ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] SSP = FAILURE

2006-09-09 12:20:24
It seems to me you may be saying that a look-alike domain can be made
to look more authentic than the actual domain.  Is that right?  If
so, I'd like to understand that.

It doesn't have to look more authentic.  It only has to look as
authentic.  With SSP, everyone can publish equally authentic "PHISH
TARGET" notices.

I would call forcing phishers to switch from exact domains to
look-alikes progress.

Well, OK.  Here's a small selection from a recent .COM zone file.
Let's pretend they all just sent you mail, and they all have valid
signatures and the most draconian SSP.  Which one is really Paypal?
(One of them is.)

Claims that SSP is a meaningful anti-phishing tool are nuts.

MYPAYPAL.COM
PAYPALSHOPS.COM
PAYPALSTORES.COM
PAYPALCARDSERVICES.COM
PAYPALMC.COM
PAYPALVISA.COM
PAYPALVERIFY.COM
SECURITY-PAYPAL.COM
PAYPALSTORE.COM
PAYPALSYS.COM
PAYPALMAIL.COM
SECURITIES-PAYPAL.COM
PAYPAL-EBAY.COM
PAYPALESCROW.COM
SECUREDPAYPAL.COM
PAYPALSERVICE.COM
WWW--PAYPAL.COM
PAYPALESHOP.COM
PAYPAL-SIGN-IN.COM
PAYPAL-VERIFYD.COM
PAYPALEMAIL.COM
PAYPAL-DATABASE.COM
PAYPAL-REDIRECT.COM
PAYPAL-BILLING.COM
PAYPALCOM.COM
PAYPALINC.COM
PAYPAL-MEMBERS.COM
PAYPAL-MEMBER.COM
WWWWPAYPAL.COM
PAYPAL-VERIFIC.COM
PAYPALMONITOR.COM
SECURITY-MEASURES-PAYPAL.COM
PAYPAL-SECURE-UPDATES.COM
PAYPALPURCHASE.COM
RELOGIN-PAYPAL.COM
WWWPAYPALL.COM
PAYPAL-VERIFICATION-SYSTEM.COM
PAYPALCODE.COM
PAYPAL-SECURED-UPDATE.COM
PAYPAL-SERVICE.COM
PAYPAL-SECURE-INFO.COM
PAYPAL-VERIFICATION-MEMBERS.COM
CUSTOMER-PAYPAL.COM
USERS-PAYPAL.COM
CGI5-PAYPAL-VERIFYUSER.COM
PAYPAL-DBS.COM
ACCOUNTS-PAYPAL.COM
VERIFY-PAYPAL-ACCOUNT.COM
BILLINGUPDATEPAYPAL.COM
SSLSERVER-PAYPAL.COM
PAYPAL-HOME.COM
INFOUPDATE-PAYPAL.COM
PAYPAL-COM.COM
PAYPALSECURITY.COM
UPDATED-PAYPAL.COM
CLIENTS-PAYPAL.COM
REACTIVATE-PAYPAL.COM
SECURIZED-CGI-PAYPAL.COM
PAYPALSUPPORT.COM
EBAYPAYPAL.COM
PAYPALUPD.COM
PAYPAL-UPDATE-VERIFY.COM
WWW-PAYPAL.COM
EXPIRE-PAYPAL.COM
RE-PAYPAL.COM
WWW-PAYPAL-COM-LOGIN-CGI-WEBSCR-CMD-LOGIN-RUN.COM
PAYPAL-CGI.COM
SECURE-PAYPAL-LOGIN.COM
UPDATE-YOUR-PAYPAL-ACCOUNT.COM
PAYPAL-INFORMATION-UPDATE.COM
SUSPENDED-PAYPAL.COM
PAYPAL-UPDATE-INFO.COM
UPDATE-PAYPAL-INFORMATION.COM
