Subject: [ietf-dkim] SSP is the Sender Signing Practices, not the Sender's accreditation

From: wayne <[email-masked]>
Date: Thu, 09 Nov 2006 10:34:51 -0600

*sigh*

As Wiestse recently said, much of this discussion has been gone over
many times and already archived.  From what I can tell, he seems to
think this all implies that the usefulness of SSP has already been
discussed and dismissed, and is wondering why these points are being
raised again.  I see just the opposite, I see it as having been
discussed and understood where it can be useful and am wondering why
these points are being raised again.

Several others have cast doubt on the usefulness of SSP because it
doesn't solve the phishing problems, especially the look-alike domain
stuff.  I see this as being a red-herring.  SSP is not designed to
solve the phishing problem.

Sender Signing Practices is designed to tell you about the sender's
signing practices.  The sender isn't telling you about whether the
they are good or bad.  They are not offering accreditation or vouching
services for them.  They are telling you what they do and do not do.

If a sender says that they sign all their email, and you receive an
email that is not signed, you can tell that this email is suspicious.
You don't need to know whether the sender is a good actor or a bad
actor.  You don't need to query any trust system.  You know that this
email does not conform to what the sender says their practices are.

Due to known situations that break signatures, you can not be
absolutely certain that an email that arrives without a valid
signature but with a SSP that says "I sign all email" isn't
legitimate.  As a receiver, you may be able to use additional
information that you know, but the sender doesn't know, to help
resolve this situation.  For example, I know that dkim.org sends a lot
of email that is both legitimate and breaks signatures.

If a sender says that they do not send email, and you as a reciever
find an email with their domain in the 2821.From:, you can not only
tell that the email is suspicious, but that you can reject the email
with much less chance of creating a false positive.

If a sender says that they sign some email, then as a reciever, you
haven't learned anything.  This isn't really useful per-se, but it is
needed to distinguish between the status-quo and other more useful
cases.

If the sender says that they sign all email, that they have taken
steps to make sure that they do not send email through known mungers,
and that you, as a receiver, can put the blame on any false positives
on the sender, then you can much more safely reject email without a
valid signature.  Again, this is the sender saying something that the
receiver can not know by themselves.  This is something useful for the
sender to say and for the receiver to hear.

DKIM, with or without SSP, does not solve the phishing problem, nor
the spam problem.  DKIM, in conjunction with one or more reputation
systems, may help here, but this has little to do with SSP.

-wayne

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Steve Atkins <[email-masked]>
Date: Thu, 9 Nov 2006 09:10:00 -0800

> solve the phishing problem.

Yet that is the use case that seems to keep coming
up.

What is the real use case for SSP, in your opinion?

Not an abstract "well, the sender says they sign mail
and this mail isn't signed, so it's bad" sort of thing, but an
actual real-world example.

I think that would go a long way towards shining
some light on the goals, the current state and the
spaces between them.

Cheers,
   Steve

---

From: "John R Levine" <[email-masked]>
Date: 9 Nov 2006 12:22:36 -0500

> services for them.  They are telling you what they do and do not do.

I wanted to check that nobody was claiming that it did anything else.

> systems, may help here, but this has little to do with SSP.

Right.  So we agree that we have yet to show any plausible reason that SSP
would be of use to receivers.

If the theory is that it's only useful with a reputation system, perhaps
we should be more explicit about how we anticipate those systems will work
and what functions they will serve.  You can probably guess what my
opinion is.

R's,
John

---

From: Michael Thomas <[email-masked]>
Date: Thu, 09 Nov 2006 09:33:59 -0800

> What is the real use case for SSP, in your opinion?

s/the/a;

~/.spamassassin/user_prefs:

score SSP_VIOLATION .79

Is this really that difficult?

       Mike

---

From: Michael Thomas <[email-masked]>
Date: Thu, 09 Nov 2006 09:33:09 -0800

s/the/a;

score SSP_VIOLATION .79

       Mike

---

From: Michael Thomas <[email-masked]>
Date: Thu, 09 Nov 2006 09:35:17 -0800

s/the/a;

score SSP_VIOLATION .79

       Mike

---

From: wayne <[email-masked]>
Date: Thu, 09 Nov 2006 12:28:32 -0600

> would be of use to receivers.

No, I don't agree at all, I never said that and I don't like you
putting words into my mouth.

A tool does not have to completely solve a problem in order for it to
be useful.  DKIM and SSP help solve domain forgery problems.  This is
a problem made worse by spam and phishing.  DKIM, by it self, seems to
only really solve the "who can I blame for sending/relaying this
spam?" problem, something which is already fairly well solved.
Without SSP, I really don't see any use in DKIM at all.

-wayne

---

From: Dave Crocker <[email-masked]>
Date: Thu, 09 Nov 2006 10:44:54 -0800

> ~/.spamassassin/user_prefs:

Michael,

The above is so wonderfully precise, concise and cryptic, that I am entirely 
missing your point.

Could I ask you to provide enough text to explain what point you are making and, 
of course, why/how this example makes the point?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Thu, 09 Nov 2006 11:39:35 -0800

Dave Crocker wrote:

> The above is so wonderfully precise, concise and cryptic, that I am 
> entirely missing your point.
>
> Could I ask you to provide enough text to explain what point you are 
> making and, of course, why/how this example makes the point?

This is hardly rocket science. Filters could make use of the fact that 
there was a
SSP violation. Filters like, oh say, Spamassassin. He asked for "the" 
reason, I
offered "a" reason. There are others.

Note that the first question offered a false choice: there need not be 
"The" reason
for SSP or DKIM for that matter. There may be a variety of reasons why 
it's useful
to a variety of different people, where a preponderence of reasons 
amongst a
preponderence of people who think they're useful is good enough reason to
specify it. For the people who think it's not a very useful thing, I'd 
suggest that
it would be a better use of time to find something that *is* useful 
rather than engaging
in a futile intrinsicist debate .

       Mike