From macfisherman@gmail.com Tue Dec 4 10:51:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE7E121F874B for ; Tue, 4 Dec 2012 10:51:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.598 X-Spam-Level: X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wle9gR4dBY4S for ; Tue, 4 Dec 2012 10:51:28 -0800 (PST) Received: from mail-we0-f182.google.com (mail-we0-f182.google.com [74.125.82.182]) by ietfa.amsl.com (Postfix) with ESMTP id 3BE1321F84F2 for ; Tue, 4 Dec 2012 10:51:27 -0800 (PST) Received: by mail-we0-f182.google.com with SMTP id u54so2130295wey.13 for ; Tue, 04 Dec 2012 10:51:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=bJNNCN7fZdgsx2oNqhjtIhQpla5IUuHf8VKj73qRmYU=; b=FaZ7lUIga6vK2NCHVH0oja16C/nNCG4aOPxL+82xV6uUEBhFSHdhGD1vs5JIeFSVxa 1YUI+4SWmr3Cir1fFuNqexOcul65OCRFh9myVnG3EcC5kefy2yj0n4vmSIvyt91fSZCI EHPy10qdYNDDB/BnD083S91YV7lRQ13bR29a5/dw0FGY2JCtecL+hKJP47wA+Gx8zTVr OPQkEemDAft42nZ2pwz/BuYUvPGy8QzWw2sM+qZpi8Hxq1jg0hWFNBVMtkW3MRr113nr /IeYcZGCjCL0OaE49IISzCMTGvqnvDHP5rqwVWPAWqaG7uMon7hbyFGmOuMizNo95Z9f gzNg== MIME-Version: 1.0 Received: by 10.216.203.205 with SMTP id f55mr4627555weo.170.1354647086954; Tue, 04 Dec 2012 10:51:26 -0800 (PST) Received: by 10.180.84.72 with HTTP; Tue, 4 Dec 2012 10:51:26 -0800 (PST) In-Reply-To: <20121020214048.3105.qmail@joyce.lan> References: <5C0A004C-1BAD-4103-85C2-B94B718F0367@blighty.com> <20121020214048.3105.qmail@joyce.lan> Date: Tue, 4 Dec 2012 13:51:26 -0500 Message-ID: From: Jeff Macdonald To: Anti-Spam Research Group - IRTF Content-Type: multipart/alternative; boundary=0016e6d7ee5069f99204d00b5aca Subject: Re: [Asrg] DNSBL and IPv6 X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2012 18:51:29 -0000 --0016e6d7ee5069f99204d00b5aca Content-Type: text/plain; charset=ISO-8859-1 Hi John, I'd like to help. Let me know what I can do. On Sat, Oct 20, 2012 at 5:40 PM, John Levine wrote: > >The only relevant difference between v4 and v6 DNS based blacklisting is > >that the ability to easily hop around *within* your /64 makes it > >possible (easy) to blow the cache of a traditional caching DNS resolver > >if you do naive "look up a record based on the IPv6 address". > > That's always been our assumption, but there is at this point precious > little evidence that MTAs that query DNSBL through caches (as opposed > to those who have a local rsync mirror) have a cache hit rate much > greater than zero. If in fact they don't, the same design, perhaps > with a little TTL tuning to give clients a hint about which ones are > worth caching, could work no worse than they do now for similar mail > volumes. > > That's why I want to do the cache simulations, to figure out what's > going on now. It shouldn't be terribly hard, and we have people > offering data. Want to help? > > R's, > John > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg > -- Jeff Macdonald Ayer, MA --0016e6d7ee5069f99204d00b5aca Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi John,

I'd like to help. Let me know what I can do= .


On Sat= , Oct 20, 2012 at 5:40 PM, John Levine <johnl@taugh.com> wrote= :
>The only relevant diff= erence between v4 and v6 DNS based blacklisting is
>that the ability to easily hop around *within* your /64 makes it
>possible (easy) to blow the cache of a traditional caching DNS resolver=
>if you do naive "look up a record based on the IPv6 address".=

That's always been our assumption, but there is at this point pre= cious
little evidence that MTAs that query DNSBL through caches (as opposed
to those who have a local rsync mirror) have a cache hit rate much
greater than zero. =A0If in fact they don't, the same design, perhaps with a little TTL tuning to give clients a hint about which ones are
worth caching, could work no worse than they do now for similar mail
volumes.

That's why I want to do the cache simulations, to figure out what's=
going on now. =A0It shouldn't be terribly hard, and we have people
offering data. =A0Want to help?

