Subject: RE: [ietf-dkim] Re: "I sign everything" yes/no

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 26 Nov 2006 06:20:06 -0800

> [mailto:[email-masked]] On Behalf Of Eliot Lear

> That leaves the cases.  Here, the simple answer is that a 
> message must make it TO the originating domain to be signed.  
> That's a change, but not a huge one from my perspective.  
> Some GPRS based phones already let you specify a mail system. 

>  There is a business model issue that potentially gets in the 
> way, but I'm not sure we should code to it.  

I think that's probably a short lived issue same as walled gardens were. The carriers will eventually realize that they are just pipes and that any attempts to extract rent from the commodity position of pipe provision is doomed to fail as they net reduce the value of the service

> Netnews is a separate case, but again not worth delving into here.

It is out of scope but well worth people looking into. My guess would be that it should just work. NNTP is a much cleaner environment as NNTP servers do not as a rule make arbitrary conversions to messages as many SMTP servers do. 

Deploying DKIM just within the NNTP environment as a spam control measure could make a lot of sense. It will inevitably happen as people write DKIM aware mail/news clients.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Sun, 26 Nov 2006 15:21:24 -0500

----- Original Message ----- 
From: "Hallam-Baker, Phillip" <[email-masked]>

> It is out of scope but well worth people looking into. My guess would be
> that it should just work. NNTP is a much cleaner environment as
> NNTP servers do not as a rule make arbitrary conversions to
> messages as many SMTP servers do.

Agree. Also NNTP has a stronger posting requirement. The loopholes have been 
ironically the advent on web site systems, which started out as readers, but 
now are allowing posting as well.
>
> Deploying DKIM just within the NNTP environment as a spam control
> measure could make a lot of sense. It will inevitably happen as
> people write DKIM aware mail/news clients.

I can easily see adding one quick feature to our NNTP server to support some 
level of DKIM/SSP.

Example: SSP control logic to handle ARTICLE posting.

With a few lines of code, the NNTP server can easily check to make sure the 
From: domain is not using a *restrictive* domain SSP, such as a high value 
domain who have absolutely, uncategorically, no interest in seeing 
uncontrolled users masquerading their domain entity in news groups 
environments.

This would be server side so it would handle ALL RFC news reader MUA 
clients. No change required to DKIM/SSP specs that I can see off hand.

But beyond this, it gets hairy.

My wish for this DKIM/SSP effort is to first focus on server-side, transport 
operations because no matter what, that needs to get done first.   We can't 
depend on the "new" MUA becoming the requirement for DKIM/SSP 
implementation.

One we get  the backend protocol requirements all worked out, then we can 
write new guidelines and interface requirements for MUAs.

---
HLS

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 27 Nov 2006 14:27:34 -0000

On Sun, 26 Nov 2006 14:20:06 -0000, Hallam-Baker, Phillip  
<[email-masked]> wrote:

> measure could make a lot of sense. It will inevitably happen as people  
> write DKIM aware mail/news clients.

Not sure I agree there.

Phishing is irrelevant for News. There is much less spam on News than on  
Email (either that, or the news server I use has incredibly good filtering  
in place).

But there is a LOT of address scraping by spammers off News, as a result  
of which large numbers of posters routinely 'munge' their addresses  
(hopefully also adding a '.invalid' at the end), and that will rather  
defeat the intentions of DKIM.

Its only advantage AFAICS is when you know (or think it likely/possible)  
that your articles may be gatewayed into email at some stage.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 27 Nov 2006 17:20:32 +0100

Charles Lindsey wrote:

> large numbers of posters routinely 'munge' their addresses (hopefully
> also adding a '.invalid' at the end), and that will rather defeat the
> intentions of DKIM.

I'm not sure what Phil's talking about, but I have usepro-06 in mind,
where you say that pgpverify (for control messages) is not exactly state
of the art.  Maybe a variant of DKIM could replace it (if server admins
got used to the idea because they see it in mail, and if DKIM works as
expected to some degree).

Posters who know how a cancel works and intend to use it, moderators,
TLH admins, and other newgroup/rmgroup users don't munge their address.

Frank

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 28 Nov 2006 11:14:30 -0000

> expected to some degree).

Well, it's getting a bit off topic, but the possibility of adapting  
DKIM-base for a future PGPVERIFY is one of the reasons I am on this list.  
But DKIM-base is not 100% suitable. You wouldn't want a header called  
"DKIM-Signed" for an application totally unconnected with DKIM, and you  
would not want the signing key to be based on a domain-name (a  
newsgroup-name such as news.announce.newgroups is traditional) and so you  
wouldn't be using DNS to publicize your keys. I raised some of these  
concerns in my "Introducing myself" thread when I first joined this list.

The other reason I am here is because of concerns over EAI. The MUST sign  
 From is problematical there, as is the expectation that the CTE on the  
wire will have to be Base64 or Q-P for DKIM-base to work, which is exactly  
what EAI is trying to put behind us.
> TLH admins, and other newgroup/rmgroup users don't munge their address.

Sure they won't. But that makes their addresses highly visible spam  
magnets (you should see the 100:1 spam:signal ratio that  
[email-masked] gets). But ordinary Usenet users, who are the ones  
Phil thought might use DKIM, find life much quieter if they don't use  
their genuine email addresses in From:.

So I don't think DKIM is really much use for routine use on Usenet, though  
there may be a few special-purpose needs for it.