled others"
and its part of the phrase for which I dropped one important word, this 
should have been "Microsoft may have unintentionally misled others" and 
this is not a very strong statement at all if they did or not. Again I 
aplogize to Microsoft and others.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: <[email-masked]>
Date: Fri, 3 Sep 2004 12:55:47 -0400

>      used the earlier CallerID algorithm, but the point remains.]

Note that in fact this algorithm does not properly implement Sender ID
in the MUA.  The problem is that people might not read email until
days or even a week after you send it.  For dynamically assigned IP
addresses, the IP address in the header will no longer be valid.

For examply, suppose my computer is called mybox.dyndns.org.  I always
make sure that the DNS name points to my IP address.  Thus, I publish
"+a -all" as my SPF2 record.  If my ISP switches my IP address every
day at midnight, and you read my mail the following day, you will
extract an old IP address from the Received header and therefore deem
my mail a forgery.

One of the objections people have raised to both SPF and to Sender ID
is that they are bad for individual domain-name owners, and only work
for large organizations.  Until now, I thought there were no grounds
for such an objection--just people who didn't understand what was
really going on.  If, in fact, Microsoft is thinking of implementing
something in Outlook that would essentially freeze out people with
dynamic IP addresses, I actually find that quite alarming.  If people
knew this, I think you would find a lot more technical objections to
Sender ID.

David