Subject: Re: [Shutup] [ietf-smtp] Proposed Charter for something

From: "John Levine" <[email-masked]>
Date: 8 Dec 2015 20:42:27 -0000

>I'm going to have some time starting in January to devote to this.
>And I'm willing to put together a laundry list of issues-to-consider,
>which will no doubt be incomplete, wrong, and poorly written.  But it
>would at least be a revision 0.1 try at enumerating the things we
>could/should discuss.

I recently noticed RFC 5111 which describes an Exploratory Group, sort
of half way between a WG and a RG.  This seems like a good fit.

R's,
JOhn

---

From: Martijn Grooten <[email-masked]>
Date: Wed, 9 Dec 2015 20:33:58 +0000

> of half way between a WG and a RG.  This seems like a good fit.

I wasn't familiar with that concept, but I agree, it seems like a good
fit.

Martijn.

---

From: Dave Crocker <[email-masked]>
Date: Wed, 9 Dec 2015 13:17:53 -0800

> of half way between a WG and a RG.  This seems like a good fit.

Here's why it isn't:

     The distance between the current state of the community and the
ability to start a productive working group is not merely the matter of
clarifying a few issues.

     The community has no overall sense of privacy protection, nor
efficacy of choices, nor... well, many things.

      Absent a basic, systems-approach to guide community effort, for
doing anything but the most blindingly obvious steps for protection, the
community will be executing a random walk through a very complex face.

      This will essentially guarantee spending quite a lot of time and
money on an effort that will have little benefit.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 Dec 2015 08:28:58 -0500

--On Wednesday, December 09, 2015 13:17 -0800 Dave Crocker
<[email-masked]> wrote:

> 
>> I recently noticed RFC 5111 which describes an Exploratory
>> Group, sort of half way between a WG and a RG.  This seems
>> like a good fit.
> 
> Here's why it isn't:
> 
>      The distance between the current state of the community
> and the ability to start a productive working group is not
> merely the matter of clarifying a few issues.
> 
>      The community has no overall sense of privacy protection,
> nor efficacy of choices, nor... well, many things.
> 
>       Absent a basic, systems-approach to guide community
> effort, for doing anything but the most blindingly obvious
> steps for protection, the community will be executing a random
> walk through a very complex face.
> 
>       This will essentially guarantee spending quite a lot of
> time and money on an effort that will have little benefit.

And, if we have learned anything from either more traditional
security designs or protocol design for complex systems more
generally, it also predicts to ending up with a "solution" that
is replaces whatever attack vectors we are trying to eliminate
with others -- perhaps new and perhaps latent there already but
not discovered by the process that is used.

    john

---

From: "John Levine" <[email-masked]>
Date: 10 Dec 2015 15:15:41 -0000

>The real question is: would spam filters still be
>able to do a good enough job if we removed these things?

No, it's not.  The question is whether there would be an overall
gain in users' privacy since providers would likely be less able
to combat phishing and other privacy attacks.

Spam filtering is just part of it, and in this case not where the
most important effects would be.

R's,
John

---

From: Martijn Grooten <[email-masked]>
Date: Thu, 10 Dec 2015 16:40:41 +0000

> most important effects would be.

I meant "spam filters" in the broad sense, including all human and
non-human activity against spam, though should have made that clear.

Are there other parts of the email headers that are important to
combat phishing and other "privacy attacks", apart from the submission
IP address? And how much does the actual IP address matter, as opposed
to a "cryptographic blob" of said address, that can be "decrypted" by
the ISP and is constant for some time for a given (user,IP) combination.

Martijn.

---

From: Richard Clayton <[email-masked]>
Date: Thu, 10 Dec 2015 16:56:29 +0000

In message <[email-masked]>, Martijn Grooten
<[email-masked]> writes

>And how much does the actual IP address matter, as opposed

an IP address generally indicates the ISP and country of origin (but
there's a number of edge cases)

for many individuals there is only a short-term linkage between
themselves and the IP address (think dialup, DHCP systems for broadband
and carrier grade NAT solutions for mobile) so you can seldom use it for
long-term tracking of activity ("what else has this person done")

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

---

From: Martijn Grooten <[email-masked]>
Date: Thu, 10 Dec 2015 17:11:22 +0000

On Thu, Dec 10, 2015 at 11:16:40AM -0500, Chris Lewis wrote:
> There really are no technical differences whatsoever between a
> blackhat and a whitehat trying to protect their identity. The ONLY
> saving grace is that (in the spam space) the blackhat is forced to
> resort to methods that scale high enough for an adequate ROI, while
> the whitehat usually doesn't care that much.

Most spam filtering - again used in the broad sense - only cares about
the identity of the sending organisation (ISP, company, etc.). And
sometimes not even that. If an email body matches some (fuzzy)
signature, it gets blocked, often regardless of who sent it from where.

It's only when said organisation doesn't do a good enough job of
checking the identity (or the hat colour) of the sender, that being able
to find the actual sender matters to everyone else.

