Big Internet Players Propose DMARC Anti-Phishing Protocol

judgecorp writes "Google, Microsoft, PayPal, Facebook and others have proposed DMARC, or Domain-based Message Authentication, Reporting and Conformance, an email authentication protocol to combat phishing attacks. Authentication has been proposed before; this group of big names might get it adopted." Adds reader Trailrunner7, "The specification is the product of a collaboration among the large email receivers such as AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America and others, all of whom have a vested interest in either knowing which emails are legitimate or being able to prove that their messages are authentic. The DMARC specification is meant to be a policy layer that works in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework)."

Comments

Why a new protocol?

[Hentes]

What's wrong with PGP?

Re:Why a new protocol?

[rabbit994]

Because average users have issues with it and they are people this proposal are trying to protect.

If any security is going to happen for average user, it must be forced upon them. Otherwise, "it's too hard"

Re:Why a new protocol?

[mlts]

PGP/gpg is ideal because it sits atop of everything else. However, most people wouldn't be bothered to generate and store securely a private key, much less build a usable WoT and making sure not just just absent-mindedly sign everyone's key that passes by.

We already have email authentication

[Sloppy]

Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."

Everybody sign your emails, so that email from fuck-knows-who sticks out like a sore thumb. This would strike a great blow to phishing, and spam in general.

And best of all, people don't need new software for it. You don't need a new standard because there are already two competing standards (PGP vs S/MIME) -- why add a third? Just start using what you've already got.

Re:We already have email authentication

[Nemilar]

The problem with PGP/signed-emails is that you're putting the burden on the user. I'm a pretty technical guy, and I don't even want to bother with it. There's no way that the average person it going to take the time to understand and implement PGP.

The proposed solution puts the burden entirely on the system and the providers, so is more likely to be adopted and actually used (and therefore, successful in its end-purpose of stopping phishing attacks).

Re:We already have email authentication

[Albanach]

There are also issues with PGP and webmail used by probably the majority of home users, as well as the multitude of devices people now have for email.

You need to sync keys between devices securely, and with webmail you pretty much need to have a browser plugin take over the signing part, unless you want to entrust your private key to a third party.

Simply checking mail onan untrusted web terminal then becomes problematic - sure you can read signed but not encrypted email, but if you tell people it's okay to trust that sometimes, they won't bother checking at other times.

Re:We already have email authentication

[heypete]

I'm an American studying in Switzerland. I bank with PostFinance, the post office-run financial institution.

Any electronic documents or messages from the bank are digitally signed: PDFs are signed and time-stamped using the built-in PDF signature methods. Emails, even the general informative newsletter containing no account-related information at all, are signed with S/MIME. Any account related communications take place using the internal messaging system on their secure website (which requires the user have access to their bank-issued smartcard and offline calculator-like challenge-response device). The instructions that came with the bank card and calculator device make it very clear how to verify that one is actually on the bank's website.

It's trivial to verify that documents and emails are actually issued by the bank, and the login method for the bank's website makes phishing much more difficult.

Compared to USAA, one of the more clueful US banks, this is excellent. Emails from USAA have the last four digits of the account number in the top-right of the message so as to "authenticate" that the message came from the bank. Of course, this is trivial to reproduce and offers no real validation. It's a shame, really.

If more banks (and indeed, more senders in general) signed their messages, that'd be a major improvement. If the big webmail providers (Gmail, Yahoo, and Hotmail) verified S/MIME signatures and displayed a suitable indicator to users, that'd be even better.

