Douglas Otis wrote:
The threats draft missed that the sending agent must be held accountable
and that the DKIM signature can not play this role. As a result of this
oversight caused by understatements of replay concerns among others such
as use of annotations, the threat draft offers poor guidance for the
policy effort. The policy requirements draft appears to be a
continuation of this short-sighted view. : (
Moaning about the fact that the WG's rough consensus wasn't what the
author wished is irrelevant and distracting. Please stop.
The threats draft does represent the WG's rough consensus at that
point in time and with the level of knowledge of the SSP protocol
existing then. While new facts may emerge, and additional levels of
protocol detail may also throw up new threats, we are not going to
re-do the entire threat analysis exercise.
Please focus your contribution towards resolvable issues with
ssp-reqs.
Thanks,
Stephen.
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html