Subject: RE: [Asrg] 2. Improving Blacklists and Reputation Services

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Feb 2004 13:59:41 -0800

> Correct which is what the current blacklists do. It is upto you to 
> figure out whose opinions you trust. An accrediation service 
> is vouching 
>   for someone, a reputation service is stating an opinion of 
> someone's 
> reputation. The two things are different.

Absolutely not. An accreditation service is simply stating a fact, any fact
at all about the subject.

Every forum I have attended where accreditation has been discussed has used
it in this sense.

Attempting to differentiate reputation is doomed to failure because it is a
distinction without a difference. If I state fred is a member of the new
york state bar a part of that statement is that fred met their character and
fitness criteria when he applied and he has not been kicked out since.

So that is an accreditation by the bar that includes a reputation component.
Most accreditations will incorporate reputation in some degree.

The whole point of introducing the term was to serve as a more illustrative
name for what in SAML are called 'attribute assertions'.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 09 Feb 2004 17:43:25 -0500

> at all about the subject.

Ok, I will accept that (although somehow whenever I think 
"accreditation" I am getting a knee-jerk reaction that it will 
automatically cost money).

So what we have is as follows (I think):
1. MTA identity.
2. Domain identity.
3. Sender's identity.

And now different accreditation services that provide facts about that 
subject in two situtations:
1. The sender/MTA/domain explicitely states that it is accredited with a 
specific service.
2. The receiver uses an accreditation service to obtain information such 
as reputation about a specific subject without that subject telling the 
receiver anything.

Several things bother me here. First of all, the MTA, sender and 
sender's domain are different identities and require different 
mechanisms. The MTA might want to advertise accreditation with ESMTP or 
DNS, while the domain or sender might want to do so via an email header.

Second, checking multiple accreditation authorities with a more 
complicated syntax slows down the filtering process.

Third, checking accreditation on per sender basis slows things down even 
more and allows for a DDOS attack against the accredidation authority 
and the receiver.

> name for what in SAML are called 'attribute assertions'.

An interesting thought - can we use SAML for exchanging reputation and 
accreditation info?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"One who watches the wind will never sow, and one who keeps his eyes on 
the clouds will never reap" (Ecclesiastes 11:4)
-------