Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

[Hector Santos <[e-mail]>]

On 7/26/2020 2:34 PM, Dave Crocker wrote:
> On 7/26/2020 11:29 AM, Hector Santos wrote:
>> Dave, for a number of years of practice, depending in the system or
>> service, users have been provided with trust-related decisions . Do
>> you need real examples?
>
>
> There is a difference between providing a signal, versus its getting
> received and use.
>
> Please provide objective data that these signals are being perceived
> and used effectively by end users.

Dave, I made a mistake to preempt the remaining comment by saying  "Do 
you need real examples?"  I thought I had removed it.  It was rude. Sorry.

Please read the remaining part in my previous message with my input 
explaining how GMAIL provides Trust-Related decision options to the 
layman user mail reader.

There is a lot more to this and I need to go.   I think you are 
correct in suggesting the user has no input in the protocols are are 
looking for.   Its the deterministic vs subjective/learning/heuristics 
protocols issue again.  In reality, we don't have the latter (IETF 
public domain standard for a non-deterministic filtering engine). 
Unless we want to include SpamAssasin as the Default EmailCore AVS 
Engine, it has been a long time missing, desirable part of the total 
picture.  With that engine, users would be a natural part of the 
equation. Unfortunately, we are not there.  But with the former, I 
always thought these deterministic protocols were targeted for 
unsolicited, anonymous transactions where only the AUTHOR DOMAIN, the 
self-signing domain, is the only trusted source.  Not the user or even 
the sender unless IFF there is an Author::Sender association established.

Have a good day, off to relax at the safe-distancing pool.

-- 
Hector Santos,
https://secure.santronics.com
https://twitter.com/hectorsantos