Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Alessandro Vesely <[e-mail]>]

On Sun 27/Sep/2020 15:06:24 +0200 Dave Crocker wrote:
> On 9/27/2020 2:20 AM, Alessandro Vesely wrote:
>> On Sat 26/Sep/2020 15:06:54 +0200 Dave Crocker wrote:
>>> On 9/26/2020 3:31 AM, Alessandro Vesely wrote:
>>>> A pointer to a better aimed report circulated on this list:
>>>
>>> An unrefereed presentation (not paper) about a single experiment is better 
>>> than a summary of an industry-wide effort that failed?
>>
>>
>> I meant aimed at email rather than web browsing.
> 
> So?
> 
> If you think the industry-wide experiment that focused on signalling a trust 
> indicator and failed is less relevant than a small, single, unrefereed paper 
> about a preliminary and poorly-design research project is somehow less 
> relevant, please explain.


I think an industry-wide experiment on petrol consumption has nothing to do 
with email protocols, however refereed.  Web browsing has a minor share with 
email, as some people use browsers instead of MUAs.  Browser security concerns 
are rather oriented toward shopping and EV certificates, than email phishing.


>>> And, for the current discussion, there's the troublesome summary the they 
>>> give about their own study:
>>>
>>>> 1. Warning only slightly lowers the click rate
>>>> 2. The absolute click rate is still high
>>>
>>> The key words there are "slightly" and "still high".
>>
>>
>> "If one person eats a chicken and another person doesn't eat anything, on 
>> average they both ate half a chicken".  That's how statistics distorts reality. 
> 
> The fact that you think this statement is somehow meaningful suggests a 
> rejection of an entire, established field of study based on not understanding it.


Statistics can easily be misused.  Distinguishing a cluster of overweight 
people from starving communities doesn't reject statistics as a whole.


>> I'm sure there are users who watch authentication results, and usually take 
>> no bait.  For them,  "slightly" and "still high" don't hold.
> 
> Except that individual cases are not the basis for establishing industry-wide 
> practice.  Industry-wide behaviors are.
> 
> An occasional example simply isn't relevant.  That's the difference that 
> legitimate statistical analysis provides.


The statistical aspect of email is that it is mostly spam, at varying shades of 
gray.  Meaningful messages can be regarded as occasional exceptions in this 
respect.  Nevertheless, they are important.


>> And, there's increasing activity about anti-phish employee training.  As a 
>> consequence, the importance of visual hints is bound to increase.
> 
> Excellent.  So that means you can point to studies that show how effective such 
> training is.  Because the general sense is in the anti-abuse community is that 
> it has little effect.  But if you know of studies to the contrary, it would 
> very useful to hear about them.


Google Scholar shows me 83 results about anti-phish training effectiveness. 
Just talking about human-oriented solutions for phishing entails that users 
need to interpret visual cues.  Hence visual cues have some effect, however little.

Discarding the importance of of users judgement provides for a skewed vision.

Filtering out obvious spam can be considered a favor to users, to keep their 
mailboxes cleaner.  Yet, a deterministic protocol which determines what to 
reject and what to quarantine would relieve MX operators from the 
responsibility of arbitrary filtering based on obscure secrets.


>>> Prompting the question of why anyone would think this study serves as
>>> demonstrating strong support for the role of end-users in abuse protection?
>>
>> That wasn't the goal of the presentation, AFAIUI.
> 
> However it /was/ the apparent reason it was cited.


Yup.


>>> All of which demonstrates a basic problem with efforts to discuss 
>>> human-related work: difficulties in understanding how to evaluate research 
>>> and research patterns, with a tendency to instead lean on confirmation bias.
>>
>>
>> That's why it is important to enable each and every soul to exert their own 
>> judgements.
> 
> Actually, it's not.


Why have elections at all if the result can be forecast before the votes are 
counted?


Best
Ale
--