Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

["Murray S. Kucherawy" <[e-mail]>]

On Wed, Apr 17, 2013 at 2:20 PM, John Sweet <[e-mail]> wrote:

> ... except, of course, that when I get a phishing mail purporting to be
> from my bank, and I respond thinking it's them, and criminals gain access
> to my accounts because of it, it's not the bank that takes it in the
> shorts. It's me, the little guy.
>

It's both, really.  It happens to the end user to the tune of what they
have in the bank, and it happens to the bank to the tune of what their
insurers have to cover in the aggregate for fraud claims.  Those are
relatively painful numbers to both parties.


> When I get yet another newspaper article forwarded by my mother, using the
> paper's website's "Send to a Friend" link, I actually don't particularly
> care if it's someone pretending to be her.  Likewise, when I see your posts
> here on dmarc-ietf, I really don't care if it's you or someone pretending
> to be you. Some applications of email just aren't desperately in need of
> authentication.
>
> If my mother writes me personally saying she's stuck in London without her
> passport and needs me to wire her $1500 immediately, well, that's another
> matter. But she's unlikely to do that through a mailing list.
>

+1 to all of that.

-MSK