Re:We already have email authentication

[jader3rd]

While I realize this is more of an implementation issue than a conceptual issue, the reason why people aren't signing their emails is how clients make the signed emails stand out. I had a coworker who had digitally signed emails, and Outlook showed a little red ribbon next to the message. I'm sure the idea being that it was letting me know that the message was digitally signed. Did I know for %100 that the email was from this person? No. Perhaps someone had his credentials and was using his system in a malicious way. So having it signed didn't matter. Plus one day emails from him stopped being signed. Did I accept those emails just as readily and I did his signed ones? yes. Why? I didn't care. He had moved clients and hadn't setup signing emails yet. The emails sounded like the emails he sends, so there was no reason to not believe them. What should have happened was my client should have freaked out that someone who was sending signed emails had stopped sending signed emails (which I suspect is a red flag in the digital signature situation), but it didn't. I trusted that the emails where from my coworker without the signature just as much as I did with the signature. I think that a much more useful system would be one which detects discrepancy. One example would be the stopping of signed emails. Another would be receiving an email from a person, but the domain is different than the domain they usually get sent from. I did have that happen to me. Someone created an account under my name, with my handle, but on a different domain. Then this person sent a very hurtful email my fiancee. My fiancee was going to break up with me, but I was able to point out to them that I'd never sent them an email from that domain, and that it wasn't my account. I would have really liked it if the system had flagged that email saying "This email looks a lot like it came from someone you usually get emails from, except it's different". If that can be done correctly I imagine my fiancee would have looked at the email and thought "A potentially suspicous email, I will read it, but realize it might not be legit", and after having read it would realize that it wasn't from me. So a system that flags slight alterations would go a mile further in protecting people than digital signatures that people consider to be more of a bother than a benefit.

Re:We already have email authentication

[betterunixthanunix]

Even on cryptography mailing lists and newsgroups most people are not signing their messages. Getting people to put in the effort needed to set up PGP is just not going to happen; it needs to be the default, and it needs to be easier. I say this as someone who has been signing his emails for years, and who has tried for years to get other people to do the same.

Here is how the conversation usually goes, assuming that you get as far as convincing them that signing is something worth the time to do:

Cryptonerd: Hey, you should sign your mail, so that everyone will know it really came from you!
Other person: Oh, good point, someone might steal my password and send an email from my account. OK, what do I do?
Cryptonerd: It's easy, just install GnuPG, and now Thunderbird, and now Enigmail, and now set up your key -- make sure it is at least 2048 bits -- OK now enter a passphrase and now you can only read or send emails from this computer!
Other person: You mean I cannot just log in from some random other person's computer and read my mail? I'll pass thanks.

Thanks to the RSA patents and the efforts of the NSA and DOJ, cryptography just never became the default online. Users are not going to take the time to set up something as complicated as PGP, especially not when it means restricting themselves to particular computers that happen to have their keyring. Asking users to do something special is an uphill battle, and in the case of PGP it is like climbing Everest.

Re:We already have email authentication

[doublebackslash]

The problem with PGP/signed-emails is that you're putting the burden on the user.

Okay, I'll bite. (not TOO hard, mind)

So lets use PGP and still put the burden on the ISP / email provider / Facebook / anyone but the user

1. Every email client in the world ships with PGP support
2. Every email provider issues a key to their users. This can be done by the email client getting the key from the server when it authenticates (say a specially crafted email that it then hides from the user. No need to make it complex like extending the protocol! Just use existing technologies like "Magic emails") And emails of this format could be filtered trivially from being recieved (so no emailing someone a new private key!)
3. Every email is signed and verified and those that aren't are flagged as "DANGER DANGER!" or ones signed but from somewhere not trusted, etc etc. PGP has a wonderful system of trust built in. It can be used in any way they want (google, MS, Yahoo, etc publish public keys and sign user keys with it, etc)

Lastly if someone savvy enough wants to use their own PGP key they can. Just get it signed by their email provider or some other such proof that they control that email address. PGP has this sort of thign already, very nice! https://keyserver.pgp.com/

Bonus points to PGP: since it already has the idea of a web of trust it can be used to GREAT effect. The email client could regognize that you seem to work with this person or email them a lot and ask, "Do you know this person in real life? Do you trust that this email is from them?" and sign keys that way. In this way one could have direct evidence that an email comes from someone that they can trust rather than just Google's big red rubber stamp. How novel!

