Subject: Security-related Wording issues - section 6.3

From: "Chris Haynes" <[email-masked]>
Date: Sat, 7 Aug 2004 11:59:09 +0100

I reference draft-ietf-marid-core-02.txt, Section 6.3

Two wording points:

1) Section title

I find the section  title
"Forged Resent-From Attacks"
misleading.

The Resent-From address in these attacks is not forged, it is valid.

It is the sender address/es (From:, Sender:) which may have been forged.

Maybe "Forged Sender Addresses" would be better?

2) The second para starts:

"In order to avoid this attack, MUAs will need to ..."

To me, this is not 'avoiding' the attack, this is 'assisting the user to detect
the attack'.

Using the provisions of Sender-ID there is no way the MTA or MUA can even detect
this attack, let alone defend against it or avoid it.

None of the technology involved has any idea which sender addresses may
legitimately be paired with any given Resent-From address.

This section should be re-worded to make it clear that its is only the end-user
who can detect the possibility of an attack and make any judgement about it.

HTH

Chris Haynes