Re: [secdir] [taugh.com-standards] Re:Security review of draft-levine-herkula-oneclick-05

[Ben Laurie <[e-mail]>]

On 19 September 2016 at 00:36, John R. Levine <[e-mail]> wrote:

> One other thought -- I think the most common thing that mailers do is to
> put the subscriber info into a database where each record includes a
> randomly generated key unrelated to anything else.  Then you put that key
> into the URI, no HMAC needed.
>

Yep.


>
> R's,
> John
>
>
> It's only a goal here because they have other ways to do it if it's not
>>>> one-click.
>>>>
>>>
>>> Ok, then in that case it seems like you only need to secure the POST
>>> arguments, not the URI.
>>>
>>
>> There's several scenarios that this draft is addressing:
>>
>> A) bad guy sends fake mail with real insecure opt-out link, MUA clicks it
>> indirectly when user hits the junk button
>>
>> B) real message with real link is clicked by helpful anti-spam software,
>> not the user
>>
>> The hash stuff is for A, the POST is for B.  Since the POST gets both the
>> URI and the arguments, the hash can be in whichever is operationally
>> easier.  All the places that have rules about commercial junk mail say that
>> if the recipient tells you to stop, you have to stop and "the link was in a
>> fake message" isn't a defense. It's quite common now for the unsubscribe
>> URI to be totally opaque, e.g., with a hash and a key the mailer looks up
>> in a database to find the recipient's address, so that malicious parties
>> can't guess other subscribers' addresses.  If they add POST arguments for
>> one-click, they'll likely keep the existing opaque URI, and with the secure
>> URI, the POST arguments tell it nothing beyond the fact that this is a
>> one-click transaction.
>>
>> In the two decades since 2369 came out, the URI stuff has become common
>> knowledge among the narrow group of people for whom "deliverability" is an
>> adjective.  I really don't want to open up 2369 with this draft, because I
>> don't think the small amount this draft says would be helpful.  It doesn't
>> change the way people use 2369, it only adds a new way to do
>> list-unsubscribe.
>>
>
> Regards,
> John Levine, [e-mail], Primary Perpetrator of "The Internet for
> Dummies",
> Please consider the environment before reading this e-mail. https://jl.ly
>