ietf-asrg
[Top] [All Lists]

Re: [Asrg] Adding a spam button to MUAs

2010-02-02 05:58:03
On 02/Feb/10 05:44, Chris Lewis wrote:
As long as the client "knows" whether its front ends support this
functionality (might be config value of administrative domain), and
ignores them if it isn't, the security issues are fairly limited.

Still need DKIM?

An ARF received at a domain's "abuse@" mailbox may arrive from an authenticated client, and it won't be DKIM-signed in that case. However, the abusive message being reported may have signatures.

Or it may arrive from a third party. A third party presumably rewrites both the boilerplate and the machine-readable parts, and I would expect it DKIM-signs them. An MTA should only receive reports where the Reported-Domain field indicates its own domain. Generic operators may also receive reports that they are supposed to "forward" --possibly rewriting and signing the first two parts in turn.

If the sender is "permitted" to insert them, for them to mean much, you
get into the same issues as end-to-end DKIM on email has. You know that
the signature verifies or not, but you still don't know whether you want
to trust the information.

Perhaps an MTA should verify on its own that an AR is correct. For authenticated clients, it may check its receive log. For reports routed by third parties, it may also verify its own signatures.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg