Re: What I've been wondering about the DMARC problem

Sabahattin Gucukoglu <listsebby@me.com> Fri, 18 April 2014 18:33 UTC

Return-Path: <listsebby@me.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF42E1A03C9 for <ietf@ietfa.amsl.com>; Fri, 18 Apr 2014 11:33:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.601
X-Spam-Level:
X-Spam-Status: No, score=-3.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_21=0.6, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RsGn3-veD5qO for <ietf@ietfa.amsl.com>; Fri, 18 Apr 2014 11:33:48 -0700 (PDT)
Received: from nk11p04mm-asmtp002.mac.com (nk11p04mm-asmtp002.mac.com [17.158.236.237]) by ietfa.amsl.com (Postfix) with ESMTP id F38A91A0220 for <ietf@ietf.org>; Fri, 18 Apr 2014 11:33:47 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; CHARSET=US-ASCII
Received: from [192.168.1.6] (natbox.sabahattin-gucukoglu.com [213.123.192.30]) by nk11p04mm-asmtp002.mac.com (Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug 22 2013)) with ESMTPSA id <0N4800IDWOW4K290@nk11p04mm-asmtp002.mac.com> for ietf@ietf.org; Fri, 18 Apr 2014 18:33:43 +0000 (GMT)
Subject: Re: What I've been wondering about the DMARC problem
From: Sabahattin Gucukoglu <listsebby@me.com>
In-reply-to: <20140417205332.GB4979@thunk.org>
Date: Fri, 18 Apr 2014 19:33:39 +0100
Message-id: <3B5401D0-13B3-4067-BC9D-15C4FBEB1224@me.com>
References: <CAKW6Ri5HWMaGMa_oLKwq5fzSUzJG=jAL1qojY1i6_tibEAxq8w@mail.gmail.com> <CAL0qLwaik1ft+AcACoc+kvKtCRt_gGvM6ov7c2yj_Uwyy3drNw@mail.gmail.com> <CAKW6Ri5_=GyOQijZMM+mqAoaEQzePGysBy9WVjN9yHO1zf3d2w@mail.gmail.com> <534C8F2B.9060903@gmail.com> <534D5516.7060902@dcrocker.net> <534D98CC.9080400@gmail.com> <2478F2D1-2E08-45D7-86A2-36443959E272@me.com> <534EE9EA.9060403@gmail.com> <09B6AA22-9D1D-4EE4-AB27-2506A1E08EDA@me.com> <5350344B.1000400@gmail.com> <20140417205332.GB4979@thunk.org>
To: Theodore Ts'o <tytso@mit.edu>
X-Mailer: Apple Mail (2.1510)
X-MANTSH: 1TEIXREEbG1oaGkdHB0lGUkdDRl5PWBoaHREKTEMXGx0EGx8SBBscHwQdGBAbHho fGhEKWE0XSxEKbX4XGhEKTFkXGxobGxEKWUkXEQpZXhdoY3kRCkNOF0sbGBpiTk0dWhl/ZBl4c wcZYxsSGRlCGBEKWFwXGQQaBB0HTUsdEkhJHEwFGx0EGx8SBBscHwQdGBAbHhofGxEKXlkXYUJ SeUMRCkxGF2xraxEKQ1oXGBsZBBsYGQQbExgEGRoRCkRYFx4RCkRJFxkRCkJFF2ZQfV0fbWQaB UhjEQpCThdscGB5QB1iUmkaYhEKQkwXZ0kfbXlpGH5yQk0RCkJsF2VoZRhtTRwYQ0ZOEQpCQBd nHGdeQmRjUhtzZBEKcGcXZkIdfUx8G0hmUEwRCnBoF29LAR9sSE99SX4bEQpwaBdgfmRGQUIcR 05JBREKcGgXZG9AYXx/f39BTmsRCnBoF2kZAUMaa39oY2dJEQpwaBdiH31tSUZneEh6aBEKcGw Xa2ZOa0FlX2ZTZwERCnBMF2xSGBkFWkVlWn9CEQ==
X-CLX-Spam: false
X-CLX-Score: 1011
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.96, 1.0.14, 0.0.0000 definitions=2014-04-18_01:2014-04-18, 2014-04-18, 1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1404180313
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/VBzYzHlb4aiPjJl4zA-cPJSaLCY
Cc: Jim Fenton <fenton@bluepopcorn.net>, IETF discussion list <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Apr 2014 18:33:50 -0000

On 17 Apr 2014, at 21:53, Theodore Ts'o <tytso@mit.edu> wrote:
> Suppose we made the mailing list software take the contents of the
> From field, and moved it to something like "X-Originally-From: ", and
> changed the From field to be "ietf@ietf.org".org".  That would be what the
> DMARC people would want, right?

Probably.  I mean, the alternative is to upgrade DMARC so it recognises the Originally-From field as From when it is present, but that would actually require maintaining compatibility with decades-old software which didn't know that From was the arbiter of all truth. :)

> Except then, a couple of years later, because users might actually
> want to find the message that was written by "Brian Carpenter", or
> "Sabahattin Gucukoglu", and not from "ietf@ietf.org".org", MUA's might
> start using the Originally-From field in the summary field, and start
> emphasizing the "Originally-From" from field in the UI.  At which
> point, the spammer/scammer/whatever could start forging the the
> "Originally-From" field, and then Lo!  There will be a DMARC II,
> demanding that "Originally-From" field be aligned with the From field,
> and we're right back to where we started.
> 
> It was the same argument about why a DKIM or DMARC couldn't just
> verify the Sender field, and call it a day.  The problem is that the
> From field is what people pay attention to.

Precisely.

Of course, if we're starting just now, there's something we could try differently: write it into Internet law that "NO MUA SHALL PROMOTE FOO TO THE DEFAULT HEADER DISPLAY", where "foo" is whatever we come up with.  Then MUA software, when presented with a known-good and known-aligned authentication results for From: could start displaying the green bar or whatever nonsense they come up with to signal that all is good, just so long as the part to the right of the @ is the domain the user thought the mail was really from.  However the MUA could continue to provide conveniences such as address autocomplete, address book memorisation, search or reply that were all using our new foo.

> And this is true of whatever solution we want to better support
> mailing lists.  Suppose the answer is to rewrite the from field to
> something like this:
> 
> 
> From: ietf-resend+brian.e.carpenter=gmail.com@ietf.org
> 
> Or this:
> 
> From: ietf@ietf.org (Originally from Brian E Carpenter: brian.e.carpenter@gmail.com)
> 
> It doesn't matter.  Eventually, the UA's will start emphasizing and
> parsing out the original From field information, because that's what
> people will want to be automatically added to their address book, and
> not ietf@ietf.org, and that's what they will want to see in their
> e-mail summary.  And then the DMARC folk will say, "Oh, Noes!
> Spammers and scammers and bears, oh my!  They are using this loophole
> to fool the naive user."  We must have DMARC II... and DMARC
> III.... and DMARC IV.... and it will never end.

Indeed.  Of course, none of that helps the mailing lists of yesteryear, I mean today.  Right now, we're all screwed without one of these hacks. :(

Cheers,
Sabahattin