R's,
John
___________________________________= ____________
Asrg mailing list
Asrg@irtf.org
htt= p://www.irtf.org/mailman/listinfo/asrg



--
= Jeff Macdonald
Ayer, MA


--0016e6d7ee5069f99204d00b5aca-- From johnl@iecc.com Tue Dec 4 13:08:37 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB81121F8892 for ; Tue, 4 Dec 2012 13:08:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.42 X-Spam-Level: X-Spam-Status: No, score=-105.42 tagged_above=-999 required=5 tests=[AWL=-0.010, BAYES_05=-1.11, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yOPoeUki+TCt for ; Tue, 4 Dec 2012 13:08:36 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id E836921F851C for ; Tue, 4 Dec 2012 13:08:35 -0800 (PST) Received: (qmail 62966 invoked from network); 4 Dec 2012 21:08:32 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 4 Dec 2012 21:08:32 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50be6650.xn--yuvv84g.k1211; i=johnl@user.iecc.com; bh=fy/6XW3/RNmtwsVyJnbxc4TRsD4QeoG08mO3d3+T5rg=; b=mpke+y9ln2MeXyE4NKw/Gy5iYp4MkMthIACL4pP7Y7zYjVOCDqJgxk7NkHhxYDAKgzktQ0EJDqUT8AfMflHuG08uHFD0W2FdA07Hp9Ir1y5ZF3CRjGfvfD8A+vDb/E4wF0M+DTXBFRUWdbL8IgmG2lMrL3zkFmyzv/7xWeU546U= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50be6650.xn--yuvv84g.k1211; olt=johnl@user.iecc.com; bh=fy/6XW3/RNmtwsVyJnbxc4TRsD4QeoG08mO3d3+T5rg=; b=fQOuI6ileNmncnMZ4sjBW/aGsifDWW04AGG8N/G+hIs0kTb64O0WQ38M+jA0aD+0wF8DaXgL9OtbUyVnPmxe5R0dTzZ2KbgoUPwKmpJ1lBZPfyJQ1ccbqeK+XBrjWAJoDIrR1ISpmhGGdcdncaMjG3ENgY46auGAkv43cT7Hdhk= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 4 Dec 2012 21:08:10 -0000 Message-ID: <20121204210810.2867.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] DNSBL and IPv6 X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2012 21:08:37 -0000 In article you write: >-=-=-=-=-=- >-=-=-=-=-=- > >Hi John, > >I'd like to help. Let me know what I can do. I think I've hooked up with some academics interested in doing analyses, so what I need now is data. Traces from largish mail servers would be good. All I need is [timestamp,IP address] to do DNSBL traces. From christian.grunfeld@gmail.com Thu Dec 6 11:05:09 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2EC021F86AD for ; Thu, 6 Dec 2012 11:05:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.999 X-Spam-Level: X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_38=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ihvS4B1UjlVc for ; Thu, 6 Dec 2012 11:05:08 -0800 (PST) Received: from mail-vb0-f53.google.com (mail-vb0-f53.google.com [209.85.212.53]) by ietfa.amsl.com (Postfix) with ESMTP id 573E521F8432 for ; Thu, 6 Dec 2012 11:05:08 -0800 (PST) Received: by mail-vb0-f53.google.com with SMTP id b23so6726135vbz.40 for ; Thu, 06 Dec 2012 11:05:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=uZxr4nLQG+RHpBwbhHn7wCTZZU835xGHcoFRnJiDuMs=; b=Sl1h2nzibip21HKFBzuijx4+y4Rvte+tOS8xFQ+SLV8b1A2i+4ebNwyXnqzfKJKmYF H4Uhprs/bHbagHXgHHwRtooMV8Buf9CpM1x7Uj3flHflxVrO+eDcghm8L8agEVgal5br c+eZr/145b1vPMtwLx5mNLCgWmxNbxt87crAk25GoqrG7kU1ULZgPFa5nyoK88rEgBCO tQScDye4o6D89Uffw9lAFuiSAdcOy6y0R9a/ivL6cwNM3NRLZyzbS5z8l/TZyLYk2KQf z4yBWJlwtJnL4tggGN54g2OqLj2BNuuDDtghE7FgaHDETtue12W40U5Kq4sF6YT6PZSc 0Vag== MIME-Version: 1.0 Received: by 10.58.168.135 with SMTP id zw7mr2087076veb.4.1354820707625; Thu, 06 Dec 2012 11:05:07 -0800 (PST) Received: by 10.58.235.131 with HTTP; Thu, 6 Dec 2012 11:05:07 -0800 (PST) Date: Thu, 6 Dec 2012 16:05:07 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 X-Mailman-Approved-At: Thu, 06 Dec 2012 11:55:11 -0800 Subject: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 19:05:09 -0000 Hi, Something I found about SPF. I don't know if it is new to you but it is worth of explanation ! As in all the tutorials of SPF, one stays relaxed when lists hosts/ips that are authorized to send for the domain and then finally closes with -all. This is true only for that domain but if there are hosts or subdomains with A records, they must enforce SPF policies ! (this is not explicit in RFC or at least confusing). A single host or subdomain that don't do it can lead to a sender spoofing attack and pose as someone from our domain without the SPF to detect it. This is because when we receive mail from foo@bar.mydomain the SPF protocol seeks TXT records corresponding to bar.mydomain instead of TXT record for mydomain. If there is an A record for bar.mydomain but no TXT "v=spf1 -all" for it, SPF returns "none" although SPF exists for