Subject: Re: [ietf-dkim] ADSP, was Lists "BCP" draft available

From: Brett McDowell <[email-masked]>
Date: Wed, 02 Jun 2010 13:57:21 -0400

On May 26, 2010, at 12:59 PM, Steve Atkins wrote:

> On May 26, 2010, at 7:45 AM, Brett McDowell wrote:
> 
>> On May 25, 2010, at 8:43 PM, Scott Kitterman wrote:
>> 
>>>> Like I said, "throw away anything that doesn't have our signature" has 
>>>> some chance of broad adoption.  Every extra word you add to the message 
>>>> makes it less likely that people will do it.
>>>> 
>>> I agree with this. I have yet to see any proposals for additions that didn't either add enough complexity to act as a barrier to deployment or alternately make it trivially possible to allow third parties to create messages that render discardable moot. 
>> 
>> I agree that adding anything to "throw away anything that doesn't have our signature" add complexity to implementation and therefore, by definition, is a barrier to adoption.  That's not what we are debating.  What we are debating is whether such complexity is a necessary evil that we should provide a specification to support -- as an optional mechanism for stakeholders who want to opt-in to the authenticated email ecosystem.  I *think* the answer is "yes".  But we haven't yet had the meaningful debate that will resolve that question.
>> 
>> Let's debate whether transient trust through a MLM is actionable.  Would a new header that enabled the MLM to report to the receiver that they indeed validated the original signature actually make any difference in the deliverability of that message to the receiver, and if yes, is that actually a good thing?  I say "yes" and "yes".  But I expect that if we debate this specific point one of you might highlight an unintended consequence that would tip the balance away from pursuing such a model.  
>> 
>> Thoughts?
> 
> Aesthetically I like the idea of some way for the MLM to tunnel authentication information through to the recipient.

Perhaps that's common ground we just discovered.  Let's build on that.

> 
> But I don't think it's clear that doing so would change anything at the recipients MX. As a concrete example, if two subscribers to a mailing list send mail to the list, one DKIM signed and one not, and the list then signs each message and sends it to the recipient, is there any reason that the recipients MX would treat those two messages differently?
> 

Yes.  But we need more information about the scenario in order to describe how.  The following detail will illustrate how.

A = sender of message from an ADSP=discardable domain but the message was not DKIM signed
B = sender of message from an ADSP=discardable domain and the message was DKIM signed
C = the MLM who is a participating MLM in the authenticated email ecosystem
D = receiver of email from the MLM who is a participating receiver (DKIM/ADSP inbound)
Note: this scenario takes place in after this IETF DKIM WG standardizes the new header I mentioned above.

In this scenario C will report to D that the message from A was not signed on inbound and that the message from B was.  This would lead D to deliver the message from B but not deliver the message from A.  The MLM signed both messages before sending to D.

-- Brett

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 2 Jun 2010 23:56:00 -0000

>> But I don't think it's clear that doing so would change anything at
>> the recipients MX. As a concrete example, if two subscribers to a
>> mailing list send mail to the list, one DKIM signed and one not,
>> and the list then signs each message and sends it to the recipient,
>> is there any reason that the recipients MX would treat those two
>> messages differently?

>Yes.

I still don't get it.  The sorting rules I use on mailing lists are
based on the list's identity using List-ID: headers or subject tags,
not the individual sender.  People will, I hope, correct me if I'm
wrong, but I'm pretty sure that's typical of existing practice.

It's possible to add all sorts of extra stuff to messages to pass
through all sorts of complex assertions, but my list sorting works
perfectly well now.  What problem for the list recipient are we
solving with this proposed extra mechanism?

To address one possibility, none of the lists I'm on have significant
problems with bad guys sneaking messages onto the lists by pretending
to meet the criteria for posting messages to the list.  Back in the
Krazy Kevin era, 15 years ago, that was a problem but list owners and
managers have dealt with it quite successfully.  If the claim is that
it'll become a problem again, I think it's fair to ask why, since list
owners and managers have dealt with it in the past, they wouldn't
continue to do so.

R's,
John

---

From: Brett McDowell <[email-masked]>
Date: Mon, 07 Jun 2010 11:52:53 +0200

On Jun 3, 2010, at 12:20 PM, Amir Herzberg wrote:

> On Wed, Jun 2, 2010 at 8:57 PM, Brett McDowell <[email-masked]> wrote:
> ...
> Note: this scenario takes place after this IETF DKIM WG standardizes the new header I mentioned above.
> 
> In this scenario C will report to D that the message from A was not signed on inbound and that the message from B was.  
>  
> Shouldn't C discard such message instead of sending it to D?

Good question.  I don't have a strong opinion either way (yet).  

The fact that MLM's deliver those messages today enables what we've seen on this list, i.e.  at least the message is in subscribers' spam folders which enables them to configure their MUA's to deliver such things in the future.  But I've seen several posts to this list suggesting life is better if such messages simply never reach the subscribers' inbox.  To be honest, I don't recall the motivation for that position.  IIRC, the original motivation was to avoid auto-unsubscriptions from the MLM, but I think we've concluded that MTA's shouldn't bounce those rejected messages back to the MLM anyway.

---

From: "John R. Levine" <[email-masked]>
Date: 7 Jun 2010 10:53:08 -0400

> If I understand correctly, the only receivers that would reject/discard such messages are "participating" receivers.  Therefore I think it's reasonable for us to expect participating receivers to follow our guidance in the DKIM-LISTS BCP.  So if we clarify that the recommended practice is to "silently discard" (as some have described it), won't we have solved this particularly problematic work flow?

You're right, then it just falls back to mail mysteriously disappearing.

Remember that the ADSP RFC specifically says not to say discardable if you 
send mail through lists.

R's,
John

---

From: "J.D. Falk" <[email-masked]>
Date: Mon, 7 Jun 2010 17:37:14 +0200

On Jun 7, 2010, at 11:52 AM, Brett McDowell wrote:

> But I've seen several posts to this list suggesting life is better if such messages simply never reach the subscribers' inbox.  To be honest, I don't recall the motivation for that position. 

There've been a couple of studies where users were discovered to be going into their spam folder, and falling for bank phishing messages there.

--
J.D. Falk <[email-masked]>
Return Path Inc

---

From: Ian Eiloart <[email-masked]>
Date: Tue, 08 Jun 2010 11:42:19 +0100

--On 7 June 2010 17:37:14 +0200 "J.D. Falk" <[email-masked]> 
wrote:

>> But I've seen several posts to this list suggesting life is better if
>> such messages simply never reach the subscribers' inbox.  To be honest,
>> I don't recall the motivation for that position.
>
> There've been a couple of studies where users were discovered to be going
> into their spam folder, and falling for bank phishing messages there.

At Sussex, we made the decision a few years back that we either deliver 
mail to the INBOX, or reject it at SMTP time.

A spam folder, for many users, is equivalent to a blackhole. Rejecting at 
SMTP time, in theory, allows the sender of a false positive to choose 
another contact method.

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

---

From: "John R. Levine" <[email-masked]>
Date: 11 Jun 2010 22:49:05 +0200

>>> ... So if we clarify that the recommended practice is to "silently
>> discard" (as some  have described it), won't we have solved this
>> particularly problematic work flow?
>>
> why can't the MLM send bounce back to sender's mail-from address?

The MLM can't tell the difference between a rejection due to the recipient 
address being invalid and due to ADSP.  Rejecting due to ADSP is probably 
wrong due to the spec, but sending mail to a list from a domain publishing 
ADSP discardable is definitely wrong, so apportion the blame as you wish.

> John's response seems to imply that it is sender's responsibility not to
> send to lists in first place (if they use discardable). But can we be sure
> this will happen?

Of course not.  That's an example of the reason that I don't find ADSP 
useful (as opposed to manually vetted discard lists.)  There's no way to 
tell whether the party publishing discardable understands what they're 
saying.

> - Wouldn't we have same problem with forwarders? and I don't think sender
> can predict whether mail will go  thru forwarders....

DKIM is not SPF.  It is uncommon for a forwarder to break a DKIM 
signature.  We designed it that way.

R's,
John

---

From: Michael Thomas <[email-masked]>
Date: Fri, 11 Jun 2010 15:19:28 -0700

> That's an example of the reason that I don't find ADSP

I'm sure that some people would like to put:

theirdomain.com.		3600	IN	A	0.0.0.0

in their zone file and still be reachable. This is and always was
a specious argument.

Mike

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Sat, 12 Jun 2010 12:56:57 +0200

> tell whether the party publishing discardable understands what they're

And likewise there is no way to tell whether the party implementing 
discard lists understand what they're doing. IMHO, we should stay away 
from assuming the presence or absence of a given level of expertise of 
the mail admins on this earth.

/rolf

---

From: "John R. Levine" <[email-masked]>
Date: 12 Jun 2010 17:22:34 +0200

> And likewise there is no way to tell whether the party implementing discard 
> lists understand what they're doing. IMHO, we should stay away from assuming 
> the presence or absence of a given level of expertise of the mail admins on 
> this earth.

There's a fairly key difference you're missing here.  For ADSP, each 
domain publishes what it thinks is its own policy, so if you look at a 
million domains, you have to guess about the competence of a million mail 
system managers.

On the other hand, if you use one or two published drop lists, you can 
afford to look at them and choose ones whose administrators are 
competent, without having to individually vet each entry.

R's,
John

---

From: "John R. Levine" <[email-masked]>
Date: 14 Jun 2010 12:22:55 +0200

> Of course, I could also keep list of competent publishers of MX records.

Indeed you could.  And if the collateral damage from trying to use inept 
MX records were as bad as the damage from trying to use inept ADSP 
records, you probably would.

R's,
John

---

From: Ian Eiloart <[email-masked]>
Date: Mon, 14 Jun 2010 10:59:32 +0100

---

From: Ian Eiloart <[email-masked]>
Date: Mon, 14 Jun 2010 10:58:10 +0100

> tell whether the party publishing discardable understands what they're

Right, but there's no way to tell whether a party publishing *any* DNS 
record understands what they're saying. You have to trust that they do. If 
something breaks as a result of a publication error, then it's the 
publisher's responsibility to fix that. Of course, any administrator who 
discovers a likely error should feel free to advise the publisher of that 
error.

---

From: "John R. Levine" <[email-masked]>
Date: 14 Jun 2010 16:07:03 +0200

> I would appreciate you describing in detail this "collateral damage". If
> it involves discarding of mail from the domain in question then it is
> not collateral. What else do you have for us?

It's collateral to the extent that one's users complain about not getting 
perfectly good mail.  "Your friend's mail admins glorp plugh ADSP grungle 
bleep" isn't a very satisfactory response to users.  Pointing to 
legalistic language in some web page with a three letter acronym won't 
help.

There's also the problems that have been noted with people bouncing off 
mailing lists.  Yes, in that case both ends are doing the wrong thing, but 
if either did the right thing and forgot about ADSP we wouldn't have the 
problem.

The sooner we stop wasting time trying to fix ADSP and start getting 
shared drop lists, the sooner there's some hope of using DKIM to keep 
simple forgeries out of peoples' inboxes.

R's,
John

---

From: "John R. Levine" <[email-masked]>
Date: 14 Jun 2010 16:22:25 +0200

> What you describe is NOT "collateral damage". The effect you describe is
> not unintended or accidental.

Aw, come on.  When the person publishing ADSP doesn't understand what he's 
saying, the damage he causes is entirely unintended and accidental.

If you're saying that ADSP was designed as a gun pre-aimed at one's foot, 
I wouldn't disagree.

