Re: [secdir] [taugh.com-standards] Re:Security review of draft-levine-herkula-oneclick-05

["John R. Levine" <[e-mail]>]

>> It's only a goal here because they have other ways to do it if it's not
>> one-click.
>
> Ok, then in that case it seems like you only need to secure the POST
> arguments, not the URI.

There's several scenarios that this draft is addressing:

A) bad guy sends fake mail with real insecure opt-out link, MUA clicks it
indirectly when user hits the junk button

B) real message with real link is clicked by helpful anti-spam software, 
not the user

The hash stuff is for A, the POST is for B.  Since the POST gets both the 
URI and the arguments, the hash can be in whichever is operationally 
easier.  All the places that have rules about commercial junk mail say 
that if the recipient tells you to stop, you have to stop and "the link 
was in a fake message" isn't a defense. It's quite common now for the 
unsubscribe URI to be totally opaque, e.g., with a hash and a key the 
mailer looks up in a database to find the recipient's address, so that 
malicious parties can't guess other subscribers' addresses.  If they add 
POST arguments for one-click, they'll likely keep the existing opaque URI, 
and with the secure URI, the POST arguments tell it nothing beyond the 
fact that this is a one-click transaction.

In the two decades since 2369 came out, the URI stuff has become common 
knowledge among the narrow group of people for whom "deliverability" is an 
adjective.  I really don't want to open up 2369 with this draft, because I 
don't think the small amount this draft says would be helpful.  It doesn't 
change the way people use 2369, it only adds a new way to do 
list-unsubscribe.

Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly