IETF Logo Mail Archive

Re: [art] [FEEDBACK REQUEST] "Birds of a Feather" topic, email security threats

Alessandro Vesely <vesely@tana.it> Tue, 04 February 2020 18:53 UTC

Return-Path: <vesely@tana.it>
X-Original-To: art@ietfa.amsl.com
Delivered-To: art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE0B9120137 for <art@ietfa.amsl.com>; Tue, 4 Feb 2020 10:53:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.298
X-Spam-Level:
X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1152-bit key) header.d=tana.it
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HkVvwbvpNwBZ for <art@ietfa.amsl.com>; Tue, 4 Feb 2020 10:53:56 -0800 (PST)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B739F12008D for <art@ietf.org>; Tue, 4 Feb 2020 10:53:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=delta; t=1580842432; bh=wwiSaT8DfdGIOQcsP3L6eyspM/OAcyw6zHejZJAVmUw=; l=891; h=To:Cc:References:From:Date:In-Reply-To; b=CzHplLichIQ22X9eL6EdSOxNt8BniMqAQSWuWLIHZI/+UMvctiNL4YrXe5ZtUcPCB wDvxLvWyWPR0IDsNvIVZKhq4+tdxkXLv649QY22O+9N3GJaCkj2fFXALgOgpyEeADV W1dt6cQpstv+nfZ8mGlitAbIfDP6Fu/GBjtHiuRGRMKkEDdOSEckAkhHjtC1U
Authentication-Results: tana.it; auth=pass (details omitted)
Received: from [172.25.197.111] (pcale.tana [172.25.197.111]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLS1.2, 128bits, ECDHE_RSA_AES_128_GCM_SHA256) by wmail.tana.it with ESMTPSA id 00000000005DC081.000000005E39BDC0.0000424E; Tue, 04 Feb 2020 19:53:52 +0100
To: Michael Peddemors <michael@linuxmagic.com>, Eliot Lear <lear@cisco.com>
Cc: art@ietf.org
References: <55abf67e-6a90-acff-a832-87a168d50522@linuxmagic.com> <298521FA-CC31-4888-99E3-7FE32419679C@cisco.com> <4150b6d5-ab85-ba54-f36e-96d36fb65026@linuxmagic.com>
From: Alessandro Vesely <vesely@tana.it>
Message-ID: <c494025c-667f-458d-670c-61875193527c@tana.it>
Date: Tue, 04 Feb 2020 19:53:52 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1
MIME-Version: 1.0
In-Reply-To: <4150b6d5-ab85-ba54-f36e-96d36fb65026@linuxmagic.com>
Content-Type: text/plain; charset="us-ascii"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/art/vqp29H4Wz0TqIqzCux-bb-5LNOw>
Subject: Re: [art] [FEEDBACK REQUEST] "Birds of a Feather" topic, email security threats
X-BeenThere: art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Applications and Real-Time Area Discussion <art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/art>, <mailto:art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/art/>
List-Post: <mailto:art@ietf.org>
List-Help: <mailto:art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/art>, <mailto:art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Feb 2020 18:53:58 -0000

On Mon 03/Feb/2020 23:54:10 +0100 Michael Peddemors wrote:
>>>
>>> Call for Feedback:
>>>
>>> "Birds of a Feather (BOF)" on email authentication security.
>>>
> On 2020-02-03 2:44 p.m., Eliot Lear wrote:
>>
>> I would suggest that one delve a bit into per-destination preauthorization
>> and how that might work from a UX perspective.
>>
> 
> I do want to point out, this is not about spam, but rather email security,
> unless you are recommending that we enlarge the topic that much?


The term "identity validation security" sounds overly specific.  I'd suggest
"authentication security" tout court.  The fact is that "email authentication"
has taken on the meaning of validating the domain ownership of the sending
MTAs, see for example:

https://www.iana.org/assignments/email-auth/email-auth.xml
https://en.wikipedia.org/wiki/Email_authentication


Best
Ale
--

v2.23.0 | Report a Bug | By Email