Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

["Jones, Steven M" <[e-mail]>]

On Wednesday, April 17, 2013 1:56 PM, J. Gomez wrote:
> 
> On Wednesday, April 17, 2013 12:39 PM [GMT+1=CET], John Levine wrote:
> 
> > Perhaps we could try and think more clearly about providing service to
> > actual mail users and less about hypothetical spoofing attacks on
> > people who are not plausible spoof targets.
> 
> It's pretty clear by now that DMARC is not about protecting actual email users, but
> about protecting big brands from email spoofing their brand.

I must disagree. While we want to prevent our brands/domains from being used to exploit consumers, we also want to help prevent our customers from being exploited in general. If that weren't the case we would have been happy using proprietary services rather than promoting an open standard.

We share our customers with many thousands of other organizations. Whether a customer is phished through abuse of our brand, or Facebook, or the local tax assessor doesn't really matter if it leads to their BofA accounts being drained and their PII stolen. While the larger brands have been a primary focus because they are most often successfully exploited and have an incentive to make disruptive changes, I have always felt that it was equally important that DMARC be available to protect any domain that needs it, of whatever size or scope.

Yes there are some direct expenses when BofA makes good on fraud losses, and because of our scale it's not a small number. But it pales in comparison to the loss of customer confidence and reputational damage, not to mention the outright loss of customers, plus the loss of the Internet as a way to interact with our customers. I don't have survey data handy, but I'm pretty sure 4 out of 5 consumers don't miss having to go into physical bank locations between 10AM and 3PM, Tuesday through Thursday except random obscure holidays, every time they wanted to do something...

DMARC is not a panacea, so it does not solve certain issues with mailing lists, any more than it solves display names or cousin domains. But it does provide a solution to a very real set of problems, and it can evolve in future.

--Steve.

Steven M Jones
Messaging Strategy
STI End User Computing
Bank of America; Concord, California


----------------------------------------------------------------------
This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer.   If you are not the intended recipient, please delete this message.