Slashdot Mirror
Big Internet Players Propose DMARC Anti-Phishing Protocol
judgecorp writes "Google, Microsoft, PayPal, Facebook and others have proposed DMARC, or Domain-based Message Authentication, Reporting and Conformance, an email authentication protocol to combat phishing attacks. Authentication has been proposed before; this group of big names might get it adopted." Adds reader Trailrunner7, "The specification is the product of a collaboration among the large email receivers such as AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America and others, all of whom have a vested interest in either knowing which emails are legitimate or being able to prove that their messages are authentic. The DMARC specification is meant to be a policy layer that works in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework)."
no really what the down side to this? my paranoia is curious....
What's wrong with PGP?
Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."
Everybody sign your emails, so that email from fuck-knows-who sticks out like a sore thumb. This would strike a great blow to phishing, and spam in general.
And best of all, people don't need new software for it. You don't need a new standard because there are already two competing standards (PGP vs S/MIME) -- why add a third? Just start using what you've already got.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Had to be done. Someone else can fill it out, I don't have time.
Your post advocates a
( ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Someone used to post a form with few boxes checked saying stuff like, "your idea will not work because: [x] blah [*] yadda yadda yadda", everytime there was an idea to combat spam/phish. Wonder what happened to him.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Your post advocates a
(x) technical ( ) legislative (x) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Custom electronics and digital signage for your business: www.evcircuits.com
Random fun fact: Yahoo uses something domain keys to authenticate their email. I can send myself a short message (like, just a URL) and it winds up in my spam folder.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
A certain amount of "user effort" is required to use PGP -- at the very least, the user must obtain the public key of the person they are corresponding with, and they must then verify that the key actually belongs to that person, etc. Experience has shown that users are not willing to put in that level of effort, especially when most users do not really understand what their effort is accomplishing.
..." indicates who the message came from go through the effort of setting up PGP?
Users' failure to understand what they are protecting themselves from when they use PGP is the biggest problem here. I routinely shock people, even people with technical backgrounds, by showing them how easily email headers can be spoofed. People generally think that if their email program says, "This is from your bank," it must mean that the email came from their bank. Why would someone who thinks that "From:
Palm trees and 8
"Spam will be a thing of the past in two years' time."
Did anyone else read that acronym as DARMOK at first glance? I keep picturing Picard getting Data to filter the spam in his inbox...
I like to think of online DRM as something akin to a college -- you pay for lessons until you learn something.
Seriously, if all the major free e-mail services signed every outgoing e-mail, wouldn't that cover about %MADEUPPERCENTAGE (but certainly more than half, perhaps closer to 90%) of all e-mail? Have Gmail/Yahoo/Hotmail/whathaveyew create a public/private key for each user, create a new e-mail header for keys (so it's not lurking in the sig confusing people.) This covers most of the Joe User situations (people who run their own server would know enough to sign their own email) and puts the onus on Hotmail/Gmail/Yahoo/whathaveyew policing their own users (heaven forbid!)
Is it just me or doesn't the majority of the spam I get come from: AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America.
To me, this just seems like an attempt by big spammers to eliminate little spammers.
If you want a certified email then set up an electronic postal service and give the new certified domain to them. To send a certified email an account would need to be set up with them and your information verified before you are permitted to send anything through them. The domain would have a set range of IP addresses certified and when a recipient receives a an email from Bank of America if it isn't from BofA@USEPO.gov AND an IP in the white-listed range then delete it. The service would need to charge a fee to maintain the service but how much is your security worth?
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
As someone who works 6 days a week fixing the things let me say why this won't work....users are fucking stupid. No seriously, dumb as post,thicker than Mississippi mud, make Forest Gump look like Stephen Hawking, spend a week at any shop and see if your gob isn't permanently smacked by the level of stupid we encounter.
Oh don't get me wrong, we do our best. most of us put on free AVs and try to educate the user but frankly the shit goes in one ear and out another, here let me give an example. One of the local insurance companies has an employee we call "Velma the disaster area' for how quickly she can hose a PC. Now the insurance company won't fire her because she has a mind like a steel trap for insurance, so when Joe the plumber walks in Velma can go "Hey Joe, how's Betty? you're youngest Cindy is about to be driving age and you know i can get you a discount if she gets good grades, does she have time to take a safety course? because i can get you a lower rate if she takes one" and so on. Needless to say the gal brings in business so they STFU and just make us poor fixit guys deal with Velma.
Here is my last exchange with Velma, swear to god its true: Me/Do NOT open that password protected email, its a virus! Velma "Oh you worry too much, its from my BFF Kim, see? that's her name right there, she wouldn't do anything bad she's my BFF!" /Me/ I KNOW Kim and she does NOT have the skills to password protect anything, hell she'd never even find the button! Do NOT open that! Velma "Oh Kim is not that bad on computers and she could have got her husband Bill to do it, and it says its kitten pics see? She know I like kittens!" /Velma promptly opens the zip, clicks on the .exe, and hoses the machine/ Velma "Ooops" /Me ...........
