Slashdot Mirror
Big Internet Players Propose DMARC Anti-Phishing Protocol
judgecorp writes "Google, Microsoft, PayPal, Facebook and others have proposed DMARC, or Domain-based Message Authentication, Reporting and Conformance, an email authentication protocol to combat phishing attacks. Authentication has been proposed before; this group of big names might get it adopted." Adds reader Trailrunner7, "The specification is the product of a collaboration among the large email receivers such as AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America and others, all of whom have a vested interest in either knowing which emails are legitimate or being able to prove that their messages are authentic. The DMARC specification is meant to be a policy layer that works in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework)."
ATTN: This e-mail has got through yet another badly thought out anti-spam/phishing/whatever proposal. Please send your credit card details in response.
Sincerely,
A. Scammer
no really what the down side to this? my paranoia is curious....
What's wrong with PGP?
Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."
Everybody sign your emails, so that email from fuck-knows-who sticks out like a sore thumb. This would strike a great blow to phishing, and spam in general.
And best of all, people don't need new software for it. You don't need a new standard because there are already two competing standards (PGP vs S/MIME) -- why add a third? Just start using what you've already got.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Had to be done. Someone else can fill it out, I don't have time.
Your post advocates a
( ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Someone used to post a form with few boxes checked saying stuff like, "your idea will not work because: [x] blah [*] yadda yadda yadda", everytime there was an idea to combat spam/phish. Wonder what happened to him.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Your post advocates a
(x) technical ( ) legislative (x) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Custom electronics and digital signage for your business: www.evcircuits.com
Random fun fact: Yahoo uses something domain keys to authenticate their email. I can send myself a short message (like, just a URL) and it winds up in my spam folder.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
A certain amount of "user effort" is required to use PGP -- at the very least, the user must obtain the public key of the person they are corresponding with, and they must then verify that the key actually belongs to that person, etc. Experience has shown that users are not willing to put in that level of effort, especially when most users do not really understand what their effort is accomplishing.
..." indicates who the message came from go through the effort of setting up PGP?
Users' failure to understand what they are protecting themselves from when they use PGP is the biggest problem here. I routinely shock people, even people with technical backgrounds, by showing them how easily email headers can be spoofed. People generally think that if their email program says, "This is from your bank," it must mean that the email came from their bank. Why would someone who thinks that "From:
Palm trees and 8
"Spam will be a thing of the past in two years' time."
Did anyone else read that acronym as DARMOK at first glance? I keep picturing Picard getting Data to filter the spam in his inbox...
I like to think of online DRM as something akin to a college -- you pay for lessons until you learn something.
Seriously, if all the major free e-mail services signed every outgoing e-mail, wouldn't that cover about %MADEUPPERCENTAGE (but certainly more than half, perhaps closer to 90%) of all e-mail? Have Gmail/Yahoo/Hotmail/whathaveyew create a public/private key for each user, create a new e-mail header for keys (so it's not lurking in the sig confusing people.) This covers most of the Joe User situations (people who run their own server would know enough to sign their own email) and puts the onus on Hotmail/Gmail/Yahoo/whathaveyew policing their own users (heaven forbid!)
Is it just me or doesn't the majority of the spam I get come from: AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America.
To me, this just seems like an attempt by big spammers to eliminate little spammers.
If you want a certified email then set up an electronic postal service and give the new certified domain to them. To send a certified email an account would need to be set up with them and your information verified before you are permitted to send anything through them. The domain would have a set range of IP addresses certified and when a recipient receives a an email from Bank of America if it isn't from BofA@USEPO.gov AND an IP in the white-listed range then delete it. The service would need to charge a fee to maintain the service but how much is your security worth?
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
and Jell-o at Tanganyka?
Question: For 1000 points: What exactly does this do to stop all of that spam I get from Yahoo users, that I report (using ARF) to Yahoo only to be told by one of their retards that I need to include full headers (which I do every time, since ARF requires that) or that the spam didn't come from Yahoo when it most clearly did?
Answer: What is abso-fucking-lutely nothing Alex?
Forgeries are only half of the problem. The other half is all of that spam that is coming from legitimate mailboxes from freemail accounts like Yahoo where said freemail providers staff their abuse desk with bricks.
Actually that's offensive to bricks. Bricks have a use and are not a waste of space (or oxygen).
Seriously, what you are asking for above is DKIM, since there would be no point into having a different signature for each users if they aren't the only one holding the private key... With DNSSEC, you wouldn't need Gmail/Yahoo/Hotmail/whathaveyew to have their key signed, but just a record like this:
$origin _domainkey.example.com.
postfix TXT "k=rsa\;p=an-rsa-key-that-slashdot-dont-let-me-post"
would simply be trust-able. So, DKIM + DMARC + DNSSEC == authenticated From: domain. If you need the user@ part, then use PGP (and don't ask for your provider to host/provide you a private key, that's simply wrong!).
The weak link in any security scheme is the humans that are involved. I don't see how DMARC, DKIM, SPF or any other combination of policies and technology is going to prevent the compromise of the human elements. Phishing is *way* too lucrative an enterprise to be abandoned; the phishers and the criminal organizations that back them are not going to give it up without a fight. What is going to stop a criminal organization, for example, from suborning the system administrators at a DMARC-compliant hosting provider? What will stop them from bribing/extorting sysadmins to look the other way (or whatever that means in terms of compromising DMARC) if/when DMARC starts to compromise their profits?
About a year ago, when I was trying to figure out why notices from BofA were crashing my Moto RAZR, I did a little reading up on DKIM, and found it rather interesting. What I found even more interesting is that all the DKIM support I could locate operated at the MTA level (sendmail, postfix, etc.). I couldn't find any client-side tools that would verify DKIM signatures.
Has this situation changed (or did I miss something)? Are there any tools I could plug in to, say, 'mutt' to verify DKIM signatures?
Schwab
Editor, A1-AAA AmeriCaptions