Steve Atkins wrote:
On May 20, 2009, at 3:57 PM, Michael Thomas wrote:
Steve Atkins wrote:
Remember that we're considering the content of the message as
displayed to the end user here,
No we're not. That has never been in the scope of the DKIM effort.
Even if it weren't section 8.1 of the existing RFC, it's pretty
obvious that a security issue that allows an attacker to create a
validly signed email with their own content without access to the
associated private key would be in scope for discussion.
They cannot alter the signed text. That's all DKIM guarantees. It's
not in DKIM's scope to tell mail receivers what to do with the
message, signed text or otherwise. Stupid receivers are free as always
to do stupid things. Smart receivers are free as always to do smart
things. As is ever was.
Mike
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html