mydomain ! Thus an attacker can inject an email from everywhere claiming that is from someone@bar.mydomain ! As the default policy of SPF should not be "fail if not present" the solution is to enforce with the records TXT "v = spf1-all" for each A record that should not send emails! This also can be made by means of wildcards but it is discourage in the RFC. Cheers From christian.grunfeld@gmail.com Thu Dec 6 12:15:03 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9886F21F8A76 for ; Thu, 6 Dec 2012 12:15:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.999 X-Spam-Level: X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_38=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1WR9lLrRgkmQ for ; Thu, 6 Dec 2012 12:15:02 -0800 (PST) Received: from mail-vc0-f182.google.com (mail-vc0-f182.google.com [209.85.220.182]) by ietfa.amsl.com (Postfix) with ESMTP id B47F021F8A74 for ; Thu, 6 Dec 2012 12:15:02 -0800 (PST) Received: by mail-vc0-f182.google.com with SMTP id fo14so8181273vcb.13 for ; Thu, 06 Dec 2012 12:15:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=sq8w7YCiApxhTG0CduWvvpmrJCPQe279J5zanLp8O3c=; b=W6eUppd4tK6JIF1lm20914T1Ig00eGpiwfljIETA0XQGVhGIDyA84AdtQF2RDsY617 19gVEVjAfslJkYNYdUFmKZatGdJz1WMX26TlIF9jdtFY9EbA14aL4jlt5FfgEIM8ndD/ VMDz/InXqn1twlT1YQsbizoDHE8CTuQefRp0zhCPAvxXQp+WEzeWJXE0qUeo2b0o/5OD wNv7CsyiS0Ayxf1s4Rz4iOWNrndZ+d6j+OtZU0Xqxd4wQ9a14uq+3yoKFT/JjJC3d+/t vOhl9V8DajKp+vjagDT34OgOos4gJkbzrHAodQ6DGMvLiOcfiP6Hx+M2/g1Rur2HpOsb gJYQ== MIME-Version: 1.0 Received: by 10.52.66.18 with SMTP id b18mr1919704vdt.43.1354824901852; Thu, 06 Dec 2012 12:15:01 -0800 (PST) Received: by 10.58.235.131 with HTTP; Thu, 6 Dec 2012 12:15:01 -0800 (PST) In-Reply-To: References: Date: Thu, 6 Dec 2012 17:15:01 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 20:15:03 -0000 here is the proof of concept ! an email sent to John Levine claiming to be from ygii-john@www.johnlevine.com !!! Could you please John paste the Received-SPF checks of your mailserver ? Connected to mail1.iecc.com. Escape character is '^]'. 220 mail1.iecc.com mailfront ESMTP EHLO www.johnlevine.com 250-mail1.iecc.com 250-SIZE 0 250-8BITMIME 250-ENHANCEDSTATUSCODES 250 PIPELINING MAIL FROM: ygii-john@www.johnlevine.com 250 2.1.0 Sender accepted. RCPT TO: johnl@taugh.com 250 2.1.5 Recipient accepted. DATA 354 End your message with a period on a line by itself. From: ygii-john@www.johnlevine.com To: johnl@taugh.com Subject: p o c Hi John, just a proof of concept . 250 2.6.0 Accepted message qp 34000 bytes 540 quit 221 2.0.0 Good bye. Connection closed by foreign host. 2012/12/6 Christian Grunfeld : > Hi, > > Something I found about SPF. I don't know if it is new to you but it > is worth of explanation ! > > As in all the tutorials of SPF, one stays relaxed when lists hosts/ips > that are authorized to send for the domain and then finally closes > with -all. This is true only for that domain but if there are hosts or > subdomains with A records, they must enforce SPF policies ! (this is > not explicit in RFC or at least confusing). > > A single host or subdomain that don't do it can lead to a sender spoofing attack > and pose as someone from our domain without the SPF to detect it. > > This is because when we receive mail from foo@bar.mydomain the SPF > protocol seeks TXT records corresponding to bar.mydomain instead of > TXT record for mydomain. If there is an A record for bar.mydomain but > no TXT "v=spf1 -all" for it, SPF returns "none" although SPF exists > for mydomain ! > > Thus an attacker can inject an email from everywhere claiming that is > from someone@bar.mydomain ! > > As the default policy of SPF should not be "fail if not present" the > solution is to enforce with the records TXT "v = spf1-all" for each A > record that should not send emails! > This also can be made by means of wildcards but it is discourage in the RFC. > > Cheers From derek.diget+asrg@wmich.edu Thu Dec 6 12:34:58 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF4F321F896C for ; Thu, 6 Dec 2012 12:34:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lxS-USVoAoZc for ; Thu, 6 Dec 2012 12:34:58 -0800 (PST) Received: from mx-tmp.wmich.edu (mx-tmp.wmich.edu [141.218.1.43]) by ietfa.amsl.com (Postfix) with ESMTP id 34C2F21F893E for ; Thu, 6 Dec 2012 12:34:58 -0800 (PST) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: TEXT/PLAIN; charset=US-ASCII Received: from spaz.oit.wmich.edu (spaz.oit.wmich.edu [141.218.24.51]) by