Subject: Re: [ietf-smtp] Email explained from first principles

From: John C Klensin <[email-masked]>
Date: Fri, 28 May 2021 10:27:05 -0400

--On Thursday, May 27, 2021 19:15 +0200 Kaspar Etter
<kaspar=[email-masked]> wrote:

> On 27 May 2021, at 18:23, John R Levine <[email-masked]>
> wrote:
>> We've spent a decade with people insisting that the entire
>> e-mail world has to change the way it works to conform to the
>> lastest FUSSP. 
> 
> Why is domain authentication framed as a spam prevention
> technique? Any messaging service which is popular, open, and
> free will have spam. Spam is a problem of quantity: You just
> have to bring down the amount of unsolicited messages to a
> bearable level, be it with domain or IP reputation,
> challenge-response mechanisms, or proof of work. Phishing, on
> the other hand, is a problem of quality: A single successful
> attack can do immense harm. It's not just large
> organizations which are being impersonated. A popular scam is
> to impersonate the victim themselves, claiming that their
> account has been compromised and blackmailing them into paying
> a ransom.
> 
> Just because some people will always fall for scams doesn't
> mean that we shouldn't try to reduce the number of victims.
> Otherwise, cars wouldn't need safety measures because some
> people will always die in car accidents. Priming plays a huge
> role in human psychology and there's a lot that mail clients
> could do in this regard: Separate messages from unknown
> senders, don't display the display name of unknown senders,
> warn users when they click on links from unknown senders, warn
> users if a previously authenticated sender could not be
> authenticated, etc.
> 
>> They understand that DMARC's limitations cause a lot of
>> gratuitous pain for their users who've been using mailing
>> lists for a long time.  
> 
> I fully understand this pain and respect the motivation behind
> ARC, but you cannot have (strict) domain authentication and
> message rewriting. I want the former and don't care about
> the latter. Maybe the solution will be that people use two
> different addresses: One with domain authentication enabled
> for direct conversations and one without domain authentication
> for mailing lists.

Kaspar, 

This is rapidly evolving into what is often known here as a
religious debate.  Such debates are rarely useful: one group of
people start with fundamental and strongly held principles about
what email is about and what is therefore most important to
optimize, others have a different set, and then they often go
off and argue about things that are really just corollaries of
the assumed principles.  That is also the disadvantage of trying
to construct an argument and explanation "from first
principles", especially if the hypothesized princinples are not
explicit: if others disagree with you about what those those
principles are, it may not be useful to have conversations about
the derived explanation and details. 

Let me give an example using part of the above thread. 

I am, personally, not a big fan of domain authentication.  My
problems are tied, not to any particular detail but to two
operational/ political problems.  The first is that any such
system is inherently dependent on the integrity, responsibility,
and accountability of domain name registrars and domain
operators.  I guess the most charitable thing I can say about
that is that some are better than others and that their business
models and incentives may not be the same as those of email
providers, much less those of the recipient email user.  Even
some email providers are problematic: absent legal action, when
was the last time you heard of a major email provider closing an
account and deleting a mailbox because it was used as the reply
address in some phishing, extortion, or other fraudulent scheme?
Or how often do you see a major provider require strong
authentication to establish a mailbox and then having terms and
conditions indicating that any fraudulent or illegal use of the
mailbox would result in termination of the account and handing
the user over to law enforcement?   

Is authentication that a mailbox exists in a domain and that
someone is allowed to send mail using/ through the domain better
than nothing?  Yes, clearly.  How much better?  Well, it cuts
down on the number of really stupid evildoers.  Some of us worry
more about the smart ones, even the smart ones who have
concluded that they will be more successful making the sort of
deliberate "mistakes" that confine their likely audiences and
potential victims to really stupid users, but that is probably
another religious issue.

The political side of the problem is that, as long as someone
can behave in an evil or criminal way but do it in a way that
allows escaping any chance of punishment (such as by carrying
out the bad behavior from a country that does not consider the
behavior criminal, as least if it is not applied to their own
citizens), then, under the best of circumstances, trying to stop
the behavior is an arms race and a losing one.  And, if we can
figure out ways to stop a large percentage of the evil traffic,
it actually reduces the incentives to deal with either those
underlying political /legal issues or with the education and
technology that appear to be prerequisite to making PKI-based
authentication work at an individual level for most of the email
users in the world.  And, that, of course, leads to another
political/social problem: to the degree to which solutions
depend on high-quality user authentication, that level of
authentication may be incompatible with highly valued ideas of
privacy and potential anonymity.   

