Re: [dmarc-ietf] DMARC alignment conflicts with RFC 5322 on the use of the From and Sender header fields

[Dave Crocker <[e-mail]>]

Wow. I'll ask folk to reread my text, here, carefully, since it 
specified something quite narrow and concrete, but is somehow being 
taken to have meant something broad and general:

> On Tue, Jun 2, 2020 at 1:46 PM Dave Crocker <[e-mail] 
> <mailto:[e-mail]>> wrote:
>> However there appears to be no actual evidence that lying in the From 
>> field affects end user behaviors, and certainly none that lying in 
>> the From field about the domain name does.


And again, there are all sorts of threats and all sorts of bad 
behaviors, but the question is whether a particular kind of bad actor 
behavior affects recipient end-user behavior.

And the specific kind is lying about the From: field domain name.

Please point to specific research -- not an extended report with lots of 
varying content.


On 6/2/2020 2:30 PM, Seth Blank wrote:
> There are decades of data that prove just this.

As I said, we did an extensive literature search at the beginning of the 
BIMI and there was no supporting research.

So now let's look at the purported counter-example you provided:

> On the abuse side, Microsoft, Google, Proofpoint, Mimecast, and others 
> (including Valimail) have all published reams of research reports over 
> the years. On the marketing side, there's another decade or two of 
> data about how properly crafting the From materially impacts open 
> rates on messages, which means user behavior is certainly impacted by 
> what's in the From and display name.
>
> There's more data here than can be meaningfully summarized. So to pick 
> one at random about usage of these methods in abuse, read page 11 of 
> this report: 
> https://www.proofpoint.com/sites/default/files/pfpt-us-tr-q117-threat-report.pdf

Doesn't contain the word 'behavior'.

Doesn't contain 'from:'

Only 'author' is reference to malware creators, not recipients.

'Recipeint' gets a brief sidebar reference to mail pretending to be from 
a top executive. Another sidebar with the word explains 'spoofing' as 
impersonation (which, of course, is what it means in the real world, but 
not in the email abuse world, which has a much broader definition.

I'll stop now and note that the reference you gave appears to have 
nothing to do with the specific behavioral issue I cited.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net