[dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

["Kurt Andersen (IETF)" <[e-mail]>]

Dave writes:

However, for all of the real and serious demonstration of users' being
tricked by deceptive or false content in a message, there is no
evidence that problematic content in a field providing information
about message's author directly contributes to differential and
problematic behavior by the end user.

I'd counter by personal anecdote that we have had to undertake security
remediations because of messages which were forwarded by our CEO to other
employees for responses which happened to contain malware and/or bad links.
Presumably, the cachet which was carried along with "important person says
look into this" overcame whatever native caution or skepticism might have
prevented them from falling prey otherwise.

--Kurt