Re: [dmarc-ietf] Tickets 98 and 99 -- fake reports are not a problem and if they were authentication would not help

Seth Blank <seth@valimail.com> Mon, 25 January 2021 17:25 UTC

Return-Path: <seth@valimail.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60E3B3A15CC for <dmarc@ietfa.amsl.com>; Mon, 25 Jan 2021 09:25:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.198
X-Spam-Level:
X-Spam-Status: No, score=-0.198 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=valimail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7dJLjKviuvPb for <dmarc@ietfa.amsl.com>; Mon, 25 Jan 2021 09:25:26 -0800 (PST)
Received: from mail-ua1-x92a.google.com (mail-ua1-x92a.google.com [IPv6:2607:f8b0:4864:20::92a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A6B03A15C8 for <dmarc@ietf.org>; Mon, 25 Jan 2021 09:25:26 -0800 (PST)
Received: by mail-ua1-x92a.google.com with SMTP id v23so4686042uam.8 for <dmarc@ietf.org>; Mon, 25 Jan 2021 09:25:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=valimail.com; s=google2048; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2L1vDtPQxSx58chs6n33NgK7yyF/VFzPYbjzjP/vDn4=; b=Rl7C2DXuVTRszMUGDp8ZH3jaerRcTb5+EV5mmLE9pcWmIyHRdY3ExKyMxoTNTCBCPB ZjtKXGupcZ/s6KCTWODxVHDuDhpQXNtl/vsBKFeEZSFnmOL+RV9o/hU7uQmlfhil8jG5 V6BqXKAqUpHC+FJ83Fe9wQt0jZihuXH+nNsCughsLu7l0+k5iScenBdxA/3ZTNiqG40/ xu5Is3VuWaTINYUyX/FiMFUX8WN6spXm267eRQrmZeD0ZJy8E4dWay2bsDbZNQ+BhnEb 9HnWtAbV596BhLyt31CiT8J6+xkTMNtbKDbdDyjGLRTXGSojZ218H+amJqoXCyvT84sV 5QyQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2L1vDtPQxSx58chs6n33NgK7yyF/VFzPYbjzjP/vDn4=; b=F0vGuwSxzktubafK41TqV5x9Y9XLd9SuzgHQd+Mm8OYnndwVJumPXRmEC/yWaiPBk/ 0lrD5P5+5UrZ3FvtOWIUxQSvxXZDco4fZxwTchDtW9/b9V+YPzMkX3qI4pUWj+zY8RRy qyjNjdbHZWcW5qJ+U5mz+ThqhPWF6MwKu8hxBBvwDfKHOvF/XBuDgcq5Sxe+6UiXY531 e/FpPXpFdEmtwllhLgFImdXSPqdSXJnlBdIAt75ZWKnlrNRDBFqfFbZcUQ2fFcwHH3Cv HWAZ0i17+c9P/DZunH8G2gFDSoHg0KqLDtQkhOIQ8b8kclgcwVuIx3gyOGLlr+hi5kL8 SPuw==
X-Gm-Message-State: AOAM533rbOlw1COOinkiS0xWBuum5j0CybL3lPCDBvSxrU2ypVwVF2Us mV6uyJTuYIyIsqHa9BWIXdcObBHQb17yK3ZeWSESUg==
X-Google-Smtp-Source: ABdhPJyV4aeNJDfceY1awyca5dDXlhLM/oUJQMWSBPiNeUtKguaReyF2yjFDqeObeLuWKNQ9uui8fYBzTy9mjCb+W70=
X-Received: by 2002:ab0:3043:: with SMTP id x3mr1413545ual.88.1611595525056; Mon, 25 Jan 2021 09:25:25 -0800 (PST)
MIME-Version: 1.0
References: <34317129-8225-fb38-4ad3-e1b9ffed21fb@iecc.com> <9c84fa50-d23c-a794-fc62-09788ac383a9@mtcc.com> <CAHej_8mTaFo7aESFk4pHjbqbheriYPoAy6f+HhcE6ASVJSyViA@mail.gmail.com> <df867378-5da0-b912-2a0f-b2081d1f2437@mtcc.com> <CAHej_8kfCC1H89pRjgxXK=+BizJHFdKgnr7Gxh_2wWq8P7L-0Q@mail.gmail.com> <a94cb6c0-0a32-da8d-4bd5-9c7ab2866c82@mtcc.com> <CAH48ZfxkQ9g-gmBOPdDsxr4RDvXOi56EaX=aJVDbuL_g7kR+xQ@mail.gmail.com> <CAOZAAfOB93fpYRjwxgQNkG-ydVHLtvgUp0LLROvv-F-amJVy4w@mail.gmail.com> <b9e8da8e-f46a-49c0-4196-1d50ed94d526@mtcc.com>
In-Reply-To: <b9e8da8e-f46a-49c0-4196-1d50ed94d526@mtcc.com>
From: Seth Blank <seth@valimail.com>
Date: Mon, 25 Jan 2021 09:25:14 -0800
Message-ID: <CAOZAAfPh4kYq0yXhtP9BaPmtP_rc7L-0f=r3Ff_P3oxrhYqvtw@mail.gmail.com>
To: Michael Thomas <mike@mtcc.com>
Cc: IETF DMARC WG <dmarc@ietf.org>, Douglas Foster <dougfoster.emailstandards@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000caf63f05b9bcd2f2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/kb1pil97QlQXHA1m4IO2Ry27T0Q>
Subject: Re: [dmarc-ietf] Tickets 98 and 99 -- fake reports are not a problem and if they were authentication would not help
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Jan 2021 17:25:28 -0000

