Slashdot Mirror
Big Internet Players Propose DMARC Anti-Phishing Protocol
judgecorp writes "Google, Microsoft, PayPal, Facebook and others have proposed DMARC, or Domain-based Message Authentication, Reporting and Conformance, an email authentication protocol to combat phishing attacks. Authentication has been proposed before; this group of big names might get it adopted." Adds reader Trailrunner7, "The specification is the product of a collaboration among the large email receivers such as AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America and others, all of whom have a vested interest in either knowing which emails are legitimate or being able to prove that their messages are authentic. The DMARC specification is meant to be a policy layer that works in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework)."
Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."
Everybody sign your emails, so that email from fuck-knows-who sticks out like a sore thumb. This would strike a great blow to phishing, and spam in general.
And best of all, people don't need new software for it. You don't need a new standard because there are already two competing standards (PGP vs S/MIME) -- why add a third? Just start using what you've already got.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Because average users have issues with it and they are people this proposal are trying to protect.
If any security is going to happen for average user, it must be forced upon them. Otherwise, "it's too hard"
Well, there is a certain minor downside......
Your post advocates a
(x) technical ( ) legislative (x) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Custom electronics and digital signage for your business: www.evcircuits.com
Someone found where he lived and burned his house down.
Random fun fact: Yahoo uses something domain keys to authenticate their email. I can send myself a short message (like, just a URL) and it winds up in my spam folder.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
The majority of your spam SAYS it comes from [insert provider here]. This is intended to stop that.
As someone who works 6 days a week fixing the things let me say why this won't work....users are fucking stupid. No seriously, dumb as post,thicker than Mississippi mud, make Forest Gump look like Stephen Hawking, spend a week at any shop and see if your gob isn't permanently smacked by the level of stupid we encounter.
Oh don't get me wrong, we do our best. most of us put on free AVs and try to educate the user but frankly the shit goes in one ear and out another, here let me give an example. One of the local insurance companies has an employee we call "Velma the disaster area' for how quickly she can hose a PC. Now the insurance company won't fire her because she has a mind like a steel trap for insurance, so when Joe the plumber walks in Velma can go "Hey Joe, how's Betty? you're youngest Cindy is about to be driving age and you know i can get you a discount if she gets good grades, does she have time to take a safety course? because i can get you a lower rate if she takes one" and so on. Needless to say the gal brings in business so they STFU and just make us poor fixit guys deal with Velma.
Here is my last exchange with Velma, swear to god its true: Me/Do NOT open that password protected email, its a virus! Velma "Oh you worry too much, its from my BFF Kim, see? that's her name right there, she wouldn't do anything bad she's my BFF!" /Me/ I KNOW Kim and she does NOT have the skills to password protect anything, hell she'd never even find the button! Do NOT open that! Velma "Oh Kim is not that bad on computers and she could have got her husband Bill to do it, and it says its kitten pics see? She know I like kittens!" /Velma promptly opens the zip, clicks on the .exe, and hoses the machine/ Velma "Ooops" /Me ...........
So you see friends the malware guys will just do as they are doing now and hit the weakest link which is ALWAYS PEBKAC. I haven't see a Windows driveby since Vista came out, simply because malware writers are lazy and can just get the idiot behind the desktop to do the work for them instead of having to do all that coding work. So it doesn't matter if they make email dummy proof, the malware guys simply will switch to loading a keylogger in a match 3 game or kitty screensaver and that's all she wrote.. the only way to kill malware would also kill FOSS deader than Dixie because you'd have to switch all the users to locked down iShiny or Wintabs where they have ZERO rights to do anything but what the corps tell them to, and to turn the net into an oversized home shopping network. Personally i like having control over my machines too much to let the march of the morons destroy my ability to put what I want on them, so they can try all they want but i can tell them it just won't work. No matter how smart your solution is the monkey with the wrench will fuck that shit up big time.
ACs don't waste your time replying, your posts are never seen by me.