Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

[Brandon Long <[e-mail]>]

On Tue, Jul 21, 2020 at 12:45 PM Dave Crocker <[e-mail]> wrote:

> On 7/21/2020 12:32 PM, Dotzero wrote:
>
>
>
> On Tue, Jul 21, 2020 at 2:06 PM Dave Crocker <[e-mail]> wrote:
>
>> On 7/21/2020 10:58 AM, Dotzero wrote:
>> For this case, DMARC externalizes that internal personnel problem.
>>
>> But it does not fit the definition of "spoofing".
>>
>> Please note that I did noy use either the word "spoof" or "spoofing".
> You wrote "MLM is authorized by the user". Someone without authority cannot
> authorize. In this case the user externalized the problem, not DMARC.
>
> That's simple incorrect.
>
> I give you my credit card, telling you to use it only for gasoline
> purchases while running errands for me.  You take the car on a
> cross-country joyride, running the cc charges for gasoline up.  The
> stations that  charged the gas to the card did nothing wrong.  The problem
> is internal, between you and me.
>
> The MLM's did not do any spoofing.  They acted appropriately, as they have
> for 45 years.
>
> If the domain owner has a problem with the user's behavior, that's
> internal, between the domain owner and the user.
>
> Using language that casts the MLM as doing something wrong is a
> fundamental misrepresentation of the situation.
>

Yahoo Groups, at least at the time I worked on it, allowed moderators to
edit the message before approval.  The full scope of that
certainly allowed the moderators to effectively spoof the poster.

That said, sure, we're not talking about spoofing.  We're talking about
message changes that prevent strict signature verification.
There is nothing in what MLM does that prevent much stronger changes than
would be considered expected by the MLM.

Stricter validation is not an uncommon addition to protocols over the last
45 years.

I'd be curious when MLMs modifying the mail going through them became a
thing, I guess I assume it wasn't 45 years ago, but I know it's irrelevant.

Brandon