Subject: [ietf-dkim] New Version Notification for draft-lindsey-dkim-mailinglists-00

From: IETF I-D Submission Tool <[email-masked]>
Date: Wed, 15 Sep 2010 14:35:10 -0700 (PDT)

A new version of I-D, draft-lindsey-dkim-mailinglists-00.txt has been successfully submitted by Charles Lindsey and posted to the IETF repository.

Filename:	 draft-lindsey-dkim-mailinglists
Revision:	 00
Title:		 DKIM, MLMs and From
Creation_date:	 2010-09-15
WG ID:		 Independent Submission
Number_of_pages: 4

Abstract:
It is proposed that a Mailing List Manager (MLM) may, under
certain circumstances, replace the From header field of a message
before forwarding it in order to prevent its being discarded by
over-zealous DKIM verifiers/receivers.

The IETF Secretariat.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Wed, 15 Sep 2010 19:45:09 -0400

> over-zealous DKIM verifiers/receivers.

Real good Charles.

My nit would be it lacks a security section.  I think you need to 
provide a rational why this proposal ... whats the proper word here, 
pick one

       violates, ignores, skips, circumvents

the security framework policy attempts to provide for the author domain?

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 17 Sep 2010 11:47:23 +0100

> the security framework policy attempts to provide for the author domain?

But I don't think it does. You don't do any of the things I am suggesting
unless you have already established there was a valid author doain
signature when it arrived, AND created an A-R to record the fact AND
re-signed.

Of course if you are a malicious MLM, you might have invented the whole
thing, but that is already possible.

There are already plenty of phishes coming from [email-masked], so one
coming from [email-masked].

So I don't see that I have created any security loophole that was not
already there.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "J.D. Falk" <[email-masked]>
Date: Fri, 17 Sep 2010 13:08:50 -0700

> Filename:	 draft-lindsey-dkim-mailinglists

Nice work.  I totally understand what you're trying to do there, and it all seems consistent with the idea of separating things that have been tried from things that haven't been tried.

So, I think the obvious next question is: who's trying it?  Seems like it wouldn't take all that much testing to figure out whether or not this idea will work on today's mail systems.