Subject: Re: [ietf-dkim] A few SSP axioms

From: Steve Atkins <[email-masked]>
Date: Mon, 31 Jul 2006 19:21:34 -0700

On Jul 31, 2006, at 7:15 PM, John L wrote:

>> As long as we all remember that bad actors can get a domain, populate
>> dkim keys and ssp then send spam until they are noticed and shutdown.
>
> I hope we all understand that if SSP is useful at all, it's only  
> about authentication, not reputation.
>
>> Policy will be by the receiver that a message that fails dkim/ssp is
>> flagged for a closer examination than a message that passes both dkim
>> and ssp but all mail will continue to be scrutinized.
>
> In the forseeable future, the main use of DKIM is likely to be more  
> reliable whitelisting of people you already know you like.

And to provide (opt-in) feedback loops to some subset of bulk senders.

In volume terms these two are going to hugely dominate that subset
of email which is validly signed and to which the recipient pays much
attention to that signature, for the near future at least.

Cheers,
   Steve

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 01 Aug 2006 16:28 -0400

On Tue, 01 Aug 2006 18:13:16 +0100 Stephen Farrell 
<[email-masked]> wrote:
>
>Hector,
>
>Hector Santos wrote:
>>> There has been suggestion in the past of the desire for a policy
>>> for "I sign everything, don't accept a message with *any*
>>> third party signatures". I've yet to see why anybody would
>>> want to set such a policy in real life though.
>> 
>> hmmm, Isn't this "highly exclusive" policy just happens to be the most
>> powerful protection the DKIM protocol has to offer?
>
>So, you're saying that...
>
>"A says he signs everything"
>
>     ...is "weaker" than....
>
>"A says he signs everything and no-one else is allowed to sign A's mail"
>
>What's the benefit for the signer/originator or the verifier? I just
>don't see one.
>
Personally, I don't see it as stronger/weaker, just different.  Some 
domains will come to DKIM wanting to make the most positive statement they 
can about the messages they send.  Others will come to DKIM wanting to make 
the most negative statement they can about the messages that they did not 
send.  

Scott K

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 01 Aug 2006 22:15 -0600

On 2 Aug 2006 03:30:50 -0000 John Levine <[email-masked]> wrote:
>>There can be other policies but I require those two and am wondering why
>>there seems to be a tremendous pushback on this. 
>
I think there is so much pushback on this because it is smething different.

>You must have a very different model of SSP use from the rest of us.
>
I agree.  We are talking sender signing policy and it seems to me that Bill 
is talking Signer Sending Policy.

It's a take on the problem space I hadn't considered.  At this point where 
we are collecting requirements, I think we ought to be liberal in what we 
accept, but that equally everyone ought to understand that this initial 
policy protocol document is unlikely to meet all the requirements we 
collect.

Scott K

Bill, I th