mta01.service.private (Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 64bit)) with ESMTPSA id <0MEM008JSMI4AJ00@mta01.service.private> for asrg@irtf.org; Thu, 06 Dec 2012 15:34:53 -0500 (EST) X-WMU-Spam: Gauge=X, Probability=10% on Thu Dec 6 15:34:53 2012, Report=' WMU_MSA_SMTP+ 0, TO_IN_SUBJECT 0.5, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1500_1599 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, FROM_EDU_TLD 0, SPF_NEUTRAL 0, __ANY_URI 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CP_URI_IN_BODY 0, __CT 0, __CT_TEXT_PLAIN 0, __HAS_FROM 0, __HAS_MSGID 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __PHISH_SPEAR_STRUCTURE_1 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __URI_NO_MAILTO 0, __URI_NS ' X-WMU-PMX-Version: 5.5.9.395186, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.12.6.202141 - Thu Dec 6 15:34:53 2012 Date: Thu, 06 Dec 2012 15:34:52 -0500 (EST) From: Derek Diget X-X-Sender: diget@spaz.oit.wmich.edu To: Anti-Spam Research Group - IRTF In-reply-to: Message-id: References: Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 20:34:58 -0000 On Dec 6, 2012 at 16:05 -0300, Christian Grunfeld wrote: =>Something I found about SPF. I don't know if it is new to you but it =>is worth of explanation ! => =>As in all the tutorials of SPF, one stays relaxed when lists hosts/ips =>that are authorized to send for the domain and then finally closes =>with -all. This is true only for that domain but if there are hosts or =>subdomains with A records, they must enforce SPF policies ! (this is =>not explicit in RFC or at least confusing). See and Note I have not followed the above at $WORKPLACE or my personal domains, because I would also want to follow RFC 6652 - Sender Policy Framework (SPF) Authentication Failure Reporting Using the Abuse Reporting Format. The problem is I don't want to publish MX records on all of the domains and then configure the MX server to handle the thousands of new "domains" to support the ra modifier since it (ra) can't specify the domain part. (I understand why it was done this way, but don't see how it scales with the this issue (SPF for non-mail sending domains). -- *********************************************************************** Derek Diget Office of Information Technology Western Michigan University - Kalamazoo Michigan USA - www.wmich.edu/ *********************************************************************** From martijn.grooten@virusbtn.com Thu Dec 6 12:47:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9096B21F8697 for ; Thu, 6 Dec 2012 12:47:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OHHyljRKoZZ6 for ; Thu, 6 Dec 2012 12:47:52 -0800 (PST) Received: from mx4.sophos.com (mx4.sophos.com [216.47.234.213]) by ietfa.amsl.com (Postfix) with ESMTP id E9FDC21F8507 for ; Thu, 6 Dec 2012 12:47:50 -0800 (PST) Received: from mx4.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id CC7F34E037E for ; Thu, 6 Dec 2012 20:47:47 +0000 (GMT) Received: from abn-exch1b.green.sophos (abn-exch1b.green.sophos [10.100.70.62]) by mx4.sophos.com (Postfix) with ESMTPS id 724544E02E7 for ; Thu, 6 Dec 2012 20:47:47 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Thu, 6 Dec 2012 20:47:46 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMN5L3 Date: Thu, 6 Dec 2012 20:47:45 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AC6B8F@ABN-EXCH1A.green.sophos> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 20:47:52 -0000 So, to use a real-world example, what you're saying is that if you want to = spoof Twitter, to avoid your email being caught by the -all in Twitter's SP= F record, you could use foo.twitter.com as the sending domain and your emai= l wouldn't be blocked because of an SPF fail. I think that's correct. You could also use aimport dot no (as some spammer sending a fake Twitter e= mail did an hour ago). That domain doesn't have an SPF record either. As we're talking about the MAIL FROM in the SMTP envelope, which usually is= n't shown to the user, I don't think this is a big problem. Perhaps your MTA or spam-filter does use the MAIL FROM in its decision whet= her to deliver the email or not. If it decides to deliver the message becau= se it claims to come from Twitter, uses a subdomain of twitter.com and didn= 't fail SPF than that's very wrong. But I don't think it's SPF's fault. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From johnl@iecc.com Thu Dec 6 13:21:44 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 915E921F85E7 for ; Thu, 6 Dec 2012 13:21:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.164 X-Spam-Level: X-Spam-Status: No, score=-106.164 tagged_above=-999 required=5 tests=[AWL=0.735, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dKGNZ0gWsGB8 for ; Thu, 6 Dec 2012 13:21:43 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id B576B21F85D6 for ; Thu, 6 Dec 2012 13:21:42 -0800 (PST) Received: (qmail 50250 invoked from network); 6 Dec 2012 21:21:38 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 6 Dec 2012 21:21:38 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c10c62.xn--3zv.k1211; i=johnl@user.iecc.com; bh=uFDP8DovUM27jMZBWDKnbnvu3TNKUugX8G7y8GrCmLg=; b=WvgNvq4GCKc4mKlyVsk6trN+BAGwpK0AplmeD4kz0O0NwirNxbea5/rIlK7XaM7ofsNYoUEnsWKHGv8ea3zLrceU6pCXsPStRDSWyqavPnwQvQ4W2GhqnewzXZfC8YxcRXpSmHjGH8epLkh0R9j9WOhUAcnJZrxjmv6ZVF4o3fE= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c10c62.xn--3zv.k1211; olt=johnl@user.iecc.com; bh=uFDP8DovUM27jMZBWDKnbnvu3TNKUugX8G7y8GrCmLg=; b=ZEJqkzxjZ3AD6MZ1AFf1f3sArdGxP/qerA0wRSXMf82Bb09aHdKJEi4SwHanteTV8hF60yUiJo1vK3B7EjbF10lx5sCMp+ZHKIYt9y0CfftE/Ydlxipm+40LUL5YBgH92oQKSMD449tN37KOcyURRnLD/PdCHAW+7vKHpfE6qTo= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 6 Dec 2012 21:21:16 -0000 Message-ID: <20121206212116.10328.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 21:21:44 -0000 In article you write: >here is the proof of concept ! an email sent to John Levine claiming >to be from ygii-john@www.johnlevine.com !!! Life is too short to publish SPF -all records for every host name that doesn't send mail. R's, John From christian.grunfeld@gmail.com Thu Dec 6 18:09:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80B9421F86E2 for ; Thu, 6 Dec 2012 18:09:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.299 X-Spam-Level: X-Spam-Status: No, score=-3.299 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FupqlL73CtUp for ; Thu, 6 Dec 2012 18:09:45 -0800 (PST) Received: from mail-ie0-f178.google.com (mail-ie0-f178.google.com [209.85.223.178]) by ietfa.amsl.com (Postfix) with ESMTP id C265021F86CC for ; Thu, 6 Dec 2012 18:09:45 -0800 (PST) Received: by mail-ie0-f178.google.com with SMTP id c12so14106ieb.9 for ; Thu, 06 Dec 2012 18:09:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=m4SIihfa0mvoyuOyyMKL2XOwWeqx97mExA2AKW0Atyg=; b=vI3qwUR2UvEAGpe9vgZe5eReseZbUhE9GxpYS1X0mWe/Iu3M+QJvCxDvRLA1MbQady XQbRvgMFvhmdJh6BlGfpdYjeMc50yO21qtQ7ZAY8rMARavqFXmcsGoKpLsP88yDWHB6R 7HnvKkMaIFEZksKv62wVktkuN5OaWi4i/XpdB/IRQpKt+XPjBuQuw4E32qq0X+f1grX7 cIUU+KRDD/LKCW+4/5/iOkeg015HLvAt0CcwDrPhfatA8+XliwjldUBVdXQQzc+1bV1b jvuXbaXf9dHkSnerp+aYjqcT/mO2EbYinJ3tJ0zjNLa6/umJlPAGIdJwB2mRV4k9IW6V 5InQ== MIME-Version: 1.0 Received: by 10.50.40.225 with SMTP id a1mr7917741igl.7.1354846185260; Thu, 06 Dec 2012 18:09:45 -0800 (PST) Received: by 10.231.65.79 with HTTP; Thu, 6 Dec 2012 18:09:44 -0800 (PST) In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AC6B8F@ABN-EXCH1A.green.sophos> References: <0D79787962F6AE4B84B2CC41FC957D0B20AC6B8F@ABN-EXCH1A.green.sophos> Date: Thu, 6 Dec 2012 23:09:44 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 02:09:46 -0000 2012/12/6 Martijn Grooten : > You could also use aimport dot no (as some spammer sending a fake Twitter= email did an hour ago). That domain doesn't have an SPF record either. simple users are more confident if the sender seems real ! > As we're talking about the MAIL FROM in the SMTP envelope, which usually = isn't shown to the user, I don't think this is a big problem. faking From: header is as simple as faking MAIL FROM envelope ! > Perhaps your MTA or spam-filter does use the MAIL FROM in its decision wh= ether to deliver the email or not. If it decides to deliver the message bec= ause it claims to come from Twitter, uses a subdomain of twitter.com and di= dn't fail SPF than that's very wrong. But I don't think it's SPF's fault. I didn't say is SPF's fault. It's our fault From prvs=0688AFDA83=paul@pscs.co.uk Fri Dec 7 00:40:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7864121F876B for ; Fri, 7 Dec 2012 00:40:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kP8+dpObct0T for ; Fri, 7 Dec 2012 00:40:46 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id C544B21F87AC for ; Fri, 7 Dec 2012 00:40:44 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP; Fri, 7 Dec 2012 08:51:24 -0000 Received: from [192.168.66.100] ([192.168.66.100]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP; Fri, 7 Dec 2012 08:31:23 -0000 Message-ID: <50C1A95A.5000001@pscs.co.uk> Date: Fri, 07 Dec 2012 08:31:22 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> In-Reply-To: <20121206212116.10328.qmail@joyce.lan> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Cc: John Levine Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 08:40:47 -0000 On 06/12/2012 21:21, John Levine wrote: > In article you write: >> here is the proof of concept ! an email sent to John Levine claiming >> to be from ygii-john@www.johnlevine.com !!! > Life is too short to publish SPF -all records for every host name that > doesn't send mail. > While I agree totally, I understand the OP's point about semi-tech-savvy people being more trusting of Twitter mail coming from 'bibble.twitter.com' than if it came from 'random.ru' This problem is really due to the (IMHO horrible) allowance for an A record to be sufficient for mail delivery. However, it would be quite hard to remove that allowance nowadays. I don't know the stats for how many email addresses use A records for delivery rather than MX, but I'd guess its a significant number. As a random thought, would there be the possibility to add some sort of marker on a parent domain to say 'we understand MX records, so we don't use A records for mail within this domain'? So, if you receive mail from 'bibble.twitter.com', you check the TXT records for 'twitter.com' which tell you that subdomains/hosts without an MX record won't have mail, and since there isn't an MX record for 'bibble.twitter.com', you can reject it/treat it as spoofed. The main problem I see with this is the increased DNS lookups - if you got a message from aa.bb.cc.dd.ee.ff.twitter.com (an excessive case), you'd have to do 6 or 7 extra DNS lookups before doing anything else, because you can't automatically tell where the 'parent' domain is. For small hosts this probably wouldn't be that big a problem. For big ones it may be, but then again, would any benefit this gave in reduced traffic outweigh the extra load, and would the DNS caches on the big hosts alleviate the problem? (There'd also be a risk that a parent domain owned elsewhere (eg .com) would block A record mail for all its legacy subdomains, but you'd hope that wouldn't happen...) Personally, I think I'd rather any effort went into some sort of 'stronger' authentication being developed for prime phishing attack targets like Twitter, Facebook, banks etc. eg a verification scheme which can verify specific messages, or a message collection system (rather than delivery) which can be automated by the recipient software, or something. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From christian.grunfeld@gmail.com Fri Dec 7 08:23:06 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EA2321F86AF for ; Fri, 7 Dec 2012 08:23:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.399 X-Spam-Level: X-Spam-Status: No, score=-3.399 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 31tfj3jP8uua for ; Fri, 7 Dec 2012 08:23:05 -0800 (PST) Received: from mail-ie0-f170.google.com (mail-ie0-f170.google.com [209.85.223.170]) by ietfa.amsl.com (Postfix) with ESMTP id 3268721F8635 for ; Fri, 7 Dec 2012 08:23:05 -0800 (PST) Received: by mail-ie0-f170.google.com with SMTP id k10so1556181iea.15 for ; Fri, 07 Dec 2012 08:23:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=CGkZGcyUwYPceLEkDKsEjMlDCP5KWgDJMxAye+fe/Fs=; b=Pl1owqVTlNNfyJsFTA4IjmiOV6YGT4DGMyOYN+cqvMxLitUUEdYK4xSzISjeR04Dn1 4WvWh/8rgnqJRt8O+EyICZ5ZO9gCzE4oIiE6tXeGCDB1FLsKye6P3cezeQZk4SThxwlN L6FbDj2PzuoCga0HUC6k31Gqi/POfnU68MHyPG732OBgJ0rJFprvBnefymHR1qZPvIXK wTDoLpEKAmjQegkf0PjkfPo96obxMW5hL311CAhzBLcd0pZq4PDrqoFm9FSL+dqiVJO6 zbVzc4orAwXAGbFbvSBiIw8ZIAxADkPrhPNOdAftKo9p0KkO6Hn/70pITetVhOIeh/2I HdCw== MIME-Version: 1.0 Received: by 10.50.187.197 with SMTP id fu5mr5351151igc.70.1354897384595; Fri, 07 Dec 2012 08:23:04 -0800 (PST) Received: by 10.231.65.79 with HTTP; Fri, 7 Dec 2012 08:23:04 -0800 (PST) In-Reply-To: <50C1A95A.5000001@pscs.co.uk> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> Date: Fri, 7 Dec 2012 13:23:04 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 16:23:06 -0000 2012/12/7 Paul Smith : > This problem is really due to the (IMHO horrible) allowance for an A record > to be sufficient for mail delivery. However, it would be quite hard to > remove that allowance nowadays. I don't know the stats for