Re: [dmarc-ietf] PSD simplification

[Dave Crocker <[e-mail]>]

On 12/13/2018 4:25 PM, Scott Kitterman wrote:
> It suffers from what is, in my opinion, a fatal flaw: it relies entirely on
> assertions that any PSO can publish with no external review.  Without some
> kind of third-party check on this, I don't believe there's any privacy
> mitigation at all.


I think that assessment is misses an essential point.

Let me back up and say that my suggested alternative is intended to take 
the basic concern you are raising seriously.  (I'm not stating a 
personal opinion about the seriousness of this as a threat vector, but 
merely looking for a simpler way to satisfy the concern.)

The alternative requires that the registry's dmarc record be accompanied 
by a record that points to the terms and conditions the registry 
publishes to indicate why their record is acceptable.  (Your draft's 
specification of those conditions looked to me like a reasonable 
starting point; there should be a separate wg discussion for the precise 
details and wording; I don't have a personal opinion about those words.)

As for the benefits I see in the alternative I've proposed, I'll class 
them as simplification and robustness.

First, a new, query-able registry is expensive to run; and difficult to 
ensure quality control for, over the long run.

Second, the vetting method your draft proposes for the registry relies 
on a technical expert to make what is frankly a legal assessment of the 
terms and conditions that the registry publishes.  And that assessment 
is made only one time, when the registry entry is first created.  The 
registry might change its T&C text and we'd be unaware of it.

So while you are technically correct that the alternative means that the 
registry gets to /publish/ with no external review, it is not true that 
their dmarc record will automatically be used without review.

In fact what I'm proposing will make widespread and ongoing review 
likely, IMO, probably in the spirit of ongoing reputation assessment 
that the email industry already does, although for dmarc default record 
rather than spam.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net