Re: [dispatch] FYI draft-levine-mailbomb-header-00

[Stephen Farrell <[e-mail]>]

On 19/06/17 18:42, John Levine wrote:
> This draft came out of a discussion last week at M3AAWG.  The issue is
> that bad guys (or more likely bad bots) fill out web forms and include
> fake mail addresses, the forms provoke confirmation mail which then
> mailbombs the address(es).
> 
> This draft adds a new header to indicate that a message is in response
> to a form submission:
> 
>  Form-Sub: v=1; ip4=198.51.x.x

Why not some hashed form of the address?

I'd assume a bad bot will generate a load of subscribes per
IP address, so a (maybe keyed) has of the full address might
be better than the /16 or whatever. And if you only had hashes
then it's harder to accidentally be privacy invasive.

S.

> 
> The IP address is that of the web client, which may be partly redacted
> with "x" for privacy reasons.  If a recipient mail system sees too
> many of them, it may block the system that's sending them.  The draft
> also asks for an enhanced status code which means we rejected this
> message because it's part of a flood with Form-Sub headers.
> 
> When we had the discussion there were people from at least two large
> consumer mail systems and a dozen hosters and (sending) mail service
> providers in the room, so it is likely this will be implemented
> enough to see if it's useful.
> 
> At this point the main point of writing the draft was to have a
> reference so I could ask IANA to register the header and status code.
> If it does turn out to be useful I'll come back and ask for it to be
> dispatched into a standards track document.
> 
> R's,
> John
> 
> _______________________________________________
> dispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dispatch
>