Subject: [ietf-dkim] A funny thing happened at RSA...

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 11 Apr 2008 10:10:39 -0700 (PDT)

One of our marketing people just sent this to me.  It's a paper produced 
by PayPal about their success fighting phishing via their deal with Yahoo! 
to have them discard any mail from paypal.com that wasn't signed or 
whose signature doesn't verify.

 	http://www.blackops.org/~msk/paypal-phishing.pdf

A few things are of interest:

1) Although this paper just came out at RSA, it mentions DomainKeys 
specifically.  I attribute this to the fact that the project's parameters 
probably didn't allow for changing of the signing technology during the 
evaluation, and not to a feeling that DomainKeys is the solution of 
choice.

2) The success of such a test with DomainKeys is also a proof-of-concept 
that the same would work with DKIM.

3) The paper mentions SSP, an adjunct to DKIM and not DomainKeys (and an 
obsolete reference at that).  DomainKeys had its own SSP spec within the 
original spec, but they appear to be refering to the newer stuff.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 11 Apr 2008 10:36:34 -0700 (PDT)

Sorry, I wasn't done yet.

The main reason I wanted to share this with the working group is to point 
out that we got some confused people at RSA asking us why we're going with 
DKIM and not DomainKeys in light of the content of this paper.

I wonder if it would be prudent to (somehow) make a statement clarifying 
that the experiment therein described was begun before RFC4871 was issued, 
and thus before DKIM enjoyed any kind of real deployment.  Or something 
like that.  Ideally that would come from PayPal but I don't know that we 
have any direct participation from them here.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Powers, Jot" <[email-masked]>
Date: Fri, 11 Apr 2008 11:19:45 -0700

> have any direct participation from them here.

We're moving to support DKIM and DK.  Our mail appliance vendor didn't
support dual signing until recently, and given that our published agreements
we need to be able to do both.

-Jot

>From [email-masked]  Fri Apr 11 10:54:13 2008
Return-Path: <[email-masked]>

[*snip*]

Received: from phx01imail03.phx.paypal.com
 (mx1.phx.paypal.com [66.211.168.231]) by chud.net (PMDF V6.1 #30000)
 with ESMTP id <[email-masked]> for [email-masked]; Fri,
 11 Apr 2008 10:54:05 -0700 (MST)
Received: (qmail 15567 invoked by uid 12076); Fri, 11 Apr 2008 17:54:00
+0000
Date: Fri, 11 Apr 2008 17:54:00 +0000
From: [email-masked]
Subject: Paypal test email
To: [email-masked]
 eNhlriLsm0n7V4oqMetgABk3fRDXWcvaw5jQzGjGWlMu9+VO2q2f7yILX o=;
Status: RO
Content-Length: 23
Lines: 1

This is a test message

-- 
Jot Powers             <[email-masked]>
Phone: 480-862-7234    Cell: 480-221-1157
Skype: jotebay

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Apr 2008 12:11:30 -0700

> we need to be able to do both.

Jot,

Within the DKIM community, I suspect there wasn't a question about Paypal's 
intent.

I think the issue is that the larger IT community makes excessive distinction 
between DomainKeys vs. DKIM and feels that not (yet) supporting the latter is 
some sort of strategic statement.

I took Murray's query as having more to do with finding a way to educate these 
folk that the difference is incremental rather than strategic.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Powers, Jot" <[email-masked]>
Date: Fri, 11 Apr 2008 12:33:00 -0700

> folk that the difference is incremental rather than strategic.

Ok. Although, clearly I'm not the communication person, the group would like
assistance getting to those people, let me know.

> have any direct participation from them here.

...and figured I would point out that:

1) At least one person here pays attention
2) In my own small way it was making a public statement (since this is in
email on a public mailing list) that could be pointed to.

If, as usual, I hae completely mis-interpreted the email chain, feel free
to *plonk* my message.

-Jot

---

From: Tony Hansen <[email-masked]>
Date: Fri, 11 Apr 2008 14:42:04 -0400

In some of my talks, I sometimes refer to DKIM as "DomainKeys Version 
2". This gets people thinking in the right frame of mind as to their 
relationship.

	Tony Hansen
	[email-masked]

---

From: "J D Falk" <[email-masked]>
Date: Fri, 11 Apr 2008 15:56:41 -0400

> 2". This gets people thinking in the right frame of mind as to their

Yep, this seems to always make things clearer (though I call it version
3.)

What hasn't been mentioned yet in this thread is that it wasn't entirely
Paypal's choice to use DomainKeys rather than DKIM; Yahoo! is still (as
of recent statements) only checking DomainKeys, though they plan to add
DKIM support real soon now.

---

From: SM <[email-masked]>
Date: Fri, 11 Apr 2008 12:18:40 -0700

> >From [email-masked]  Fri Apr 11 10:54:13 2008

And a funny thing happened on this mailing list.  This email came 
through without a DomainKeys or DKIM signature.

Should the receiving MTA pass the message to this passive user or 
reject it?  I'm ignoring any ADSP considerations.

Regards,
-sm

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Apr 2008 13:12:00 -0700

> 2". This gets people thinking in the right frame of mind as to their 

Not only are you correct, but strictly speaking, RFC 4871 documents DomainKeys, 
version *4*.

The current version of DomainKeys is version 2.  The private industry effort 
that created DKIM was, therefore, version 3.

