ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] How to reconcile passive vs active?

2006-08-07 12:34:56

----- Original Message -----
From: "Steve Atkins" <steve(_at_)blighty(_dot_)com>
To: "DKIM List" <ietf-dkim(_at_)mipassoc(_dot_)org>

Even when it decreases overall deliverability? That is to say, causes
legitimate email to be treated as forgeries and, likely, discarded.

The fraudulent mail covered are for 0% FALSE POSTIVES. Absolutely No FUZZY
LOGIC. If it was fuzzy, I personally wouldn't wasting my time anymore here.

I can see cases where that's going to be an appropriate tradeoff, but
I don't think they're as widespread as some people think.

The last time someone doubted the potential for fraudulent mail:

   From RFC 2821

   7.1 Mail Security and Spoofing

   ...

   This specification does not further address the authentication issues
   associated with SMTP other than to advocate that useful functionality
   not be disabled in the hope of providing some small margin of
   protection against an ignorant user who is trying to fake mail.

that "ignorant user" turned into a world-wide multi-billion industry
powerhouse.

The SSP is about the 100% detection with 0% false positive of the most
obvious of fraudulent mail, the ones that the unprotected DKIM-BASE protocol
leaves hanging in the wind to be easily exploited.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com







_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

<Prev in Thread] Current Thread [Next in Thread>