> Tor, for example, being a case in point.  Tor would be ideal for
> spam. And it was for a bit.  Slow, but worked.  I don't know whether
> the fact that the tor network became so slow as to be unuseable, or
> that the screams from the "spammed" turned the day, but so few tor
> exit nodes support outbound port 25 nowadays that it isn't a big
> problem.

If they hadn't all blocked that port (it's the default, I believe) then
every DNSBL would add the exit nodes; Tor, by design, doesn't hide the
nodes' IP addresses and it's easy to check if a certain IP address is
or was a Tor exit node at a given time.

Tor in an email context should be used to connect to an ISP's or
corporate mail server. It's up to them to decide whether they have
enough reason to believe youare a whitehat. Many believe they are able
to do so, though they often require a one-time phone verification.

If being able to hide (the geolocation of) your submission IP address is
of vital importance, then this is the way to use email. For most people,
this isn't necessary, but it is my belief that at the very least we
should help organisations that wish to protect personal data for all of
its users to do so in a way that doesn't seriously harm the existing
email infrastructure.

Martijn.

---

From: Martijn Grooten <[email-masked]>
Date: Thu, 10 Dec 2015 17:23:36 +0000

> there's a number of edge cases)

The email address does at least indicate the former. Personally, I don't
think country of origin is significant personal information (though here
too there are edge cases).

> long-term tracking of activity ("what else has this person done")

I have been told that in the case of a home ISP, the linkage lasts long
enough that if you send me a job application email from 1.2.3.4 that a
visit to our website three days ago from 1.2.3.4 was quite likely made
from the same house.

I believe this is in part why some legislations consider an IP address
personal data.

A "crypgraphic blob" would still be linked to the customer, but not to
any other activity.

Martijn.

---

From: Steve Atkins <[email-masked]>
Date: Thu, 10 Dec 2015 09:36:41 -0800

> On Dec 10, 2015, at 9:23 AM, Martijn Grooten <[email-masked]> wrote:
> 
> The email address does at least indicate the former.

Only in the cases where the email address is provided by the access ISP
of the user. That's not as common as it was (and the case where all the email addresses
in the domain are used solely by users of the same access ISP is vanishingly
rare).

Cheers,
  Steve

---

From: Richard Clayton <[email-masked]>
Date: Thu, 10 Dec 2015 17:42:30 +0000

In message <[email-masked]>, Martijn Grooten
<[email-masked]> writes

>visit to our website three days ago from 1.2.3.4 was quite likely made

My home cable connection has had the same IP for 15 months... but I
would expect to get a different IP if I powered the cable modem down for
more than a few minutes.

There are no general rules here and almost every possible case is common

>I believe this is in part why some legislations consider an IP address

It's not to do with lifetimes per se because there may exist
organisations that can link the IP to a person....  the test is

        any information
        relating to
        an identified or identifiable
        natural person

and you should read

<http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.
pdf>

for a detailed analysis of each of those four elements.

And then you can amuse yourself for seeing how the UK failed to
transcribe this especially well (so the test is different here) and then
note that the EU is almost certainly going to go forward with a
Regulation next week (so that the UK can't "cheat" in future)

>A "crypgraphic blob" would still be linked to the customer, but not to

all recipients of the email (and the blob) will of course become
processors of personal data (but we all knew that already, didn't we)

- -- 
richard                                                   Richard Clayton

---

From: Chris Lewis <[email-masked]>
Date: Thu, 10 Dec 2015 12:50:47 -0500

> signature, it gets blocked, often regardless of who sent it from where.

I would contend that very little spam filtering cares what the identity 
is at all.  The identifier tokens just being more grist for the 
filtering engine that may help or may not.

For example, Bayes doesn't care what the words it scans mean, it looks 
for statistical similarity with stuff it knows is bad and stuff it knows 
is good.

> to find the actual sender matters to everyone else.

Or, sometimes, when you're trying to figure out where it's going to pop 
up next and/or warn providers of the toxic customer.

> If they hadn't all blocked that port (it's the default, I believe)

Newbie ;-)  It wasn't always that way.  How do you think that came to be 
that way?

> then every DNSBL would add the exit nodes;

Precisely.

> Tor, by design, doesn't hide the

The aforementioned boilerplate describes that in copious detail so as to 
make it easier for the DNSBL operator to use their exit node list to 
whitelist them unconditionally no matter what comes out of them.

Er, no.  We're very polite.  We have boilerplate for that too.

They also get told that at least we don't treat tor nodes any 
differently than any other, and a reminder to not co-locate a tor node 
with their own servers/network and thus share the reputation of the exit 
node.

> its users to do so in a way that doesn't seriously harm the existing

The tor "group" had to make a similar decision, when it came to the 
serious harm to the viability of their own infrastructure by what, at 
the time, was unfettered spam.

I2P is going through a similar revolution now - going from a theology of 
the "bits must be free and more importantly private" to a realization 
that their future relevance relies on not becoming an infamous source of 
harm.  They have to come up with innovative ways to preserve what they 
want it to be, in the face of those wishing to pervert it to being a 
safe haven conduit for their abuse.