Mike, how do you believe DMARC reports are consumed and utilized? I think
you have a misunderstanding here which is why you're going down this path
and everyone else is pushing back.

On Mon, Jan 25, 2021 at 9:22 AM Michael Thomas <mike@mtcc.com> wrote:

> Taking in information from unauthenticated sources and acting on it is an
> operational problem per se. Have we learned nothing in the last 30 years?
>
> Mike
> On 1/25/21 9:19 AM, Seth Blank wrote:
>
> What operational problem are we solving here? Absent evidence of a problem
> and strong consensus on the solution, let's close these tickets and move on.
>
> On Mon, Jan 25, 2021 at 9:10 AM Douglas Foster <
> dougfoster.emailstandards@gmail.com> wrote:
>
>> Since the status quo is unauthenticated, I wonder if adding a signing
>> requirement will help.
>> Will recipients discad unsigned messages, or accept whatever is available
>> to maximize their information capture?  I suspect they will conrinye to
>> accept everything.
>>
>> I think we would need an identified threat before recipients would be
>> motivated to discard.
>>
>> But what about John's problems with receiving reports that should not
>> have gone to him?   I did not understand the root cause, but I would hope
>> there is something that can be done.  Would signing help receiving sites,
>> those with less sophistication than he has, be able to sort out noise more
>> effectively?
>>
>>
>> On Mon, Jan 25, 2021, 11:51 AM Michael Thomas <mike@mtcc.com> wrote:
>>
>>>
>>> On 1/25/21 8:44 AM, Todd Herr wrote:
>>>
>>> On Mon, Jan 25, 2021 at 10:18 AM Michael Thomas <mike@mtcc.com> wrote:
>>>
>>>>
>>>> The main thing I've learned over the years of dealing with security is
>>>> to not underestimate what a motivated attacker can do. Your imagination is
>>>> not the same as their imagination. Closing #98 in particular is absolutely
>>>> ridiculous: the report should already have a DKIM signature or SPF so it's
>>>> just a matter of making sure its valid. Why would you *not* want to insure
>>>> that? The amount of justification for *not* having the receiver
>>>> authenticate it is a mountain. The amount of effort to authenticate it is
>>>> trivial for mail. Levine's dismissal of security concerns because he has
>>>> anecdotal "evidence" from a backwater domain carries no weight at all.
>>>>
>>>
>>> That's all well and good, but you haven't answered the question I asked.
>>>
>>> What threats do you have in mind? Put another way, how do you envision
>>> an attacker exploiting the lack of authentication in a DMARC report to his
>>> or her gain?
>>>
>>> No, sorry, the onus is on the people who don't think it can be gamed. A
>>> bald assertion that it can't be gamed is very unconvincing. You need to lay
>>> out a miles long case for why it cannot be gamed. And to what end? #98 has
>>> a simple piece of text that should be added to DMARC to eliminate the
>>> possibility of forgery. You'd need a 10 page threat I-D to explain why it's
>>> not necessary. What is the point of that? For email, it's trivial to
>>> prevent forgeries. Why would anybody argue against that?
>>>
>>> Mike
>>> _______________________________________________
>>> dmarc mailing list
>>> dmarc@ietf.org
>>> https://www.ietf.org/mailman/listinfo/dmarc
>>>
>> _______________________________________________
>> dmarc mailing list
>> dmarc@ietf.org
>> https://www.ietf.org/mailman/listinfo/dmarc
>>
>
>
> --
> *Seth Blank* | VP, Standards and New Technologies
> *e:* seth@valimail.com
> *p:* 415.273.8818
>
>
> This email and all data transmitted with it contains confidential and/or
> proprietary information intended solely for the use of individual(s)
> authorized to receive it. If you are not an intended and authorized
> recipient you are hereby notified of any use, disclosure, copying or
> distribution of the information included in this transmission is prohibited
> and may be unlawful. Please immediately notify the sender by replying to
> this email and then delete it from your system.
>
>

-- 

*Seth Blank* | VP, Standards and New Technologies
*e:* seth@valimail.com
*p:* 415.273.8818


This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.