IETF Logo Mail Archive

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

Seth Blank <seth@sethblank.com> Thu, 17 August 2017 00:34 UTC

Return-Path: <seth@sethblank.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E47313217D for <dmarc@ietfa.amsl.com>; Wed, 16 Aug 2017 17:34:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sethblank-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9PduktafpbfW for <dmarc@ietfa.amsl.com>; Wed, 16 Aug 2017 17:34:34 -0700 (PDT)
Received: from mail-vk0-x231.google.com (mail-vk0-x231.google.com [IPv6:2607:f8b0:400c:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FE22132143 for <dmarc@ietf.org>; Wed, 16 Aug 2017 17:34:34 -0700 (PDT)
Received: by mail-vk0-x231.google.com with SMTP id u133so17607489vke.3 for <dmarc@ietf.org>; Wed, 16 Aug 2017 17:34:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sethblank-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=kf3KOtiGPSjvqocBXibtZrm2ltfsVXcFULTCrU2AalQ=; b=1hupoj54A7oejXgWbP6I4RLYk5bBRzDBetyeEM4j49KIbZI7gR+GAYUaTyq4nNYI7I VUilB+vaoNjhc1jUotJhYhEB8/2oefC7rdYAILTlsKe15eXjVOvIomQf/YQT/8Dd9ZuO 0V4DgWzz9iffPd9s3zr0MwWI7Gd3LCu31ZajZ959LdcS1Ot/7DBY+mxJiJDhHJSaiZw/ qyd7f7H7+aQvYg7vlks68mUW55dwbLpbgXkDFw0sNtozewvu6RtYINiAu9Hsgt36nPDK ESoqDJqRkPuIz58ZWYX2F/2fvDrpcUWCYGSr2zDd2YYb54IfZ8V58eZZUCKAsdVa+Qho aSLg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=kf3KOtiGPSjvqocBXibtZrm2ltfsVXcFULTCrU2AalQ=; b=SiXMqiQzEXCdpHis2npfeg3edc+ZpSta8F2HvNwxRo7lYNPjyfQrmXDy5HjKDn53rP DnSkO/UzZu6gkTFbp0XVUUSgHNVdet8MwQXZZy1X47EY8bcuEoFeUMporEZQmiaPGvTI 0gk1/zqUQSkz6pABAPTh2nJsO/MrPzdQVDGfQM+fBU6mDJvx7n7gAbS+aLzISU4ogPi2 4LhKb3b3XoZW7i61OJCnA6l90mw8EFrGkWBbg8QTLVHNFEX0DnYoWohnK+i4w1XXoSEr uWBxDecFMWaApdMJFWOGvxBSr8uZClSVv4Vdl4rAeTUYMmhM3beGvzw78T5NUrCe8Hwx rSag==
X-Gm-Message-State: AHYfb5iBRlcOQdN4Gr/uyrp6+7emFNBnFBmC/UjoCHglFKaIT8U3YDx4 v9zYfg/7mKtpxu7RlkUJRwk+gpx+NO3D8BckxQ==
X-Received: by 10.31.133.130 with SMTP id h124mr2247574vkd.14.1502930072372; Wed, 16 Aug 2017 17:34:32 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.103.89.22 with HTTP; Wed, 16 Aug 2017 17:34:11 -0700 (PDT)
In-Reply-To: <1502929303.4038704.1075868960.5D80A788@webmail.messagingengine.com>
References: <1502083287.2191248.1065195288.7CDC7FF3@webmail.messagingengine.com> <CABuGu1oTMbuLd4yTwecu5sKFnsmH+HiwT1FG=JpySYHzpMTx_w@mail.gmail.com> <1502200759.3946686.1066841264.607B4D0B@webmail.messagingengine.com> <2720431.u3G7bbkkxK@kitterma-e6430> <1502317564.1935379.1068588344.040173AF@webmail.messagingengine.com> <a08c7590-ded3-1642-4ffc-07848b3c6cd2@gmail.com> <e14f2130-6f00-4ef1-485b-850a4cc1c48c@gmail.com> <1502495646.4099176.1070896040.2B09B1F8@webmail.messagingengine.com> <166070f0-4ba1-70da-1f73-885b4a7f7640@gmail.com> <1502497178.4103451.1070917304.23DD466D@webmail.messagingengine.com> <598F9484.7020700@isdg.net> <CABuGu1p=oLfLRkuoaDHoz3Cv3_FrURdsFPzkac7jNzBpqBmiSg@mail.gmail.com> <599484FB.9050908@isdg.net> <1502929303.4038704.1075868960.5D80A788@webmail.messagingengine.com>
From: Seth Blank <seth@sethblank.com>
Date: Wed, 16 Aug 2017 17:34:11 -0700
Message-ID: <CAD2i3WN_bmDgmQBw3pnyu7vWJJM2Kzwgru87VhK=NA_H91B+og@mail.gmail.com>
To: dmarc@ietf.org
Content-Type: multipart/alternative; boundary="001a11440e101623a80556e82d8a"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/SBYGyh9vUvQXo1vnBiMliXn3NqE>
Subject: Re: [dmarc-ietf] ARC-Seal is meaningless security theatre
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Aug 2017 00:34:37 -0000

On Wed, Aug 16, 2017 at 5:21 PM, Bron Gondwana <brong@fastmailteam.com>
wrote:
>
> The only way you could even hope (as a mailing list) to avoid rewriting
> the sender is for every site that currently has DMARC p=reject to change
> that to a new policy which explicitly means "only reject if no ARC chain" -
> otherwise you can't stop rewriting sender until you know that every
> receiver on your list is ARC-aware.
>

I don't understand your point.

The only way DKIM works is if enough receivers validate it.

The only way adding elliptic curve to DKIM works is if enough receivers
validate it.

The only way a DMARC policy works is if enough receivers validate it.

ARC is the explicit solution to mailing list breakage with DMARC. But, as
with all other IETF RFCs, only works if enough receivers validate it.

Our job is to make sure ARC accomplishes its goals under the DMARC charter,
and demonstrate value to receivers that it's worthwhile to implement.

There will always be a ramp up and implementation phase, that is a feature,
not a bug, and not a reason to say "it won't work."

Seth

v2.23.0 | Report a Bug | By Email