Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

Hector Santos <hsantos@isdg.net> Sat, 12 August 2017 23:22 UTC

Return-Path: <hsantos@isdg.net>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2518113237B for <dmarc@ietfa.amsl.com>; Sat, 12 Aug 2017 16:22:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.334
X-Spam-Level: *
X-Spam-Status: No, score=1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_SBL_CSS=3.335, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isdg.net header.b=Nx4Y8iZm; dkim=pass (1024-bit key) header.d=beta.winserver.com header.b=kyNXPgeq
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8WE1fM1KTy-D for <dmarc@ietfa.amsl.com>; Sat, 12 Aug 2017 16:22:14 -0700 (PDT)
Received: from demo.winserver.com (secure.winserver.com [76.245.57.69]) by ietfa.amsl.com (Postfix) with ESMTP id 2D03E131CED for <dmarc@ietf.org>; Sat, 12 Aug 2017 16:22:13 -0700 (PDT)
DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1; c=simple/relaxed; l=930; t=1502580126; atps=ietf.org; atpsh=sha1; h=Received:Received:Received:Received:Message-ID:Date:From: Organization:To:Subject:List-ID; bh=PoxKymFPZo9nrRZ5ZfIXSOh7ZOA=; b=Nx4Y8iZm+HIE5pJz0Zl9tehEAHiRtCIfNpJ6WZCzNv+Zn/dbEIbvBAOrQBFJJl XR6Z47mNUq3lcmW2RsK42Yb23kXbh5Y8KDCKGGU8FPxbG9qCSV/KbE+QG6/lsbrw otmLj75reaWG147G8gkoshhGW/SXkcZxwLWE6+Rbr3Syw=
Received: by winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Sat, 12 Aug 2017 19:22:05 -0400
Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=pass policy=all author.d=isdg.net asl.d=beta.winserver.com;
Received: from beta.winserver.com ([76.245.57.74]) by winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 2643985028.1.3924; Sat, 12 Aug 2017 19:22:04 -0400
DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=930; t=1502580093; h=Received:Received: Message-ID:Date:From:Organization:To:Subject:List-ID; bh=KhC9ZPD AfZfBS9/RFNn/Q0ZFZmI1j5eJmn1/wC6qJO4=; b=kyNXPgeqUeekVVPzSCHJDxQ Yl/U42e8Y4u6p8GqqWhZh7G1HRJRHu3sgWAK4Ff9xYGIt+fHICaDDGyMbxQ+JhyO NRLmsgWE9NpvbRXrev72ZUmMa6CpypPg7PaOKXA6lXvubuCTpEbrDQ+gmZ4UZtWW IjvloLRDXa8qVnxHREIo=
Received: by beta.winserver.com (Wildcat! SMTP Router v7.0.454.6) for dmarc@ietf.org; Sat, 12 Aug 2017 19:21:33 -0400
Received: from [192.168.1.68] ([99.121.5.8]) by beta.winserver.com (Wildcat! SMTP v7.0.454.6) with ESMTP id 3186489924.9.634444; Sat, 12 Aug 2017 19:21:31 -0400
Message-ID: <598F8DA1.8020700@isdg.net>
Date: Sat, 12 Aug 2017 19:22:09 -0400
From: Hector Santos <hsantos@isdg.net>
Organization: Santronics Software, Inc.
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.8.1
MIME-Version: 1.0
To: Dave Crocker <dcrocker@gmail.com>, "Kurt Andersen (b)" <kboth@drkurt.com>
CC: "dmarc@ietf.org" <dmarc@ietf.org>
References: <1502083287.2191248.1065195288.7CDC7FF3@webmail.messagingengine.com> <CABuGu1oTMbuLd4yTwecu5sKFnsmH+HiwT1FG=JpySYHzpMTx_w@mail.gmail.com> <1502200759.3946686.1066841264.607B4D0B@webmail.messagingengine.com> <2720431.u3G7bbkkxK@kitterma-e6430> <1502317564.1935379.1068588344.040173AF@webmail.messagingengine.com> <89f1a978-0cc6-f7f3-5d3d-0ccd67341369@gmail.com> <CABuGu1paM6qjUF9sdHMR8iTJDrwp4TRPRXk4YMZ0vmKXjgHXjw@mail.gmail.com> <4a8d9564-ba0c-9c9b-7a23-ab6340fd2400@gmail.com>
In-Reply-To: <4a8d9564-ba0c-9c9b-7a23-ab6340fd2400@gmail.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dmarc/p858wv3IuVny7ROhpoGgklrUgAU>
Subject: Re: [dmarc-ietf] ARC-Seal is meaningless security theatre
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Aug 2017 23:22:16 -0000

On 8/11/2017 1:19 PM, Dave Crocker wrote:
> On 8/11/2017 9:34 AM, Kurt Andersen (b) wrote:
>> I think that we have that sort of information scattered around in
>> various non-spec presentations that have happened regarding ARC. Do
>> you consider this to be something that should be tackled before or
>> after the "intent"-related notes in your earlier review notes from
>> the end of July?
>
>
> I think it's compatible with some of the concerns I raise and so
> should be pursued at the same time.  I'm hoping that the exercise will
> produce much better clarity and coherence and widespread understanding
> of what ARC will and will not do.
>

This is important if there is going to be an wider implementation here 
especially among the community of non-open source developers.  This is 
where the expense will be and there is an  expectation of having a 
document can developers can produce code from.

-- 
HLS