So you see friends the malware guys will just do as they are doing now and hit the weakest link which is ALWAYS PEBKAC. I haven't see a Windows driveby since Vista came out, simply because malware writers are lazy and can just get the idiot behind the desktop to do the work for them instead of having to do all that coding work. So it doesn't matter if they make email dummy proof, the malware guys simply will switch to loading a keylogger in a match 3 game or kitty screensaver and that's all she wrote.. the only way to kill malware would also kill FOSS deader than Dixie because you'd have to switch all the users to locked down iShiny or Wintabs where they have ZERO rights to do anything but what the corps tell them to, and to turn the net into an oversized home shopping network. Personally i like having control over my machines too much to let the march of the morons destroy my ability to put what I want on them, so they can try all they want but i can tell them it just won't work. No matter how smart your solution is the monkey with the wrench will fuck that shit up big time.
ACs don't waste your time replying, your posts are never seen by me.
Seriously, what you are asking for above is DKIM, since there would be no point into having a different signature for each users if they aren't the only one holding the private key... With DNSSEC, you wouldn't need Gmail/Yahoo/Hotmail/whathaveyew to have their key signed, but just a record like this:
$origin _domainkey.example.com.
postfix TXT "k=rsa\;p=an-rsa-key-that-slashdot-dont-let-me-post"
would simply be trust-able. So, DKIM + DMARC + DNSSEC == authenticated From: domain. If you need the user@ part, then use PGP (and don't ask for your provider to host/provide you a private key, that's simply wrong!).
What exactly does this do to stop all of that spam
It's not an anti-spam tool, so you are right: nothing. But ...
or that the spam didn't come from Yahoo when it most clearly did?
... DMARC does something for that.
The weak link in any security scheme is the humans that are involved. I don't see how DMARC, DKIM, SPF or any other combination of policies and technology is going to prevent the compromise of the human elements. Phishing is *way* too lucrative an enterprise to be abandoned; the phishers and the criminal organizations that back them are not going to give it up without a fight. What is going to stop a criminal organization, for example, from suborning the system administrators at a DMARC-compliant hosting provider? What will stop them from bribing/extorting sysadmins to look the other way (or whatever that means in terms of compromising DMARC) if/when DMARC starts to compromise their profits?
About a year ago, when I was trying to figure out why notices from BofA were crashing my Moto RAZR, I did a little reading up on DKIM, and found it rather interesting. What I found even more interesting is that all the DKIM support I could locate operated at the MTA level (sendmail, postfix, etc.). I couldn't find any client-side tools that would verify DKIM signatures.
Has this situation changed (or did I miss something)? Are there any tools I could plug in to, say, 'mutt' to verify DKIM signatures?
Schwab
Editor, A1-AAA AmeriCaptions
Hmm... You could set her up with the moral equivalent of a "Live CD," i.e. the core OS files are read-only, with maybe a UnionFS-type of writeable store overlaid on top. All her data files would be on normal read-write partitions. Thus, if she infects her machine, all that's required is a reboot. Naturally, installing new software would require administrative intervention, but honestly, other than OS updates, how many times does she need to install something?
You could also put her machine in a DMZ on the company's network so her machine doesn't reach out and contaminate others.
...And I imagine you've probably already thought of most of this...
Schwab
Editor, A1-AAA AmeriCaptions
> ... the only way to kill malware would also kill FOSS deader than
> Dixie because you'd have to switch all the users to locked down
> iShiny or Wintabs where they have ZERO rights to do anything
> but what the corps tell them to, and to turn the net into an oversized
> home shopping network. Personally i like having control over my
> machines...
It's not an either/or situation. Apple just had their biggest quarter ever, selling tens of millions of iDevices.... did your personal computers disappear? Did Sourceforge or Freshmeat close up when Apple's App Store opened? Has the Internet changed in any meaningful way since the introduction of these things? (OK, maybe "yes" to that last one, but the **AA are a bigger threat to the 'Net than Apple, Google, or Microsoft.)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I have and it's the only way I run the network and systems my employer gave me responsibility over. Users have no right at the office to install software that's not approved for business reasons, nor visit websites that aren't in any way applicable to their position of responsibility. Those sites are whitelisted in a similar manner to what programs are allowed to run. This has effectively shut down all the 'bandwidth hogs' and time wasting game sites not to mention all the shitty sites that love to give people malware. And management has praised the work I've done. So yes, the users absolutely *WILL* tolerate it or they can find another job. That's been tested and proven to be effective.