We could really make this work with popular social media sites like facebook (I'm not a member, but lotsa people are) and show where this person is on your social graph (if they are at all)

So that is how we can use PGP, have it be as good AND BETTER than something new and not make the users do it. Sure there are more than a few flaws in the above but that is the basic outline.

Re:We already have email authentication

[IamTheRealMike]

Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."

You're way behind the times. Go read up on email authentication and DKIM. You will find that a significant fraction of all email on the internet is being signed automatically - that is how DKIM works. The difference is, it's signed with the email providers keys instead of the users keys. But this is good enough to stop phishing because if an email claims to be from info@paypal.com or sloppy@gmail.com, the signature proves it came from PayPal or Gmail and you can then trust that they won't sign such mail unless it really did come from that address.

DMARC solves a problem that real world DKIM deployments have - merely signing your mail is not enough. You need to tell people what to do if signature checks fail. And you need a way to learn about failing signature checks, because large organizations often have incredibly complex mail streams, including mail they know nothing about because some random guerilla marketing team contracted a third party provider and told them to send as "campaign@foo.com", even though it's not being sent via foo.coms servers. This has made real deployments of DKIM quite tricky and ad-hoc affairs. DMARC will standardize this and make deployment feasible even for smaller organizations.

DKIM has other problems, like the number of mail relays that think it's OK to modify mail in transit whilst claiming it comes from the original sender, but those are all issues you get with retrofitting digital signatures onto an existing infrastructure./p

Re:We already have email authentication

[GPLHost-Thomas]

DMARC solves a problem that real world DKIM deployments have - merely signing your mail is not enough. You need to tell people what to do if signature checks fail.

Note only that. With DKIM, when you receive a mail, basically, its header are telling that the mail is signed, and that you can go ahead and check the DNS for the key. But if there's no such thing in the email, then no further check will be made. With DMARC, you will finally have a way to tell if a domain requires DKIM or SPF checks, which wasn't in the specs before.

some random guerilla marketing team contracted a third party provider and told them to send as "campaign@foo.com", even though it's not being sent via foo.coms servers

DMARC will force M. marketing to send his emails correctly, because now it's going to be really impossible to send emails without the foo.fr servers.

DKIM has other problems, like the number of mail relays that think it's OK to modify mail in transit whilst claiming it comes from the original sender

I haven't seen any relay explicitely deleting DKIM signatures. They even can add their own, and you'd receive a mail signed multiple times (which is fine in the DKIM specs). The issue with relaying (in fact, forwarding) is more with SPF, which is a stupid technology that DKIM supersedes.

Obligatory

[Anonymous Coward]

Had to be done. Someone else can fill it out, I don't have time.

Your post advocates a

( ) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Obligatory

[GPLHost-Thomas]

approach to fighting spam

GAME OVER ! The topic is *not* about SPAM, but about make sure it's impossible to forge a fake From (I should write "envelope-from", but you don't seem to be a technical person, so I wont confuse you too much...), when you don't own the domain. This, DKIM and DMARC (and I'd add: with DNSSEC) really can do it now. Please try to understand the topic before writing too much about it and exposing yourself. Maybe also, next time, you'll read the title of the slashdot headline? Because it clearly is about phishing, and *not* about SPAM (sorry to insist, but you've really missed the obvious...).

Re:And the downside is?

[del_diablo]

Well, there is a certain minor downside......

Where is that fixed font check box post?

[140Mandak262Jamuna]

Someone used to post a form with few boxes checked saying stuff like, "your idea will not work because: [x] blah [*] yadda yadda yadda", everytime there was an idea to combat spam/phish. Wonder what happened to him.

Re:Where is that fixed font check box post?

[alvinrod]

Someone found where he lived and burned his house down.

Re:Where is that fixed font check box post?

[Jaqenn]

And they did it with a lemon! They got their engineers to invent a combustible lemon that burned his house down!

http://www.youtube.com/watch?v=7mUC-262Xr4

You're proposing

[guruevi]

Your post advocates a

(x) technical ( ) legislative (x) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Still have to fight layers of stupidity

[sootman]

Random fun fact: Yahoo uses something domain keys to authenticate their email. I can send myself a short message (like, just a URL) and it winds up in my spam folder.

