Re: [dmarc-ietf] Ticket #55 - Clarify legal and privacy implications of failure reports

[Michael Thomas <[e-mail]>]

On 1/5/21 2:07 PM, Dave Crocker wrote:
> On 1/5/2021 1:58 PM, Michael Thomas wrote:
>> On 1/5/21 1:49 PM, Dave Crocker wrote:
>>> On 1/5/2021 1:20 PM, Michael Thomas wrote:
>>>> On 1/5/21 1:18 PM, Dave Crocker wrote:
>>>>> On 1/5/2021 12:55 PM, Michael Thomas wrote:
>>>>>> It also says with actual data that your assertion that users 
>>>>>> can't be trusted for anything is not correct.
>>>>> I didn't say that.  And it didn't say that.
>>>> "Also, receiver filtering engines are all that matter." The word 
>>>> all includes human beings. That's the nature of "all".
>>> 1. In terms of average use for typical email, it is.
>> What study asserts that for email? You wouldn't take my word for it 
>> if I said that. But of course I wouldn't make a categorical statement 
>> without empirical evidence.
>
> You seem to be seeing a requirement to prove the negative, while the 
> actual requirement is to prove the positive.  A claim that there is 
> meaningful efficacy, for average recipients, by having visual trust 
> indicators, requires affirmative demonstration that there is.  There 
> is no requirement to prove there isn't.  My point is that we have 
> decades of belief that it's useful but no demonstration that it 
> actually is.  And we have history such as the EV effort, showing that 
> it isn't.
>
> Your focus on email, as somehow distinctive, would need some basis for 
> ignoring the web experience.  Feel free to provide it.

Your example of web is fraught because web stuff has had visual 
indicators for decades now, and trying to compare EV certs isn't 
especially a good example because the situations are not the same. At 
least this study is directly relevant and it doesn't support your 
categorical statement. This is actually a Good Thing.

I did provide it with that paper. You seem to be dismissing it out of 
hand in favor of something that isn't even email based. We are here 
because of email, so I think that's pretty relevant.

>
>> You really should read the paper.
>
> Your implication that I haven't is both odd and troublesome.
>
In 15 minutes? It's like 30 pages long and very technical. And you're 
asking me whether I read it closely? If you have read it before, just 
say that. If you haven't you can skip to the part that doesn't support 
your categorical statement.

Mike