Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

["Murray S. Kucherawy" <[e-mail]>]

On Mon, Jul 20, 2020 at 1:59 AM Laura Atkins <[e-mail]>
wrote:

> There was a research project done by an inbox provider and a major
> supporter of DMARC presented at a MAAWG meeting a few years ago. They tried
> adding trust indicators to the message list but found no statistically
> significant behavioral changes by users. Given the conference policies, I
> hesitate to mention it here, but there is research. There’s also a
> conference paper I found, done by a computer science research team at VA
> Tech that looked at this as well.
>

I remember something about the former.  I'll see if I can find a public
reference to it.

"Data, data, data; we cannot make bricks without clay."


> Most clients these days seem to be hiding the RFC5322.From domain from the
> individual end users. Mail.app on OSX does unless you change that setting
> specifically (and it seems every few upgrades they reset the setting and
> then hide the checkbox again). The iOS mail app doesn’t even have a setting
> to change that I’ve been able to find. I seem to remember the last time I
> set up a mailbox on Thunderbird (pre-2016 election as I was tracking some
> candidate mail) they also hid the 5322.From address.
>

I could be wrong but I seem to recall that at the time DMARC was published,
this wasn't the case.  (See my previous remarks about Gmail.)  But I agree
that it does seem to be the case now.

I'm not sure we've ever fully faced the idea that what MUAs choose to
display needs to be factored into the evolution of these protocols.  For as
long as I've been working on this, it's been the opposite.

-MSK