[dispatch] draft-levine-herkula-oneclick, additional security consideration

[Roland Turner <[e-mail]>]

The Security Considerations section mentions potential use of the 
mechanism to test whether an email address is valid, but does not 
address the probing of spam filters. This may well be a moot point given 
the widespread use of seed boxes by both legitimate senders and 
spammers, however I recall that when Gmail first introduced an 
unsubscribe button (in the dialogue box that could pop up if the user 
clicked This is Spam), they established three criteria:

  * that a List-Unsubscribe: header was present
  * that the message authenticated, and
  * that the sender was in good standing in terms of its complaint rate.

It may be argued, with some strength, that the third item really makes 
no difference, but it would appear to be a relevant consideration to 
address in Security Considerations, and perhaps an option to suggest.

- Roland