Re: [dmarc-ietf] ARC vs reject

[Michael Thomas <[e-mail]>]

On 12/6/20 10:45 AM, Douglas Foster wrote:
> The recent discussion has introduced two challenges to ARC:  first, 
> that it is too complicated, and second, that it opens up security 
> holes that should be unacceptable.    John's response appears to be 
> that the technology will only be used by a small group of lists in 
> cooperation with a small group of recipients, that the complexity will 
> be a non-issue for the participants and the risk, while present, will 
> be mitigated by the limited scope of participation.    All of this is 
> problematic.
>
> On security issues, we have to assume attacks by state-sponsored 
> actors, not just fortune seekers.   So the security challenge needs to 
> be thoroughly vetted.
>
> But the participation assumption is even more worrisome. If this is a 
> limited participation protocol, supported by a private but 
> not-yet-created communication network, then it does not solve the 
> chair's requirement for a general solution.

Indeed, I wonder if ietf.org would meet that criteria for "small group 
of lists".

>
> I ask the chairs to formally endorse development of an alternative to 
> ARC as an additional approach to the mailing list problem, a solution 
> based on reverse transformation.  Alessandro and Murray have submitted 
> drafts.   It is time to study their proposals and merge their work.
>

Based on the work I did at Cisco 15 years ago which essentially was a 
heuristic based form of those two drafts, I found that it worked for 
about 90 some percent. I unfortunately do not know what the nature of 
the remaining messages that could not be recovered (either I never did 
the analysis or don't remember). Things may have changed some since 
then, but that was what we got for the entire mail stream of a large 
company. Is that "good enough"? Or better yet, what is the definition of 
"good enough"?

That's probably the most important question out of all of this: what is 
the success criteria? Our success criteria was that we wanted to mark up 
messages that were possible spear phishing, so the success criteria was 
some given false positive rate, with whitelists to mop up some of the 
corner cases. But that was a very enterprise-y criteria. The larger 
success criteria needs to encompass a far larger set of use cases.

Mike