PAYPAL-UPDATE-INFORMATION.COM
UPDATE-YOUR-PAYPAL-ACCOUNT.COM
UPDATE-YOUR-PAYPAL.COM
PAYPAL-ACCOUNT-UPDATE.COM
PAYPAL-CONTROL.COM
PAYPAL-UPDATE-YOUR-INFO.COM
PAYPALINSURANCE.COM
USERS-UPDATES-PAYPAL.COM
SERCURE-PAYPAL.COM
PAYPAL-INFOUP.COM
SAFE-PAYPAL.COM
PAYPALREPORT.COM
VERIFYBILLING-PAYPAL.COM
PAYPALACCOUNTSERVICE.COM
PAYPAL-CREDITCARD.COM
VERIFYBILLING-PAYPAL.COM
PAYPALACCOUNTSERVICE.COM
SUPPORTS-PAYPAL.COM
PAYPALBILLING.COM
PAYPALACCOUNTSERVICES.COM
PAYPALCUSTOMERCARE.COM
US-PAYPAL.COM
PAYPAL-UPGRADE.COM
PAYPAL-SSL.COM
PAYPAL-EUROPE.COM
ALERTS-PAYPAL.COM
PAYPAL-ONLINEINFO.COM
CGI-PAYPAL-UPDATE.COM
SSL-PAYPAL.COM
PAYPAL-CONFIRMINFO.COM
PAYPALNEWUPDATE.COM
PAYPAL-CGI-UPDATE.COM
PAYPAL-CGI-BIN.COM
RESTORE-PAYPAL-ACCOUNTS.COM
CUSTOMER-UPDATE-PAYPAL.COM
PAYPAL1.COM
PAYPAL-CUSTOMER-CENTER.COM
PAYPAL-ACCOUNT-UPDATES.COM
PAYPAL-SM.COM
SERVICE-ACCOUNT-PAYPAL.COM
PAYPAL-ONLINECONFIRM.COM
PAYPAL-INFOCONFIRM.COM
PAYPAL-VALIDATEINFO.COM
PAYPAL-INFO-UPDATE.COM
INFO-PAYPAL-UPDATE.COM
CGI-UPDATE-PAYPAL-ACCOUNT.COM
PAYPAL-SECUREINFOS.COM
PAYPAL-CGI-BIN-SECURE.COM
SECURE-PAYPAL-CGI-URL.COM
PAYPALAUSTRALIA.COM
PAYPAL-INTL-SERVICE.COM
ACCOUNTUPDATE-PAYPAL.COM
PAYPALNEWUPDATES.COM
EMAIL-PAYPAL.COM
PAYPAL-ORGANIZATION.COM
PAYPAL-CUSTOMER-CENTRE.COM
EBAY-AUCTION-PAYPAL.COM
EMAILPENDING-PAYPAL.COM
PAYPALSERVIICE.COM
SSLCONNECTION-PAYPAL.COM
E-PAYPAL.COM
PAYPAL-ACOUNT-CENTER.COM
PAYPAL-UPDATE-CENTER.COM
PAYPALCUSTOMERSERVICES.COM
PAYPALSECUREDPAYMENT.COM
CGI-INFO-PAYPAL.COM
PAYPAL-CLIENT-SUPPORT.COM
CONFIRM-PAYPAL-ACCOUNTS.COM
PAYPAL-INFOVALIDATE.COM
RESTORE-PAYPAL-INFO.COM
CS-PAYPAL.COM
IMG-PAYPAL.COM
PAYPAL-COM-CGI-BIN-CONFIRMATION-PP545454.COM
SIGNIN-ACCOUNT-PAYPAL.COM
PAYPAL-MEMBERS-VALIDATION.COM
PAYPAL-SECURE-UPDATE.COM
PAYPAL-ACCOUNT-SERVICE.COM
UNLOCK-PAYPAL.COM
EMAILS-PAYPAL.COM
PAYPAL-SUBMIT.COM
PAYPAL-SECURITY-SYSTEM.COM
UPDATE-PAYPAL-SYSTEM.COM
CONFIRM-PAYPAL.COM
PAYPAL-SETUP.COM
PAYPAL-SECURITY-UPDATES.COM
ONLINE-PAYPAL-UPDATE.COM
US-PAYPAL-SUPPORT.COM
PAYPAL-SUPPORT-SSL.COM
PAYPAL-PAYMENTS.COM
PAYPAL-SERVERS.COM
PAYPAL3.COM
PAYPAL-LOGIN.COM
VERIFY-PAYPAL-US.COM
VERY-PAYPAL.COM
RESUBMIT-PAYPAL.COM
UPDATEUSER-PAYPAL.COM

R's,
John
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html