Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Dave Crocker <[e-mail]>]

On 9/27/2020 2:20 AM, Alessandro Vesely wrote:
> On Sat 26/Sep/2020 15:06:54 +0200 Dave Crocker wrote:
>> On 9/26/2020 3:31 AM, Alessandro Vesely wrote:
>>> A pointer to a better aimed report circulated on this list:
>>
>> An unrefereed presentation (not paper) about a single experiment is 
>> better than a summary of an industry-wide effort that failed?
> 
> 
> I meant aimed at email rather than web browsing.

So?

If you think the industry-wide experiment that focused on signalling a 
trust indicator and failed is less relevant than a small, single, 
unrefereed paper about a preliminary and poorly-design research project 
is somehow less relevant, please explain.


>> And, for the current discussion, there's the troublesome summary the 
>> they give about their own study:
>>
>>> 1. Warning only slightly lowers the click rate
>>> 2. The absolute click rate is still high
>>
>> The key words there are "slightly" and "still high".
> 
> 
> "If one person eats a chicken and another person doesn't eat anything, 
> on average they both ate half a chicken".  That's how statistics 
> distorts reality. 

The fact that you think this statement is somehow meaningful suggests a 
rejection of an entire, established field of study based on not 
understanding it.


> I'm sure there are users who watch authentication 
> results, and usually take no bait.  For them,  "slightly" and "still 
> high" don't hold.

Except that individual cases are not the basis for establishing 
industry-wide practice.  Industry-wide behaviors are.

An occasional example simply isn't relevant.  That's the difference that 
legitimate statistical analysis provides.


> 
> And, there's increasing activity about anti-phish employee training.  As 
> a consequence, the importance of visual hints is bound to increase.

Excellent.  So that means you can point to studies that show how 
effective such training is.  Because the general sense is in the 
anti-abuse community is that it has little effect.  But if you know of 
studies to the contrary, it would very useful to hear about them.



>> Prompting the question of why anyone would think this study serves as
>> demonstrating strong support for the role of end-users in abuse 
>> protection?
> 
> That wasn't the goal of the presentation, AFAIUI.

However it /was/ the apparent reason it was cited.


> 
> At any rate, I don't think that demeaning users can be a long term 
> strategy toward a more evolved society.  Albeit it may work 99% of 
> times, delegating decisions to a security manager is a limitation.  It 
> is possible, at least in theory, that a message is considered a phish by 
> some but not by others.  In illiberal countries that's all the more likely.
> 
> 
>> All of which demonstrates a basic problem with efforts to discuss 
>> human-related work: difficulties in understanding how to evaluate 
>> research and research patterns, with a tendency to instead lean on 
>> confirmation bias.
> 
> 
> That's why it is important to enable each and every soul to exert their 
> own judgements.

Actually, it's not.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net