spf-discuss
[Top] [All Lists]

RE: A hole in planned phishing-prevention?

2004-06-14 10:59:13
From: Alan Hodgson
Sent: Monday, June 14, 2004 12:48 PM


On Mon, Jun 14, 2004 at 12:11:17PM -0500, Seth Goodman wrote:
One problem is that mailing lists would have to change their practice
slightly.  They often use a slightly different bounce address
than they put
in Sender:.  As they are mass mailers, it would not be
difficult for them to
use the same address in both places, i.e.
owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com,
albeit with the appropriate signature in MAIL FROM:, and redirect any
bounces to wherever they choose.

Mailing lists use VERP to accurately identify the address that caused the
bounce.  This allows them to not have to parse bounce messages to try to
determine which address bounced.

If they use eg. owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com in MAIL 
FROM:
they would lose
this ability.  I don't think you'll find many mailing list operators would
choose to give up VERP's.  I might have missed it, but I don't
see how your
proposal addresses this?

Sorry if I was not clear on this.  I proposed using the same "plain" address
in MAIL FROM: and Sender:, but the MAIL FROM: could be signed by VERP, SES,
SRS, ...  The comparison between the two addresses at the recipient MTA
would be after "unwrapping" the MAIL FROM: address from whatever signature
scheme they used.

--

Seth Goodman