Re: [lamps] Proposed addition of header protection to the LAMPS charter

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Mon, 12 November 2018 16:01 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94D1B130E4A for <spasm@ietfa.amsl.com>; Mon, 12 Nov 2018 08:01:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.189
X-Spam-Level:
X-Spam-Status: No, score=-4.189 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OM3Nbdn_E4QN for <spasm@ietfa.amsl.com>; Mon, 12 Nov 2018 08:01:51 -0800 (PST)
Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B7C1130E4E for <spasm@ietf.org>; Mon, 12 Nov 2018 08:01:49 -0800 (PST)
Received: from fifthhorseman.net (ool-6c3a0662.static.optonline.net [108.58.6.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id CA211F99A; Mon, 12 Nov 2018 11:01:47 -0500 (EST)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 862A620315; Mon, 12 Nov 2018 10:57:40 -0500 (EST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: John Levine <johnl@taugh.com>, spasm@ietf.org
Cc: housley@vigilsec.com
In-Reply-To: <20181106045754.7331F2007FC274@dhcp-8071.meeting.ietf.org>
References: <20181106045754.7331F2007FC274@dhcp-8071.meeting.ietf.org>
Date: Mon, 12 Nov 2018 10:57:40 -0500
Message-ID: <877ehiwaob.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/nYe8ebzc1jsSwyhG5M68NdG7yOc>
Subject: Re: [lamps] Proposed addition of header protection to the LAMPS charter
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Nov 2018 16:01:53 -0000

On Tue 2018-11-06 11:57:54 +0700, John Levine wrote:
> In article <DC188C55-6FDE-4E64-9151-54815E96B50B@vigilsec.com> you write:
>>3) If it results in an RFC, would you implement?
>
> Not to be an old grouch or anything, but anything that affects mail
> user interfaces is dismayingly hard to do well and easy to do in ways
> that nobody wants to use.  When we were looking at anti-DMARC hacks
> for the IETF mailing lists I wrote a mail reflector that wrapped
> messages in various ways and sent them back so people could see how
> they looked in their mail programs.  The only thing that was
> consistent from one MUA to another was that they looked awful.

John, if you have the infrastructure set up to generate screenshots of
e-mail messages on multiple MUAs (particularly those that handle message
encryption and/or signatures), i'd love to take advantage of it!  If
it's something you can share, please let me know (off-list is fine if
it's not something you can make broadly public).

> I think header protection is a fine idea, but without some code to try
> and see if it's usable, we're far too likely to end up with yet
> another paper spec.

There are multiple clients already doing header protection today,
interoperably (e.g. enigmail and K-9 mail).  This is not a code-free
exercise :)

         --dkg