Subject: RE: [ietf-dkim] The basic problem with SSP

From: Arvel Hathcock <[email-masked]>
Date: Fri, 08 Sep 2006 15:02:00 -0500

>> The owner of the domain does get to state that legitimate messages are 
>> signed and to insist that it is extreemly likely that messages without 
>> authentication headers are forgeries intended to defraud the recipient.
>>
> And recipients should pay attention to that statement because ... ? 

Because they don't want to waste time reading forged mail nor pass on forged mail to their subscribers.

> Some people who claim they are heavily phished will be right.  Others will 
> not be, and there is no way to tell from the SSP who is ebay and who is 
> some dimwit who doesn't understand that you shouldn't say I sign 
> everything if you use Yahoogroups.

First, one needn't be phished (or wait to be phished) in order to be motivated to protect one's domain (a key corporate asset) from unauthorized use.  My house has never been robbed, yet my doors all have locks.  Second, the fact that someone might errantly configure a "I sign all" when they shouldn't must not stop us from providing benefit to those who will properly understand and use the system.

-- 
Arvel 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Fri, 08 Sep 2006 13:26:28 -0700

> First, one needn't be phished (or wait to be phished) in order to be
> motivated to protect one's domain (a key corporate asset) from
> unauthorized use.  My house has never been robbed, yet my doors all
> have locks.  Second, the fact that someone might errantly configure a
> "I sign all" when they shouldn't must not stop us from providing
> benefit to those who will properly understand and use the system.

I am quite fond of the house analogy, because our concept of home 
security is actually pretty sophisticated.

For example, it represents a significant balancing act between 
expense/complexity on the one side, versus perceived (and actual) risk 
on the other.

Your house can be broken into.  Quite easily.  So can mine and pretty 
much everyone else's.

We mostly understand just how easily.  Yet we find the current level of 
protection adequate.

We should keep that kind of balancing in mind, when we talk about what 
kinds of security DKIM is expected to provide.

We should that kind of balancing in mind particularly when we find 
ourselves tending to believe that it will provide extensive and basic 
protection against determined and sophisticated attacks.  It won't, 
particularly with respect to interesting forms of phishing attacks. 
Phishing fundamentally entails tricking humans.  There is no known 
technique -- computer-based or otherwise -- for guaranteeing that humans 
will not be tricked.  So the broad statements about the use of DKIM, in 
the service of generically stopping phishing, are quitey simply invalid.

DKIM provides a very modest service.

That's what makes it useful.

The more ambitious are the goals for DKIM, the less likely that it will 
be useful.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Fri, 8 Sep 2006 14:03:23 -0700

On Sep 8, 2006, at 1:26 PM, Dave Crocker wrote:

> ourselves tending to believe that it will provide extensive and  
> basic protection against determined and sophisticated attacks.  It  
> won't, particularly with respect to interesting forms of phishing  
> attacks. Phishing fundamentally entails tricking humans.  There is  
> no known technique -- computer-based or otherwise -- for  
> guaranteeing that humans will not be tricked.  So the broad  
> statements about the use of DKIM, in the service of generically  
> stopping phishing, are quitey simply invalid.

I agree.  DKIM by itself may only slightly slow the rate of  
successful phishing attempts.

DKIM used in conjunction with an intelligent MUA annotating email- 
addresses found within the address-book when assured valid by  
associated DKIM signing domains, can significantly reduce the success  
rate of phishing attacks.  These annotations should become the gold- 
standard before recipients act.  This should also improve the open  
rate of valid messages.  This could be seen as being analogous to  
that of the browser lock-symbol.  To help boot-strap this effort,  
policy could assist this effort by also offering specific email- 
addresses assured by listed domain.

-Doug