Re: [Asrg] MXs Used As Authentication - Why RMX?

"Alan DeKok" <aland@freeradius.org> Sat, 20 September 2003 01:36 UTC

Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00653 for <asrg-archive@odin.ietf.org>; Fri, 19 Sep 2003 21:36:52 -0400 (EDT)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.12.8/8.12.8) with ESMTP id h8K1VhAl020140 for <asrg-archive@odin.ietf.org>; Fri, 19 Sep 2003 21:36:33 -0400
Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id h7PI9Y5g009391 for asrg-archive@odin.ietf.org; Mon, 25 Aug 2003 14:09:34 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rLmT-0002QL-6I for asrg-web-archive@optimus.ietf.org; Mon, 25 Aug 2003 14:09:29 -0400
Received: from optimus.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05816; Mon, 25 Aug 2003 14:09:23 -0400 (EDT)
Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rLln-0002EG-Tt; Mon, 25 Aug 2003 14:08:47 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 19rK5d-0005hc-Ag for asrg@optimus.ietf.org; Mon, 25 Aug 2003 12:21:09 -0400
Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA26457 for <asrg@ietf.org>; Mon, 25 Aug 2003 12:21:02 -0400 (EDT)
Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 19rK5b-00038X-00 for asrg@ietf.org; Mon, 25 Aug 2003 12:21:07 -0400
Received: from giles.striker.ottawa.on.ca ([192.139.46.36] helo=mail.nitros9.org ident=root) by ietf-mx with esmtp (Exim 4.12) id 19rK5b-00038U-00 for asrg@ietf.org; Mon, 25 Aug 2003 12:21:07 -0400
Received: from [127.0.0.1] (helo=giles.striker.ottawa.on.ca ident=aland) by mail.nitros9.org with esmtp (Exim 3.34 #1) id 19rK5f-0004nx-00 for asrg@ietf.org; Mon, 25 Aug 2003 12:21:11 -0400
From: Alan DeKok <aland@freeradius.org>
To: asrg@ietf.org
Subject: Re: [Asrg] MXs Used As Authentication - Why RMX?
In-Reply-To: Your message of "Mon, 25 Aug 2003 15:11:34 +0200." <a06001a0ebb6fb930b27d@[10.0.1.2]>
Message-Id: <E19rK5f-0004nx-00@mail.nitros9.org>
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=unsubscribe>
List-Id: Anti-Spam Research Group - IRTF <asrg.ietf.org>
List-Post: <mailto:asrg@ietf.org>
List-Help: <mailto:asrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=subscribe>
List-Archive: <https://www1.ietf.org/mail-archive/working-groups/asrg/>
Date: Mon, 25 Aug 2003 12:21:10 -0400

Brad Knowles <brad.knowles@skynet.be> wrote:
> 	As I see it, one primary problem with this draft is that it 
> breaks the most common form of mailing lists -- aliases.

  This was discussed earlier on the list.  "outgoing" MX records mean
that some current network behaviours may change.  Mailing lists may
still exist, but their implementations may change.  Other than
deployment, I don't see this as much of a problem.

> 	This draft also prevents people from being able to legitimately 
> transmit e-mail using domain names that they don't control, via other 
> servers.  It is not at all unusual for me to go travelling somewhere 
> and want to continue to use my normal e-mail address, but use the 
> local mail relay services available from the provider I'm using at 
> the moment.

  How does the recipient of that email establish a consent framework
for communication with you?  How does he separate your traffic from
the "forged spam" traffic?

> 	You would have no choice but to have SMTPAUTH or TLSSMTP 
> available for the official relays for your domain, and to be able to 
> guarantee that you can always get through to them using these 
> features,

  How is this different than having you establish a consent framework
for communication?  

> 	I don't see this sort of solution being feasible.  The legitimate 
> third-party relay problem is a tough one to solve.

  How does the recipient distinguish "legitimate" third-party relays
from "illegitimate" ones?

  Why is it the recipients problem to establish that legitimacy?  What
work are you willing to do, to share the burden of establishing that
legitimacy?

  I'm not opposed to legitimate third-party relaying.  But it's my
perogative as a recipient to discard any email I choose.  Unverifiable
third-party relaying is a large part of my spam, and costs me time and
money.  "legitimate" third-party relayers who ask that I spend more
time and money to "legitimatize" their email for them look a whole
lot like spammers, from that perspective.

  Alan DeKok.

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg