Re: [dmarc-ietf] making mail not work for your users, was the endless mailing list silliness

[John Sweet <[e-mail]>]

On Wed, Apr 17, 2013 at 1:55 PM, J. Gomez <[e-mail]> wrote:

> On Wednesday, April 17, 2013 12:39 PM [GMT+1=CET], John Levine wrote:
>
> > Perhaps we could try and think more clearly about providing service to
> > actual mail users and less about hypothetical spoofing attacks on
> > people who are not plausible spoof targets.
>
> It's pretty clear by now that DMARC is not about protecting actual email
> users, but about protecting big brands from email spoofing their brand.
>

... except, of course, that when I get a phishing mail purporting to be
from my bank, and I respond thinking it's them, and criminals gain access
to my accounts because of it, it's not the bank that takes it in the
shorts. It's me, the little guy.

When I get yet another newspaper article forwarded by my mother, using the
paper's website's "Send to a Friend" link, I actually don't particularly
care if it's someone pretending to be her.  Likewise, when I see your posts
here on dmarc-ietf, I really don't care if it's you or someone pretending
to be you. Some applications of email just aren't desperately in need of
authentication.

If my mother writes me personally saying she's stuck in London without her
passport and needs me to wire her $1500 immediately, well, that's another
matter. But she's unlikely to do that through a mailing list.

J

-- 
"Science is like an inoculation against charlatans who would have you
believe whatever it is they tell you." (Neil DeGrasse Tyson)