ietf-mailsig
[Top] [All Lists]

Re: MASS Security Review document

2005-02-15 09:41:28

On Tue, 2005-02-15 at 01:58, Tony Finch wrote:
sender -> isp -> exploder -> millions of people

The ISP no longer has any control over who receives a message after it has
been relayed to its recipients, unless there is some kind of call-back.

Ah, the mailing list scenario.  This still strikes me as a solution in
search of a problem, since this exact scenario has been possible for 20
years and I can't ever remember it being an abuse problem.

We're anticipating that signatures will make new forms of attack more
attractive.

As I said in another message, revocation would be an ideal tool for
spammers to use to pretend that they weren't responsible for their spam.

Revocation allows another attack suggested by Roger Moser, in which one
recipient of a message which was sent to many people spams the
verification server in order to make it believe that abuse is occuring,
so that it revokes the message and prevents others from receiving it.

This will more often happen when someone's system has been compromised. 
Viewing the message would be the first step before revocation.  Your
account canceled may include your stamps robbed as well however.

http://research.microsoft.com/research/sv/PennyBlack/
The Penny Black project... Recipients would aggressively safe-list good
senders.  (The instant messaging buddy list?)

The ticket scheme involves creating a ticket service that would issue
tickets, which can then be submitted with an email message.  The
recipient would then call the ticket service to validate and cancel the
ticket.  There are some interesting ramifications to the ticket server
idea.  For example, 1000 pre-paid tickets might be bundled with each new
PC.  A detailed description of the Ticket Server design is available in
[ABBDW-03].

http://www.nytimes.com/2005/02/13/business/yourmoney/13digi.html

-Doug





    


<Prev in Thread] Current Thread [Next in Thread>