MIME-Version: 1.0
References: <cd9258e6-3917-2380-dd9b-66d74f3a64d3@gmail.com>
 <20200717210053.674D61D2C431@ary.qy>
 <CAL0qLwbkhG-qUyGqxaEjcFn2Lb7wPMhcPFEMA8eqptBJpePPxA@mail.gmail.com>
 <8efcf71c-f841-46a4-10b7-feb41a741405@gmail.com>
 <CAL0qLwbK7GQXkiS+H8GtsvHMzWr4o431Shc7Cc9MhqsTiHfzFw@mail.gmail.com>
 <bc7ed18c-8f1d-b41b-0a4b-3aa180a63563@gmail.com>
 <CAL0qLwYgs7py1aTQ87pykNT_0dpnrKz=+1DxMMSQMgbwz4XZDg@mail.gmail.com>
 <381c7792-5bd8-a1be-6b93-b7df015a2333@gmail.com>
In-Reply-To: <381c7792-5bd8-a1be-6b93-b7df015a2333@gmail.com>
From: "Murray S. Kucherawy" <superuser@gmail.com>
Date: Sun, 19 Jul 2020 17:04:46 -0700
Message-ID: <CAL0qLwb2Ufw1HZBoCDccj2KBqtOHnmcmPWiuqYtGGQZbUDkBEg@mail.gmail.com>
To: Dave Crocker <dcrocker@gmail.com>
Cc: IETF DMARC WG <dmarc@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000de3f6f05aad441fd"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/be1gAWI_i1Z_p2L8urcrY7a3L5s>
Subject: Re: [dmarc-ietf] Response to a claim in
 draft-crocker-dmarc-author-00 security considerations
Precedence: list

--000000000000de3f6f05aad441fd
Content-Type: text/plain; charset="UTF-8"

On Sun, Jul 19, 2020 at 11:33 AM Dave Crocker <dcrocker@gmail.com> wrote:

> On 7/19/2020 11:08 AM, Murray S. Kucherawy wrote:
>
> gain: There is quite a bit of experience demonstrating that providing
>> trust indicators to end users does not produce reliable -- ie, useful --
>> decision-making by end users.
>>
> We appear to be talking past each other.  I wasn't talking about trust
> indicators, but rather whether the RFC5322.From domain is visible.  I don't
> have any reason yet to think trust indicators are effective.
>
> The view that the From: address, or domain, or Display-Name is used, by
> end-users, for assessing the trustworthiness of a message means it/they are
> used as trust indicators.
>
> The track record is that people are unreliable at this.
>
> There is quite a bit of distance between 'unreliable' and 'blindly open
> and read absolutely everything'.
>
Is there?

If there's no part of the From field that can be considered reliable, then
by opening even this email am I not exhibiting nearly-blind faith that the
indicators I can see (in this case the string "Dave Crocker (gmail.com)")
have not been falsely generated?  How is this message, in terms of its
trustworthiness, different from any other?

-MSK

--000000000000de3f6f05aad441fd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Jul 19, 2020 at 11:33 AM Dave Cro=
cker &lt;<a href=3D"mailto:dcrocker@gmail.com">dcrocker@gmail.com</a>&gt; w=
rote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote"=
 style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);p=
adding-left:1ex">
 =20
   =20
 =20
  <div>
    <div>On 7/19/2020 11:08 AM, Murray S.
      Kucherawy wrote:<br>
    </div>
    <blockquote type=3D"cite">
      <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex">
        <div>
          <p>gain: There is quite a bit of experience demonstrating that
            providing trust indicators to end users does not produce
            reliable -- ie, useful -- decision-making by end users.</p>
        </div>
      </blockquote>
      <div>We appear to be talking past each other.=C2=A0 I wasn&#39;t talk=
ing
        about trust indicators, but rather whether the RFC5322.From
        domain is visible.=C2=A0 I don&#39;t have any reason yet to think t=
rust
        indicators are effective.<br>
      </div>
      <div><br>
      </div>
    </blockquote>
    <p>The view that the From: address, or domain, or Display-Name is
      used, by end-users, for assessing the trustworthiness of a message
      means it/they are used as trust indicators.=C2=A0 <br>
    </p>
    <p>The track record is that people are unreliable at this.</p>
    <p>There is quite a bit of distance between &#39;unreliable&#39; and
      &#39;blindly open and read absolutely everything&#39;.</p></div></blo=
ckquote>Is there?<br><br></div><div class=3D"gmail_quote">If there&#39;s no=
 part of the From field that can be considered reliable, then by opening ev=
en this email am I not exhibiting nearly-blind faith that the indicators I =
can see (in this case the string &quot;Dave Crocker (<a href=3D"http://gmai=
l.com">gmail.com</a>)&quot;) have not been falsely generated?=C2=A0 How is =
this message, in terms of its trustworthiness, different from any other?</d=
iv><div class=3D"gmail_quote"><br></div><div class=3D"gmail_quote">-MSK</di=
v><div class=3D"gmail_quote"><br></div></div>

--000000000000de3f6f05aad441fd--