Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

["MH Michael Hammer (5304)" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Alessandro Vesely
> Sent: Thursday, April 18, 2013 7:45 AM
> To: [e-mail]
> Subject: Re: [dmarc-ietf] making mail not work for your users, was the
> endless mailing list silliness
> 
> On Thu 18/Apr/2013 00:00:21 +0200 MH Michael Hammer (5304) wrote:
> >> From: [e-mail] On Behalf Of J. Gomez
> >>
> >> It's pretty clear by now that DMARC is not about protecting actual
> >> email users, but about protecting big brands from email spoofing their
> brand.
> >
> > Having seen the damage done to individuals clicking on those phishing
> > or malware emails purporting to be from banks and other big brands I
> > strongly disagree with your statement which appears somewhat
> > dismissive.
> 
> Spoofing a bank's brand can damage the users who become victims of
> phishing.  That's what we aim at protecting from, however we call it.
> 
> > I would argue that organizations not making these sorts of efforts are
> > doing a disservice to their customers and the community at large.
> 
> If courts argued like that, then phishing victims would be able to claim
> damages from non-compliant banks.  Possibly, victims would need to prove
> that scam messages would have been blocked if the bank had complied.
> Therefore they had better choose receivers who enable DMARC rejection.
> 

Ethics != law. 

> That way, we can extend the argument that mailing list posters need a
> different email address:  We'd need a different email address even for
> lurking.  However, experience with RFC 6109 shows that even if people is
> compelled by law to get certified email accounts, they tend to forget them
> and use the ones that work instead.[1]
> 
> [1] http://www.digitpa.gov.it/pec/statistichepec (in Italian)
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc