IETF Logo Mail Archive

RE: We need an architecture, not finger pointing.

Christian Huitema <huitema@microsoft.com> Tue, 27 October 2015 18:17 UTC

Return-Path: <huitema@microsoft.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D2C81ACDC0 for <ietf@ietfa.amsl.com>; Tue, 27 Oct 2015 11:17:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K8-T9Ogeja7G for <ietf@ietfa.amsl.com>; Tue, 27 Oct 2015 11:17:15 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0127.outbound.protection.outlook.com [207.46.100.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B09F1ACDC6 for <ietf@ietf.org>; Tue, 27 Oct 2015 11:17:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=TM1S/Lz2d1LRoLqnIYMTGS0SrwyJLt8b+cQjSgfBeyc=; b=SKMYFZYCO+xPvSipwNBsRqpFA77JrQcIpihsAXUoFm0X4QJeOF6VkzBfrc8Y4mDn8Bpx9WnlxJa+SJOVkXw6iP50J/GzmtWdEIhWdoel6z1r54BIfMKnb8XmWZqfvL1/IYPJNZXKbRgCdW8bN1PR/LiVD1ZjFvq0MinlsSr3pF4=
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com (10.160.96.17) by DM2PR0301MB0653.namprd03.prod.outlook.com (10.160.96.15) with Microsoft SMTP Server (TLS) id 15.1.306.13; Tue, 27 Oct 2015 18:17:11 +0000
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) by DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) with mapi id 15.01.0306.003; Tue, 27 Oct 2015 18:17:11 +0000
From: Christian Huitema <huitema@microsoft.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>, Phillip Hallam-Baker <phill@hallambaker.com>
Subject: RE: We need an architecture, not finger pointing.
Thread-Topic: We need an architecture, not finger pointing.
Thread-Index: AQHREAK9ztYQ9yK3hkOydehbnzhrbp5+xEWAgADg5/A=
Date: Tue, 27 Oct 2015 18:17:11 +0000
Message-ID: <DM2PR0301MB06559397EF4341AFC279503BA8220@DM2PR0301MB0655.namprd03.prod.outlook.com>
References: <CAMm+LwiO02P5r=+QthsDSosTYxP2pajMcJYrv+47omJOsgMeZQ@mail.gmail.com> <562F0125.20400@gmail.com>
In-Reply-To: <562F0125.20400@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=huitema@microsoft.com;
x-originating-ip: [2001:4898:80e8:5::4fd]
x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0653; 5:VOwE6TwRufBf2BGSu8BaYwaSvpxEcHDT8yUV1Hs8yw11iol8fhpeG9b9h+ppbELmsSBlQCjTgtGH3Ml2u11e3gKLQ02pEFC0RI12/WwfufNXhwPEZjRJ+SoeNv/vLEnXk1+Alm/OFwhVNN7TmCQ9Gg==; 24:A8H0sFj32X6EZyYXoiC2/R2/SagL6ZoCMSHMVzOdaBLhj3u7okYLb/INrGyFMjMlvM5pD3U6tyYWUbpYGUj5vJjR4ryV0B5PscMgkMsyIYY=; 20:QShPgFiNX2SwxdcVwpYIo/iXWHPtn8XfZxxLpAYcMcTe1MNQns9A98xBxyZHLBKSk5wAGExkJdCuOnIYV56mrg==
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0653;
x-microsoft-antispam-prvs: <DM2PR0301MB065372611B29B2ECA57BCD11A8220@DM2PR0301MB0653.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425024)(601004)(2401047)(8121501046)(520078)(5005006)(3002001)(102215026)(61426024)(61427024); SRVR:DM2PR0301MB0653; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0653;
x-forefront-prvs: 0742443479
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(24454002)(199003)(377454003)(189002)(74316001)(189998001)(33656002)(106116001)(2950100001)(5004730100002)(102836002)(11100500001)(8990500004)(5003600100002)(5001960100002)(10290500002)(10400500002)(5002640100001)(5008740100001)(10090500001)(5005710100001)(2900100001)(77096005)(5007970100001)(81156007)(106356001)(122556002)(19580395003)(97736004)(19580405001)(92566002)(50986999)(40100003)(5001770100001)(87936001)(86362001)(105586002)(86612001)(99286002)(101416001)(76176999)(54356999)(76576001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0653; H:DM2PR0301MB0655.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Oct 2015 18:17:11.6286 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0653
Archived-At: <http://mailarchive.ietf.org/arch/msg/ietf/lbnxDCIJQGX6PC1hDVF_TDt0m9Y>
Cc: Philip Homburg <pch-ietf-3@u-1.phicoh.com>, John Levine <johnl@taugh.com>, IETF Discussion Mailing List <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Oct 2015 18:17:17 -0000

On Monday, October 26, 2015 9:44 PM, Brian E Carpenter wrote: 
> ...
> 
> Architecturally, we need to validate that phill@hallambaker.com is the
> genuine sender even after the message has been relayed. DMARC doesn't do
> that in its present form.

Actually we need to validate two assertions:

* That the mail came from the stated author, e.g. PHB.
* That the mail was relayed by the IETF mailing list.

Identity checks matter. Lots of the discussion focused on SPAM, but the "acute problem of the day" is actually phishing, and specifically forging a mail that appears to come from someone you trust, to entice you to open a document or visit a URL that you should not. That's a pretty common step in the chain of events that leads to another "42 million user accounts compromised in a breach." 

-- Christian Huitema

v2.46.0 | Report a Bug | By Email | System Status