Subject: Re: [ietf-dkim] the alleged list problem, was If DKIM would ignore

From: Michael Deutschmann <[email-masked]>
Date: Tue, 5 Apr 2011 00:05:48 -0700 (PDT)

On 31 Mar 2011, John Levine wrote:
> Quite right.  It would be helpful to me if people could explain what
> problem they're trying to solve when they bring up mailing lists yet
> again.  "Some lists break submitters' signatures" is a fact, not a
> problem.  "I am trying to do X with my list mail, but I can't so I
> have to do Y instead" would be a problem.

Isn't it obvious?

We'd like to be able to deploy DKIM, coupled with some ADSP-like protocol
(The real ADSP is hopelessly inadequate) in order to block all forgeries at
the MX.  *All* forgeries, not just phish.  And I emphasize this should be
automatic -- suspect messages should be rejected, not merely highlighted so
the user can decide whether the signature breakage was innocent.

But the fact that most actual users post to mailing lists and obviously do
not want those posts blocked, coupled with the fact that the mailing lists
break signatures, means that the obvious implementation would have an
unacceptable false positive rate.

So we need to make a hole -- hopefully as small as possible -- in our
ADSP-like protocol so that mailing list traffic can get through.
Otherwise no one will deploy it in a useful way.

---- Michael Deutschmann <[email-masked]>
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "John Levine" <[email-masked]>
Date: 5 Apr 2011 13:22:00 -0000

>Isn't it obvious?

Yes, but not in a good way.

>the MX.  *All* forgeries, not just phish.

Well, as we've established long past the point of boredom, you can't.
And it's not just mailing lists.  Don't forget all the mail that bots
can send with real stolen credentials, and mail to a friend, blah
blah.  (This is not an invitation to reargue those points.)

>Otherwise no one will deploy it in a useful way.

Hmmn.  Give that this is all entirely hypothetical, it belongs in the
ASRG, not a standards group.  See you there.

R's,
John

---

From: Michael Deutschmann <[email-masked]>
Date: Tue, 12 Apr 2011 23:45:57 -0700 (PDT)

On 5 Apr 2011, John Levine wrote:
(> > = me)
> can send with real stolen credentials,

Small semantics issue here.  You are using a vertical "all" (eg: "With this
ADSP-alike, it will be beyond impossible for a @paypal.com mail to get
through that is not sanctioned by PayPal's legitimate officers.").  But I
meant a horizontal "all" (eg: "With this other ADSP-alike, @paypal.com
forgeries are reasonably expected not to get through, and neither are
@gmail.com forgeries or @iecc.com forgeries.").

By stating "all", I was distancing myself from those here who consider it
Not A Problem that Gmail is never going to deploy "dkim=discardable", since
Gmail is "not a phishing target".

> and mail to a friend, blah

There is a difference in kind between mailing lists and all other "friendly
forgery" cases such as F2F.  Providers of F2F will likely give up and use
original From: addresses before end-users give up and (force their BOFH to)
undeploy ADSP.  But the mailing list problem for ADSP is even bigger than
SPF's forwarding bugaboo -- it utterly scares off meaningful senderside
deployment.