R's,
John

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Mon, 14 Jun 2010 10:16:45 -0400

> -----Original Message-----
> From: John R. Levine [mailto:[email-masked]]
> Sent: Monday, June 14, 2010 10:07 AM
> To: MH Michael Hammer (5304)
> Cc: DKIM List
> Subject: RE: [ietf-dkim] Lists "BCP" draft available
> 

John,

What you describe is NOT "collateral damage". The effect you describe is
not unintended or accidental. It is inherent. You may not like it but to
describe it as "collateral damage" is an abuse of the English language.

Mike

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Mon, 14 Jun 2010 10:00:49 -0400

> From: [email-masked] [mailto:ietf-dkim-
> [email-masked]] On Behalf Of John R. Levine
> Sent: Monday, June 14, 2010 6:23 AM
> To: Ian Eiloart
> Cc: DKIM List
> Subject: Re: [ietf-dkim] Lists "BCP" draft available
> 
> >> million domains, you have to guess about the competence of a
million
> mail

John,

Mike

---

From: Douglas Otis <[email-masked]>
Date: Mon, 14 Jun 2010 10:08:10 -0700

John,

How will "doing the right thing" with ADSP resolve mailing list abuse?
> simple forgeries out of peoples' inboxes.
Is a shared-drop list an improved "discardable" list, and what does 
"discardable" mean in respect to Author Domain Signing Policy?  Should 
all critical and potentially phished transactions be marked 
"discardable" and not generate DSN?"  Should "all" be receive the same 
delivery treatment as "discardable"?   Does "discardable" mean something 
other "all" and no NDNs?  Should ADSP also indicate whether third-party 
services are being used?

Reputation alone will not resolve abuse issues with a steady increase of 
abuse coming from reputable sources, and reputation certainly will not 
resolve a phishing issue, especially when senders are compelled to 
change email domains without a means to specifically and unilaterally 
authorize third-parties.  Any general third-party authorization would 
increase abuse emitted by mailing lists, which would prove counter 
productive, especially without a defined method to identify third-party 
services.

Of course, it remains possible for senders to make such a list 
themselves and to note how third-party services can be identified.  An 
authorization scheme would leave "drop lists" control in the hands of 
the senders being trusted, or in the hands of their delegated authority 
(detail will be added in the draft to explain this function).

-Doug

---

From: Ian Eiloart <[email-masked]>
Date: Tue, 15 Jun 2010 15:11:00 +0100

--On 14 June 2010 16:07:03 +0200 "John R. Levine" <[email-masked]> wrote:

> perfectly good mail.

My understanding of "collateral damage" is that third parties are damaged. 
In an email correspondence, the sender and recipient are the first and 
second parties respectively. This may or may not be damage, but it's not 
collateral.

---

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Tue, 15 Jun 2010 10:30:53 -0400

> Sent: Monday, June 14, 2010 10:22 AM

Unintended and accidental does not equal collateral.

> If you're saying that ADSP was designed as a gun pre-aimed at one's
foot,

I am not saying that. The fact that something can be misused does not
mean that it is pre-aimed at one's foot.

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 15 Jun 2010 11:02:57 -0600

> simple forgeries out of peoples' inboxes.

I'm aware of a handful of beta-ish commercial products which intend to fill that niche.  (Full disclosure: my employer developed one of these, contact me off-list if you'd like to know more.)

Speaking as an IETF participant: the experiences of the larger email operations community in choosing, implementing, and troubleshooting these products could be very useful in determining what (if anything) needs to be changed in ADSP.

Until then, we keep going in circles....

---

From: Michael Thomas <[email-masked]>
Date: Tue, 15 Jun 2010 11:03:58 -0700

> Until then, we keep going in circles....

Everybody knows I'm cynical but...

1) Grab people's published ADSP records
2) Aggregate them and call them a "shared drop list"
3) PROFIT!@!

Mike