Subject: Re: [ietf-dkim] Some responsibility

From: Alessandro Vesely <[email-masked]>
Date: Mon, 01 Nov 2010 11:53:03 +0100

Rolf E. Sonneveld wrote:
> I'm not very happy with the introduction of the word 'some' in front of 
> 'responsibility'. The way it is mentioned now is like one can say 
> 'somewhat dead' or 'a bit pregnant'.

It involves domains.  For comparison with the web, how would we describe the 
varying degree of responsibility that domains implicitly claim for hosting 
content on their web sites?  A user's bank account page is obviously very 
different from a blog post...
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 1 Nov 2010 10:01:04 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Graham Murray
> Sent: Saturday, October 30, 2010 11:51 PM
> To: [email-masked]
> Subject: Re: [ietf-dkim] Some responsibility
> 
> > DKIM is no position today to provide any assurance to or for anyone to
> > be indemnified from liabilities.
> 
> I agree that it does not provide indemnity, but it does not claim to, it
> claims to do the opposite.  What it does provide is assurance of
> acceptance of liability for messages which are signed. ie if a message
> is DKIM signed, the signer cannot later claim "It was nothing to do with
> me, it must have been a forgery"

+1

Moreover, I think we tread on dangerous ground when we make assertions in any direction that are legal rather than technical.  We're about as expert in law as we are in MUAs, which is to say "not at all".

---

From: Hector Santos <[email-masked]>
Date: Mon, 01 Nov 2010 14:02:29 -0400

Murray S. Kucherawy wrote:

>> Graham Murray
> Moreover, I think we tread on dangerous ground when we make assertions 
> in any direction that are legal rather than technical.

Yet there is exist an assertion of an ambiguous legal term that raise 
more questions than not about the potential risk factors for a signing 
service or organization can assume with a blind responsibility for the 
signing of a domain for any message.

> We're about as expert in law as we are in MUAs, which is to say 
> "not at all".

Speak for yourself.

There are those with commercial product development, legal and 
liability understanding to have very keen realistic view of the 
concept and a quick grasp for have a legitimate concern for the 
"responsibility" term in DKIM. It is a closer reality than what you 
are expressing.

DKIM is an unprotected protocol and it is NO position to suggest to 
anyone that it can assume a responsibility that can easily by 
violated.   As you ready to take BLAME for a poor signing of a faulty 
message that can predictably harm an END-USER based on added 
DKIM-based confidence by yet another 3rd party?   I don't think so.

We have MUAs in the market place and for nearly 30 years.  Do You? 
Mind you, one doesn't really need to have direct MUA design 
experiences to gain good insight and understanding and input.  Gods 
know, you think you now more than others regardless your silly 
statement.  But the fact remains, whether you care or not, there are 
some here that do have real MUA product design experiences.

Have a good day

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Mon, 01 Nov 2010 23:53:58 +0100

+1

Given the fact that DKIM does not require a complex PKI, this means DKIM 
provides an interesting business case for various types of organizations 
(of course, assuming that the organization uses DKIM as it was 
designed). To give an example: recently I spoke with a security officer 
of a big insurance company, about DKIM. He told me that it was very 
important to them to be able to make a statement about mail they send to 
their customers, that is: a statement about the mail as it leaves their 
ADMD, not about how it arrives at the customer. It is sufficient for 
them to be able to show to anyone who might ask them, that they sign 
their outbound mail using decent crypto technology. And if they can do 
so, without having to deploy a full PKI, it makes DKIM an interesting 
technology to them. IMHO DKIM needs these kinds of use case scenario's 
to get wide acceptance.

[Of course, in addition to signing their mail, they probably will want 
to archive their outbound mail including DKIM signature etc., but that's 
not relevant to the discussion here.]

> Moreover, I think we tread on dangerous ground when we make assertions in any direction that are legal rather than technical.  We're about as expert in law as we are in MUAs, which is to say "not a…

Agreed.

/rolf

---

From: "John R. Levine" <[email-masked]>
Date: 1 Nov 2010 21:04:14 -0400

Putting on my native speaker of American dialect hat, I don't see a useful 
difference between "responsibility" and "some responsibility" in this 
context.  In practice they mean the same thing, and neither means "total 
responsibility."

If someone goes to the effort of signing a message and publishing a 
validation key, they have taken some responsibility for the message.  On 
the other hand, if you then complain to them about it, and they tell you 
to get stuffed, that's the end of it.  (You might stop accepting their 
mail, but that's outside the scope of DKIM.)  It's some responsibility, 
but it may not be very much.

So pick one and be done with it.  It doesn't matter which one.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Tue, 02 Nov 2010 07:27:46 -0400

Agreed.

> So pick one and be done with it.  It doesn't matter which one.

The issue is that its too vague and incomplete especially when there 
is an unknown and unrestricted RE-signers involved as part of the 
framework.

What does responsibility actually mean?  Does it mean that the last 
signer is the blame or part of the blame for any harm caused?

Does the last signer absolve all previous signer(s) responsibility? 
Is this something the original domain signer is aware of?

     "INFORMATIVE NOTE:  DKIM allows resigners to operate. When a
      resigning takes place, all previous signer domains no longer
      have a responsibility for the message."

Of course, in a perfect integrated protocol world, one could add 
statements about POLICY restrictions, but that would be a taboo here 
at this point.  Maybe it can be stated another way to provide the 
concept of absolving domain responsibility.