---

From: Hector Santos <[email-masked]>
Date: Thu, 10 Dec 2015 13:05:59 -0500

On 12/10/2015 12:42 PM, Richard Clayton wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

I will be surprise if it did.  For my home system, my "dynamic" IP has 
not changed unless the box itself was replaced by my ISP (AT&T).  That 
has happened twice (box replaced) over the last 8-10 years and only 
then did the IP change.  Over those years, there has been times where 
the boxes were powered off for lengthy periods and to my surprise, and 
unlike the earlier days, there was never a new IP assigned.

> There are no general rules here and almost every possible case is common

I personally think the ISP has a contract and business deals with the 
advertising market to make sure to keep dynamic IP boxes "static" for 
as long as possible.   I'm sure they have deals with the "Facebooks" 
and "Yahoos" of the world.

In any case, I am going to pencil in an new SMTP option in our SMTP 
server product:

    [X] Add Receiver Trace Line
        (o) Show Client IP
        (_) Mask Client IP

I think it is important enough because of the improved (and society 
acceptable) BI (business intelligence) software in the market today.

Thanks

-- 
HLS

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 10 Dec 2015 10:48:41 -0800

On Thursday, December 10, 2015 7:16 AM, John Levine wrote:
> ... 
> >The real question is: would spam filters still be able to do a good
> >enough job if we removed these things?
> 
> No, it's not.  The question is whether there would be an overall gain in
users'
> privacy since providers would likely be less able to combat phishing and
> other privacy attacks.
> 
> Spam filtering is just part of it, and in this case not where the most
important
> effects would be.

I am not sure I understand correctly, but it seems the reference to phishing
is in the context of "impersonated users." Bob receives a mail that appears
to come from "[email-masked]." Everything matches, SPF, DKIM, DMARC. So
Bob actually believes the mail comes from Alice, and opens the attachment.
But the mail actually comes from the evil Eve, who somehow managed to
acquire Alice's password, and submitted the phishing message by
authenticating as Alice to Alice's MSA. In that context, if Bob's UA notices
that the submission IP comes from Upper Nowheristan instead of the usual
Mirrorland, Bob's UA could pop up a warning, or block the message. Is that a
correct summary of the concern?

-- Christian Huitema

---

From: Chris Lewis <[email-masked]>
Date: Thu, 10 Dec 2015 14:36:15 -0500

> correct summary of the concern?

If all of these in place world wide (ha!), it would still only apply to 
a small percentage (generally <10%) of the phishing that tries to 
impersonate the email address completely.  Most phishes don't 
impersonate email addresses, just the "friendly" part of the From: line 
if that.

How does SPF/DKIM/DMARC help you with?

Subject: Alert!  Your American Express card has been compromised!
From: "AmericanExpress Accounts" <[email-masked]>

[Especially if razzum.bar's DMARC lines up]

Right now the highest volume spam of all is blind-recipient spoofing on 
behalf of various (for the most part non-finance) companies, and the 
headers are all brand-specific and consistent - except for the 
DKIM-useful header bits which are just plain random.  And infects you 
(with Dyre/Dridex) if you fall for it - just like phishing, but 
infection not identity/account being the payload.

The lack of a unique id of some kind (relatively static in terms of spam 
burst durations), forces the ML (or less sophisticated filter) to treat 
all of the output of a given domain (or MTA) as equal, and it cannot use 
originator distinction to "help" the content filtering.  Which, as we 
well know, is extraordinarily difficult in the case of 419 and 
essentially impossible in the case of CEO phishing.

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 10 Dec 2015 13:19:36 -0800

On  Thursday, December 10, 2015 11:36 AM, Chris Lewis wrote:
> > I am not sure I understand correctly, but it seems the reference to
> > phishing is in the context of "impersonated users." Bob receives a
> > mail that appears to come from "[email-masked]." Everything
> > matches, SPF, DKIM, DMARC. So Bob actually believes the mail comes from
> Alice, and opens the attachment.
> > authenticating as Alice to Alice's MSA. In that context, if Bob's UA
> > notices that the submission IP comes from Upper Nowheristan instead of
> > the usual Mirrorland, Bob's UA could pop up a warning, or block the
> > message. Is that a correct summary of the concern?
> 
> If all of these in place world wide (ha!), it would still only apply to a
small
> percentage (generally <10%) of the phishing that tries to impersonate the
> email address completely.  Most phishes don't impersonate email addresses,
> just the "friendly" part of the From: line if that.

Yes of course. There are many types of attacks, the "mass market" scammers
use crude techniques, and they probably account for the biggest volumes. But
these are not the only ones that we care about. The more sophisticated
"spear phishing" attacks commonly include detailed reconnaissance of the
target and their relations, precisely of the type "hacking Alice to get to
Bob." I think that's what you refer to when you mention "CEO phishing."

We could argue that checking the origin IP is only one of the many possible
ways to harden mail systems against phishing, and that alternatives could be
just as efficient. Maybe. But first, I would like to be sure that we
understand the scenarios in which the origin IP address is used to prevent
phishing.

-- Christian Huitema