Subject: RE: [ietf-dkim] The basic problem with SSP

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 8 Sep 2006 12:02:50 -0700

The sender of the message does not get to insist that the message be accepted.

The owner of the domain does get to state that legitimate messages are signed and to insist that it is extreemly likely that messages without authentication headers are forgeries intended to defraud the recipient. 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Dave Crocker
> Sent: Friday, September 08, 2006 12:56 PM
> To: John Levine
> Cc: [email-masked]
> Subject: Re: [ietf-dkim] The basic problem with SSP
> 
> 
> 
> John Levine wrote:
> >> 2.  I don't care about the breakage and I'd prefer you 
> reject unsigned mail.
> > 
> > Not to put too fine a point on it, but the fundamental 
> question here 
> > is why should the recipient care what the sender claims he prefers?
> > 
> > Anytime you send e-mail to someone, you're basically asking 
> them to do 
> > you a large favor by investing the effort to accept and deliver it.
> > Senders don't get to set rules about what recipients can do.
> 
> 
> or will do or should do.
> 
> bang on, John!
> 
> 
> discussion on the list continues to use a perspective that 
> sounds like the sender gets to dictate things, rather than 
> that the receiver has the option of using information.
> 
> at every turn we should start by asking how a feature will 
> benefit the receive-side and what our basis is for believing 
> that they will *see* that benefit (and hence be motivated to use it)?
> 
> d/
> 
> 
> -- 
> 
>    Dave Crocker
>    Brandenburg InternetWorking
>    bbiw.net
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John L <[email-masked]>
Date: Fri, 8 Sep 2006 15:28:42 -0400 (EDT)

> The owner of the domain does get to state that legitimate messages are 
> signed and to insist that it is extreemly likely that messages without 
> authentication headers are forgeries intended to defraud the recipient.

Right.

And recipients should pay attention to that statement because ... ?

Some people who claim they are heavily phished will be right.  Others will 
not be, and there is no way to tell from the SSP who is ebay and who is 
some dimwit who doesn't understand that you shouldn't say I sign 
everything if you use Yahoogroups.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Fri, 8 Sep 2006 12:51:11 -0700

On Sep 8, 2006, at 12:28 PM, John L wrote:

>> The owner of the domain does get to state that legitimate messages  
>> are signed and to insist that it is extreemly likely that messages  
>> without authentication headers are forgeries intended to defraud  
>> the recipient.
>
> Right.
>
> Some people who claim they are heavily phished will be right.   
> Others will not be, and there is no way to tell from the SSP who is  
> ebay and who is some dimwit who doesn't understand that you  
> shouldn't say I sign everything if you use Yahoogroups.

A statement  "All messages containing this email-address domain are  
initially signed" would be correct for the dimwit that uses  
Yahoogroups, provided there is also an assertion "Only compliant  
services are used that retain initial signatures" can be added to  
this assertion.  The need to clarify this statement is to better  
ensure transactional messages prone to being spoofed are treated  
differently than messages used with common services.  This  
distinction can also apply to specific email-addresses, when  
considering how annotations offer anti-spoofing protections.

-Doug

---

From: John L <[email-masked]>
Date: Fri, 8 Sep 2006 16:09:14 -0400 (EDT)

> A statement  "All messages containing this email-address domain are initially 
> signed" would be correct for the dimwit that uses Yahoogroups, provided there 
> is also an assertion "Only compliant services are used that retain initial 
> signatures" can be added to this assertion. ...

You may rest assured that the dimwit will beat his tiny gorilla chest, 
make all of the most aggressive assertions, and then blame everyone but 
himself when nobody gets his Yahoogroups mail.

One of the most useful outcomes of SPF was the confirmation that people 
are generally unable to get any but the most trivial configuration 
descriptions correct.  An SPF record consisting only of -all is probably 
correct, while an SPF record consisting of something else followed by -all 
is almost certainly wrong.  All of the proposed SSP values other than "I 
send no mail" fall into the latter category.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 8 Sep 2006 16:31:35 -0400

> send no mail" fall into the latter category.
I'd be interested in the data that supports this assertion.

Scott K

---

From: Douglas Otis <[email-masked]>
Date: Fri, 8 Sep 2006 13:47:26 -0700

On Sep 8, 2006, at 1:09 PM, John L wrote:

>> A statement  "All messages containing this email-address domain  
>> are initially signed" would be correct for the dimwit that uses  
>> this assertion. ...
> You may rest assured that the dimwit will beat his tiny gorilla  
> chest, make all of the most aggressive assertions, and then blame  
> everyone but himself when nobody gets his Yahoogroups mail.

I tend to agree with you about this concern.  Two different  
assertions can not be understood or used correctly.

The one assertion: (weak)
   "All messages containing this email-address domain are initially  
signed"

This provides useful information, although not enough to block all  
unsigned messages.

The two assertions: (stronger)
   "All messages containing this email-address domain are initially  
signed" +
   "Only compliant services are used that retain initial signatures"

This provides enough information to block all spoofed messages.  It  
is also likely this assertion should only be applied in exceptional  
cases related to transactional messages.  Otherwise there will be any  
number of upset administrators complaining about delivery problems.   
Here I agree with your concern, which also relates to the use of a  
trusted-domain list as well.

Assume that a trusted-domain list is communicated to the recipient  
via some form of annotation.

Why should anyone trust all messages signed by a trusted domain?

It seems there is a solution to handles both concerns about dimwit  
administrators and too broadly trusting all messages signed by a domain.

Provide some mechanism that allows specific messages to have the  
stronger assertion applied.

There have been several suggestions related to this topic:

  - Mark the key/signature to indicate a stronger assertion applies.
  - Allow email-address specific policy be applied.
  - The DAC suggests additional headers (such headers might not be  
controlled by the administrator).

-Doug