Steve Atkins wrote:
The most obvious thing that MLMs do that invalidate signatures are 1. append
content to the body and 2. prepend content to the subject line.
+1
Any approach that allows me to replay messages while making those changes
seems to open the door to abuse.
However, we need to see if we can address survivability first before
we can try to mitigate this. I'm concern not just about what I see
but what is everyone else going to see. We know what is going on. The
rest are not expected to realize the details.
Of the list I am personally involved with and beginning to sign mail,
I see 100% body hash fail, but when the extra <CRLF> top line is
considered, there is a significant improvement.
+----------------------------------------------------------------+
| LIST-ID SIGNER FAILS CRLF-FIX |
|----------------------------------------------------------------|
| ietf-822.imc.org cybernothing.org 100% 100% |
| ietf-822.imc.org messagingengine.com 100% 61% |
| ietf-822.imc.org tana.it 100% 0% |
| ietf-822.imc.org mrochek.com 100% 0% |
| ietf-822.imc.org ISDG.NET 100% 0% |
|----------------------------------------------------------------|
| ietf-smtp.imc.org resistor.net 100% 100% |
| ietf-smtp.imc.org messagingengine.com 100% 71% |
| ietf-smtp.imc.org gmail.com 100% 58% |
| ietf-smtp.imc.org SANTRONICS.COM 100% 11% |
| ietf-smtp.imc.org tana.it 100% 0% |
| ietf-smtp.imc.org sonnection.nl 100% 0% |
| ietf-smtp.imc.org taugh.com 100% 0% |
| ietf-smtp.imc.org mrochek.com 100% 0% |
|----------------------------------------------------------------|
| ietf.ietf.org resistor.net 100% 100% |
| ietf.ietf.org cybernothing.org 100% 100% |
| ietf.ietf.org cisco.com 100% 100% |
| ietf.ietf.org mrochek.com 100% 100% |
| ietf.ietf.org qualcomm.com 100% 100% |
| ietf.ietf.org iecc.com 100% 100% |
| ietf.ietf.org gmail.com 100% 100% |
| ietf.ietf.org ISDG.NET 100% 0% |
+----------------------------------------------------------------+
The domains in caps are mine. I'm signing with l= and not signing the
subject line, except for santronics.com in IETF-SMTP and the 89%
survival are with replies after the subject line has been altered.
But you see other domains survive because the first two list do not
add footers. The last one does and only "l=" people will survive that
(after the CRLF adjustment).
For example, Ned with mrochek.com, all fails but fixed with the <CRLF>
adjustment in the first two list. But since he doesn't sign with "l=",
he still fails the ietf.ietf.org (IETF Discuss) list which does add a
footer.
Overall, I agree with you that the most common MLM changes are the
subject [list-name] tag prefix and the added footer. We need to deal
with that, for sure, as a highlighted signer recommendation targeting
list mail. But as the table above shows, without the <CRLF> fix it
doesn't matter.
--
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html