Re: [dmarc-ietf] Call for Adoption: DMARC Use of the RFC5322.Sender Header Field

[Laura Atkins <[e-mail]>]

> On 17 Aug 2020, at 14:18, Dotzero <[e-mail]> wrote:
> 
> And, 17 years on, we know that domain level authentication doesn’t actually help filter spam nor does it provide law enforcement with a potent tool for locating and identifying spammers. It was promising, it didn’t live up to the promise. 
> 
> There were a lot of thrown at the wall during those 3 days of talks. One of them was domain level opt-out. Another was a global opt-out list similar to the postal opt-outs run by the DMA. Another was a technology called TEOS. HashCash. The list of things we discussed as promising solutions was extensive. Just because we discussed a particular kind of solution does not mean that anything was decided. It also doesn’t mean that any particular solution mentioned was workable. 
> 
>>> https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day1.pdf <https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day1.pdf>
>>> https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day2.pdf <https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day2..pdf>
>>> https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day3.pdf <https://www.ftc.gov/sites/default/files/documents/public_events/ftc-spam-forum/transcript_day3.pdf>
>> 
>> 
>> Thanks.  Let me quote a paragraph by Paul Q. Judge, from the 3rd pdf:
>> 
>>    It doesn't require that one day everyone turns it on and we begin
>>    to drop the rest of the e-mail and break e-mail.  If a domain
>>    decides to turn it on, then they've prevented forgery for their
>>    domain and they're protected.  For persons that have not turned it
>>    on, then their e-mail still flows but they are not able to
>>    stop people from forging messages from their domain.  So, I think
>>    it's something useful and can be deployed incrementally.
> 
> We know, now, that turning on domain level protection does not stop phishing attacks against that company. It stops direct spoofing of the domain, but the phishers simply use a completely different domain. Just this weekend I got a PayPal phish. PayPal who helped invent DMARC are still getting spoofed and phished. Sure, the phishers aren’t using the paypal.com <http://paypal.com/> domain, but that doesn’t seem to have any effect on their success at stealing money from people. 
> 
> You raise an interesting point, Laura. Whatever "solutions" we put in place, the abusers/bad guys will evolve. One of the problems for the good guys (for some definition of good) is that standards work takes years (decades?)  while the bad  guys change their tactics at will. Crime existed before the Internet and will continue long after we are all dead and buried.

Totally agreed. The issue here is that DMARC is a fundamentally flawed model for preventing phishing. Phishers were adapting to mailbox provider filters even before DMARC and there was a lot of cousin and non-look-alike domain phishing even during the initial discussions. I know these issues were brought up during discussion of the protocol. Unfortunately, they weren’t sufficiently addressed and now we’re at a point where, to my mind, DMARC doesn’t fix anything while also breaking a lot of ways folks use mail.

It’s a little late now to go back. I think this is an opportunity to think about the underlying technical problems as well as a chance to revisit the assumptions about how email is used. Discussing things like Dave’s drafts will give us a chance to talk about how people actually use email to communicate with one another. And how we can allow brands what they want without breaking email too much for the rest of us. 

>> It seems we're still stuck midstream...
> 
> Stuck at what? Many of the people who were at that conference are still working in the field and understand both the purpose and what came out of the forum. I’d also say that most of what happened there is a nice bit of history but is also irrelevant to addressing the spam problem as it is now. Email has evolved significantly in the last 5 years, much less the last 15. We can use the discussion as history to say “we looked at this and it didn’t work” but I don’t really see a lot of value in saying “let’s retread things from a decade and a half ago that didn’t work.”
> 
> I think the most 
>  useful thing we can say about the FTC workshops is that they were a forcing mechanism that instigated a lot of effort and innovation in the space. Some of those efforts fell by the wayside and some still persist.

You think? I’m not sure I’d agree. I saw the workshop as mostly a political (and educating the politicians) exercise. The effort and innovation were already there and being done by a lot of people who weren’t there. I’m kinda bemused by the importance folks have assigned to it in relation to the vastly different email ecosystem we have today.

laura 
-- 
Having an Email Crisis?  We can help! 800 823-9674 

Laura Atkins
Word to the Wise
[e-mail]
[phone]		

Email Delivery Blog: https://wordtothewise.com/blog