I use PGP but...

[betterunixthanunix]

A certain amount of "user effort" is required to use PGP -- at the very least, the user must obtain the public key of the person they are corresponding with, and they must then verify that the key actually belongs to that person, etc. Experience has shown that users are not willing to put in that level of effort, especially when most users do not really understand what their effort is accomplishing.

Users' failure to understand what they are protecting themselves from when they use PGP is the biggest problem here. I routinely shock people, even people with technical backgrounds, by showing them how easily email headers can be spoofed. People generally think that if their email program says, "This is from your bank," it must mean that the email came from their bank. Why would someone who thinks that "From: ..." indicates who the message came from go through the effort of setting up PGP?

Yeah...

[3vi1]

"Spam will be a thing of the past in two years' time."

Why can't free mail services PGP-sign everything?

[mistapotta]

Seriously, if all the major free e-mail services signed every outgoing e-mail, wouldn't that cover about %MADEUPPERCENTAGE (but certainly more than half, perhaps closer to 90%) of all e-mail? Have Gmail/Yahoo/Hotmail/whathaveyew create a public/private key for each user, create a new e-mail header for keys (so it's not lurking in the sig confusing people.) This covers most of the Joe User situations (people who run their own server would know enough to sign their own email) and puts the onus on Hotmail/Gmail/Yahoo/whathaveyew policing their own users (heaven forbid!)

Re:um...

[jmkaza]

The majority of your spam SAYS it comes from [insert provider here]. This is intended to stop that.

Re:From: critical@paypal-warning.com

[hairyfeet]

As someone who works 6 days a week fixing the things let me say why this won't work....users are fucking stupid. No seriously, dumb as post,thicker than Mississippi mud, make Forest Gump look like Stephen Hawking, spend a week at any shop and see if your gob isn't permanently smacked by the level of stupid we encounter.

Oh don't get me wrong, we do our best. most of us put on free AVs and try to educate the user but frankly the shit goes in one ear and out another, here let me give an example. One of the local insurance companies has an employee we call "Velma the disaster area' for how quickly she can hose a PC. Now the insurance company won't fire her because she has a mind like a steel trap for insurance, so when Joe the plumber walks in Velma can go "Hey Joe, how's Betty? you're youngest Cindy is about to be driving age and you know i can get you a discount if she gets good grades, does she have time to take a safety course? because i can get you a lower rate if she takes one" and so on. Needless to say the gal brings in business so they STFU and just make us poor fixit guys deal with Velma.

Here is my last exchange with Velma, swear to god its true: Me/Do NOT open that password protected email, its a virus! Velma "Oh you worry too much, its from my BFF Kim, see? that's her name right there, she wouldn't do anything bad she's my BFF!" /Me/ I KNOW Kim and she does NOT have the skills to password protect anything, hell she'd never even find the button! Do NOT open that! Velma "Oh Kim is not that bad on computers and she could have got her husband Bill to do it, and it says its kitten pics see? She know I like kittens!" /Velma promptly opens the zip, clicks on the .exe, and hoses the machine/ Velma "Ooops" /Me ...........

So you see friends the malware guys will just do as they are doing now and hit the weakest link which is ALWAYS PEBKAC. I haven't see a Windows driveby since Vista came out, simply because malware writers are lazy and can just get the idiot behind the desktop to do the work for them instead of having to do all that coding work. So it doesn't matter if they make email dummy proof, the malware guys simply will switch to loading a keylogger in a match 3 game or kitty screensaver and that's all she wrote.. the only way to kill malware would also kill FOSS deader than Dixie because you'd have to switch all the users to locked down iShiny or Wintabs where they have ZERO rights to do anything but what the corps tell them to, and to turn the net into an oversized home shopping network. Personally i like having control over my machines too much to let the march of the morons destroy my ability to put what I want on them, so they can try all they want but i can tell them it just won't work. No matter how smart your solution is the monkey with the wrench will fuck that shit up big time.