Finally, as John Levine and others have more or less pointed
out, getting some of these problems solved may require either a
cure for human stupidity and carelessness or training,
certification, and licensing of Internet users.  I have no idea
which of those is less likely.

best,
  john

p.s. some of us already use different addresses for
individual/direct communications and for mailing lists. In
practice, it does not work well for the purpose you describe
with or without domain authentication because message threads,
and the addresses used with them, transition back and forth
between the two realms.

---

From: "John R Levine" <[email-masked]>
Date: 28 May 2021 13:22:56 -0400

On Fri, 28 May 2021, John C Klensin wrote:
> operators.

You're missing the point.  Domain authentication lets us recoginize good 
actors, who have an incentive not to screw around.  The more reliably we 
can recognize known good senders, the more aggressively we can filter 
everything else and limit the number of false positives.

I cannot say how many times I have pointed this out, only to get a reply 
"but the bad guys can change their domain."  Yeah, we know.  When 90% of 
mail is spam, recognizing good actors is a much smaller and simpler 
problen than recognizing bad ones, but as far as I can tell, a lot of 
people fixed their model of mail filtering in the 1990s and can't imagine 
that it might be different.

Similarly, if it were true that blocking senders that leak spam would make 
them behave, we would have found some evidence of that.  I know a few 
cases where really bad leakers who didn't send much mail that people 
actually wanted were publicly bludgeoned into submission, but these days 
the pressure points are not in places that are visible to people who run 
tiny mail systems like you and I do.

For some reason, much of the IETF is particularly disconnected from e-mail 
reality.  I know IETFers who claim that DNSBLs were a fad in the 1990s and 
nobody uses them any more.

R's,
John

PS:

> ... when was the last time you heard of a major email provider closing an

Every day.  They don't send out press releases.

> the user over to law enforcement?

I am guessing you haven't tried to set up an Office 365 account.  I did 
last year for the UASG EAI tests and let me tell you that the hoops I had 
to jump through to send even one message were quite extensive.  If I 
hadn't brought my own domain, which meant my mail's reputation did not 
borrow the reputation of MS' large public domains, they would have been a 
lot worse.

---

From: Sam Varshavchik <[email-masked]>
Date: Fri, 28 May 2021 18:42:24 -0400

> nobody uses them any more.

I subscribe to a combination of:

1) That public DNSBL usage are reasonably popular. Everyone from Microsoft  
(Outlook/Office365) to various hosting providers (1and1/godaddy) to large  
infrastructure providers (GTT) uses public DNSBLs.

2) That their golden age was in the 1990s. These days they'll mostly block  
an occasional spam, but the don't amount to more than a rounding error of  
the massive crapton that's flying everywhere.

Occasionally I hear someone say that they see public DNSBLs blocking a  
significant portion of the crap. That's certainly possible, of course, but I  
believe that's an outlier. Everyone's incoming E-mail is unique. So it's not  
unexpected that, for some, DNSBLs will have some level of effectiveness. But  
I have reasons to doubt that they amount to much for most end recipients.

---

From: "John Levine" <[email-masked]>
Date: 28 May 2021 23:19:48 -0400

>infrastructure providers (GTT) uses public DNSBLs.

Of course.  Big providers all have paid subscriptions that give then higher
query rates and often extra data.

>the massive crapton that's flying everywhere.

Your mail must be very different from mine.  The handful of DNSBLs I use block the majority
of the incoming mail I get and from looking at the logs, the error rate is very low.

Large mail providers use DNSLBLs as part of their scoring systems.  I use a handful to do
simple blocking that I trust not to overblock (Spamhaus, Invaluement) but large systems have
a lot more complicated mail flows than we do.

R's,
John

---

From: Richard Clayton <[email-masked]>
Date: Sun, 30 May 2021 09:18:16 +0100

In message <F43E00C7D57DBDB88E527909@PSB>, John C Klensin <john-
[email-masked]> writes

>Even

it's generally policy (on the advice of lawyers) for abuse@ reports to
be replied to (if indeed they are at all) with a thank you note and an
indication that appropriate action will be taken -- no more than that

in practice, in my experience, reports of dropboxes accompanied by good
evidence (and/or from trusted correspondents) are regularly acted upon
by major email providers ...

... but it's not clear to me that even publishing summary statistics,
let alone more detailed info, would assist anyone but the bad guys.

BTW: I recall one early ransomware case where the mailbox was closed and
this somewhat frustrated the victims, some of whom were prepared to pay.

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755