So the IETF published version represents the 4th round of specification and 
deployment.

d/
-- 

   Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Apr 2008 13:13:10 -0700

FWIW, having dkim.org and mipassoc.org do DKIM signing is in the queue.  No 
schedule, though.

d/

-- 

   Dave Crocker

---

From: Eric Allman <[email-masked]>
Date: Fri, 11 Apr 2008 13:21:19 -0700

By the way, how many angels /can/ dance on the head of a pin, anyway?

eric

--On April 11, 2008 1:12:00 PM -0700 Dave Crocker <[email-masked]> 
wrote:

>
>
> Tony Hansen wrote:
>> In some of my talks, I sometimes refer to DKIM as "DomainKeys
>> Version  2". This gets people thinking in the right frame of mind
>> as to their  relationship.
>
>
> Not only are you correct, but strictly speaking, RFC 4871 documents
> DomainKeys,  version *4*.
>
> The current version of DomainKeys is version 2.  The private
> industry effort  that created DKIM was, therefore, version 3.
>
> So the IETF published version represents the 4th round of
> specification and  deployment.
>
> d/

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Apr 2008 13:40:42 -0700

> By the way, how many angels /can/ dance on the head of a pin, anyway?

Apparently more than people who can appreciate relative (im)maturity of a 
technical effort and how it should affect work on it.

d/

-- 

   Dave Crocker

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Fri, 11 Apr 2008 16:43:42 -0400

> -----Original Message-----
> From: [email-masked] [mailto:ietf-dkim-
> [email-masked]] On Behalf Of Eric Allman
> Sent: Friday, April 11, 2008 4:21 PM
> To: [email-masked]
> Subject: Re: [ietf-dkim] A funny thing happened at RSA...
> 

What kind of angels and what kind of pin?

---

From: Jim Fenton <[email-masked]>
Date: Fri, 11 Apr 2008 13:12:42 -0700

I was at Michael Barrett's (PayPal CISO) talk yesterday morning.  He 
said that the early gains they have made have been with DomainKeys, but 
said quite clearly that "the future is definitely with DKIM" (or words 
to that effect).

He said that Yahoo! had blocked 50 million messages allegedly from 
paypal.com as a result of the lack of a signature.

He said a lot about SSP (I didn't correct him on the name, but of course 
he means ADSP).  He had described the arrangement they have with Yahoo!, 
and how they would like to have such arrangements with a lot of other 
ISPs and how there many other domains like them that would also like to 
do so, and that SSP is needed in order to allow this process to scale.

I haven't read the whitepaper yet.

-Jim

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Apr 2008 14:05:24 -0700

> paypal.com as a result of the lack of a signature.

Can Yahoo! or Paypal comment on whether the protection is for specific, names or 
whether it is by sub-tree?

How does Yahoo! know the list of domain names to treat as belonging to paypal?

With respect to sub-trees is that written into the bilateral agreement or is 
there a way of signaling it?

d/
-- 

   Dave Crocker

---

From: "Powers, Jot" <[email-masked]>
Date: Fri, 11 Apr 2008 14:23:02 -0700

> whether it is by sub-tree?

I guess that might mean me.  I was not involved in the negotiations of the
agreement, but it is my understanding that it is for specific names.

Now, I believe that includes *.paypal.com
After that it gets ugly with international domains being handled
individually, but generally being *.paypal.whatever

It might be limited to some value for the splat, the reports we get show
a small number of matches.

(The same holds true for eBay as well as some of the other companies that
eBay, Inc controlls).

> How does Yahoo! know the list of domain names to treat as belonging to paypal?

We talked, and agreed.

> there a way of signaling it?

There are no technical solutions.  I.e., ADSP was not implemented in some
secret way.  We handle that going forward by communication (i.e.
backchannel)

-Jot "not official company spokesman" Powers
-- 
Jot Powers             <[email-masked]>
Phone: 480-862-7234    Cell: 480-221-1157
Skype: jotebay

---

From: Tony Hansen <[email-masked]>
Date: Fri, 11 Apr 2008 21:07:53 -0400

One more question: what is Yahoo! looking at to determine "allegedly 
from paypal.com"? My guess is some subset of the From: header field, the 
Sender: header field, the Reply-To: header field, the 821.MailFrom 
return path, the Resent-From: header field, the Resent-Sender: header 
field, or do they look for something something else entirely?

	Tony Hansen
	[email-masked]

Powers, Jot wrote:
>  > ...

---

From: "Powers, Jot" <[email-masked]>
Date: Fri, 11 Apr 2008 21:21:13 -0700

> field, or do they look for something something else entirely?

I believe it is either 821.MailFrom and/or From.

-Jot

---

From: Roland Turner <[email-masked]>
Date: Mon, 14 Apr 2008 12:32:53 +0800

On Fri, 2008-04-11 at 12:18 -0700, SM wrote:

> reject it?

Pass it:

_domainkey.paypal.com.  3600    IN      TXT     "t=y\; o=~"

- Roland

-- 
Roland Turner | Product Manager, RealMail | BoxSentry Pte Ltd
3 Phillip Street, #13-03 Commerce Point, Singapore 048693
Mob: +65 96700022 | Skype: roland.turner | Fax. +65 65365463
[email-masked] | www.boxsentry.com