Subject: Re: [Asrg] Introduction and another idea

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 19 Jun 2003 15:26:37 -0400

At 12:41 PM 6/19/2003 -0600, Vernon Schryver wrote:
>[..]
>
> > Also, blocking base64 encoding would block email schemes where digital
> > signatures are used.
>
>That is entirely mistaken.  You might want to ensure that sender and
>recipient agree on whether to sign the encoded or plaintext versions
>of the message, but that's all.

In the scheme proposed by Art Pollard, a copy of the public key would be 
included with the signed message. Common format for public key certificates 
use base 64 encoded, outright ban of all base-64 email would be a problem 
for this. The point I was trying to make is that outright ban on ALL 
base-64 email is not a simple as it sounds. There are legit applications 
that use it and such banning approach would have to take them into account.

Yakov  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 19 Jun 2003 13:37:57 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

> for this. 

Oh, I hadn't thought of that.   However, you could encode a signature
with either quoted-printable or a binary MIME Content-Type.  Yes, of
course, neither would be as appropriate as Base64.

>           The point I was trying to make is that outright ban on ALL 

That's certainly true.  

As far as I can tell, all calls for bans on Base64 and Quoted-Printable
are based on naive visions on how the system works or simplistic spam
filters.  Base64 and Quoted-Printable are as relevant to spam or
security problems as whether your network uses 4B5B or NRZI.  Base64,
Quoted-Printable, 4B5B, and NRZI can all be decoded with simple, single
pass state machines with only a few bits of state.

I must admit that some of my irritation with HTML is because it cannot
be decode into what the user will see with Internet Explorer or Netscape
as readily.  As far as I can tell, you must generate an HTML parse tree.

Vernon Schryver    [email-masked]

---

From: [email-masked]
Date: Thu, 19 Jun 2003 17:06:26 -0500

>> ...when you actually look at the spam (and viruses, and worms) 
>going
>through the Net, the *great* majority of it is pernicious (and hard to 
>filter)
>due to various tricks generally exploiting HTML, encoded text, and 
>attachments.

>>It's notable, I think, that very little LEGITIMATE E-mail content (and
>relatively few senders) need to send E-mail containing those types of content.

>> In my case, I would probably enable less than 10-15% of my correspondents to
>send me that type of stuff.
>[..]

> Can ISPs on the list provide some statistics on percentage of legimitate 
email coming in as HTML, attachments, base64, etc. 

I'd like to see such numbers.

A lot depends on whether you're talking about message volume (percentage of 
bytes) or message ratios (percentage of messages, disregarding sizes of 
messages).

There are some skewing factors which also need to be taken into consideration, 
such as the fact that Hotmail and AOL (notably) as well as Microsoft Outlook are 
perversely set by default to send HTML-burdened E-mail, and by and large without 
any good reason for that.  In most cases, it's POSSIBLE to force those services 
to send plain ASCII text E-mails, although many users are clueless regarding 
even the need for that, let alone how to do it.  

But it's fairly safe to say that, once AOL and other such large-volume ISPs and 
software vendors get the religion, the great majority of 
needlessly-HTML-burdened E-mail would vanish from the Net in short order.

It would also be interesting to see what percentage of the attachments that ARE 
sent are of what types (dangrous PIF/EXE/SCR/etc versus safe GIF/JPG/PDF/TXT).

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.