how many email > addresses use A records for delivery rather than MX, but I'd guess its a > significant number. I think you are confused about the MX on the receiver side and the A record of the sender ! Mails are sent to MX for a domain but the sender has not to have a MX record to send ! The problem here is that the sender uses a forged address which has an A record. What you said is that the recipient should not be an A record and should be an MX. They are two different things ! > As a random thought, would there be the possibility to add some sort of > marker on a parent domain to say 'we understand MX records, so we don't use > A records for mail within this domain'? So, if you receive mail from > 'bibble.twitter.com', you check the TXT records for 'twitter.com' which tell > you that subdomains/hosts without an MX record won't have mail, and since > there isn't an MX record for 'bibble.twitter.com', you can reject it/treat > it as spoofed. same as above. MX for bibble.twitter.com is only to receive emails. Nothing prevents someone@bibble.twitter.com to send unless you put a TXT "v=spf1 -all" for it ! From prvs=0688AFDA83=paul@pscs.co.uk Fri Dec 7 09:12:53 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5E2221F8AE3 for ; Fri, 7 Dec 2012 09:12:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5hTf985w9-I7 for ; Fri, 7 Dec 2012 09:12:52 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id 2895C21F8A94 for ; Fri, 7 Dec 2012 09:12:51 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP; Fri, 7 Dec 2012 17:21:30 -0000 Received: from [192.168.66.100] ([192.168.66.100]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP; Fri, 7 Dec 2012 16:53:16 -0000 Message-ID: <50C21EFC.4060508@pscs.co.uk> Date: Fri, 07 Dec 2012 16:53:16 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 17:12:53 -0000 On 07/12/2012 16:23, Christian Grunfeld wrote: > 2012/12/7 Paul Smith : > >> This problem is really due to the (IMHO horrible) allowance for an A record >> to be sufficient for mail delivery. However, it would be quite hard to >> remove that allowance nowadays. I don't know the stats for how many email >> addresses use A records for delivery rather than MX, but I'd guess its a >> significant number. > I think you are confused about the MX on the receiver side and the A > record of the sender ! > Mails are sent to MX for a domain but the sender has not to have a MX > record to send ! Oh, I know that. But a reasonable test is that if a message comes from an email address which you cannot reply to, then the sender email address is probably forged. (This is how call-back verification (CBV) works) So, if you could ONLY send to MX addresses, the OP's issue wouldn't be a significant problem. Currently, I could send a message from 'bill@www.microsoft.com', and even though there are no MX records for 'www.microsoft.com', there is an 'A' record, so a quick check cannot tell that the sender address is invalid. I can look for SPF records, but there is no SPF record for 'www.microsoft.com', so I assume they don't use SPF, and let the message through. (I could use CBV, but since that would also help with the OP's problem, I'll assume we aren't doing that) If (in the past) it had been mandated that you can only send mail to an MX record server, then if a message comes from 'bill@www.microsoft.com', I can quickly tell that it is probably a bad email address, since there is no MX record for www.microsoft.com. This would make it easier at the cost of 5 seconds more configuration time per domain. Unfortunately, it's too late to change that now. >> As a random thought, would there be the possibility to add some sort of >> marker on a parent domain to say 'we understand MX records, so we don't use >> A records for mail within this domain'? So, if you receive mail from >> 'bibble.twitter.com', you check the TXT records for 'twitter.com' which tell >> you that subdomains/hosts without an MX record won't have mail, and since >> there isn't an MX record for 'bibble.twitter.com', you can reject it/treat >> it as spoofed. > same as above. MX for bibble.twitter.com is only to receive emails. > Nothing prevents someone@bibble.twitter.com to send unless you put a > TXT "v=spf1 -all" for it ! > But it would help tremendously, without needing to add SPF records for each host in a domain. This is because there would be no MX record for 'bibble.twitter.com', so you could assume (because of this 'new rule') that that sender email address is invalid, because there is no way of replying to it. Yes, the MX is for receiving mail only, according to the SMTP standard, BUT if you work on the assumption that you have to be able to reply to the sender (which is a common enough assumption), then it ALSO has to be valid for sending mail. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From darxus@chaosreigns.com Fri Dec 7 10:19:10 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 124AD21F864D for ; Fri, 7 Dec 2012 10:19:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JcokvGVDl-bM for ; Fri, 7 Dec 2012 10:19:09 -0800 (PST) Received: from panic.chaosreigns.com (panic.chaosreigns.com [IPv6:2600:3c01::f03c:91ff:fe96:340b]) by ietfa.amsl.com (Postfix) with ESMTP id 5790421F85DD for ; Fri, 7 Dec 2012 10:19:09 -0800 (PST) Received: by panic.chaosreigns.com (Postfix, from userid 1000) id 6622B2C6FC8; Fri, 7 Dec 2012 13:19:08 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=chaosreigns.com; s=mail; t=1354904348; bh=4N2PdLsZDV0wYX1qqegKD1tPKGZYn8NEsJuRacBCnsc=; h=Date:From:To:Subject:References:In-Reply-To; b=bv8e/XCVnb3SSabejxyBCn3qHjqUr9LcCOcAd1Fqt2Mnl9bk2pNlqBQQ2aTCdgLvI dVBbUAEHvea/M0sJ8WoYH8sDZJB1d/Hzmkv5ZTxC07xYZgA3OG8zRsjB7T3cowz9a0 EVuu+YSSMuka9qlfQtDBciVNHQXTk6wG/qbrq4lA= Date: Fri, 7 Dec 2012 13:19:08 -0500 From: darxus@chaosreigns.com To: asrg@irtf.org Message-ID: <20121207181908.GM12261@chaosreigns.com> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50C21EFC.4060508@pscs.co.uk> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 18:19:10 -0000 On 12/07, Paul Smith wrote: > >>As a random thought, would there be the possibility to add some sort of > >>marker on a parent domain to say 'we understand MX records, so we don't use > >>A records for mail within this domain'? So, if you receive mail from > >>'bibble.twitter.com', you check the TXT records for 'twitter.com' which tell > >>you that subdomains/hosts without an MX record won't have mail, and since > >>there isn't an MX record for 'bibble.twitter.com', you can reject it/treat > >>it as spoofed. > >same as above. MX for bibble.twitter.com is only to receive emails. > >Nothing prevents someone@bibble.twitter.com to send unless you put a > >TXT "v=spf1 -all" for it ! > > > But it would help tremendously, without needing to add SPF records > for each host in a domain. > > This is because there would be no MX record for > 'bibble.twitter.com', so you could assume (because of this 'new > rule') that that sender email address is invalid, because there is > no way of replying to it. > > Yes, the MX is for receiving mail only, according to the SMTP > standard, BUT if you work on the assumption that you have to be able > to reply to the sender (which is a common enough assumption), then > it ALSO has to be valid for sending mail. I think this makes sense, but I think it would make more sense if there was a way to just specify in the SPF record for, for example, twitter.com, that all legit senders for all subdomains are included in the highest level SPF record. I don't know, I'm not a huge fan of SPF at this point, I'm not sure it's worth the work. -- "Forget not that the earth delights to feel your bare feet and the winds long to play with your hair." - Kahlil Gibran http://www.ChaosReigns.com From sm@resistor.net Fri Dec 7 10:39:23 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A72E21F86C3 for ; Fri, 7 Dec 2012 10:39:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.632 X-Spam-Level: X-Spam-Status: No, score=-102.632 tagged_above=-999 required=5 tests=[AWL=-0.033, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H+jYne2LjyIh for ; Fri, 7 Dec 2012 10:39:23 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id D9C0C21F86B2 for ; Fri, 7 Dec 2012 10:39:22 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id qB7IdHQE005166 for ; Fri, 7 Dec 2012 10:39:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1354905561; bh=kEzKcO9jAxzPNMTzq7F2dQAPhV0/Dk1P4AfZKrwlWJg=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=u+3XHm8dHe78pBwmo4J4hZyLi7jaxa6IhJoXF6rEFgXEwzZR4LfSoxgvf6YIlpTMq QxtcX/4gwUNlJOLQus8l3RPyiEAzad2AE3JiYuluOpmg65+sLFziN6xdqxTbx/IUL6 c6gB3reA1I26v7zonkfEKXyF23lSv/IrL25lpbKs= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1354905561; i=@resistor.net; bh=kEzKcO9jAxzPNMTzq7F2dQAPhV0/Dk1P4AfZKrwlWJg=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=bqSUxKEJaUM09IzuMIOhNipbvd/9ojR3viUzMhQV8pRfXj3kIKpHZswFv+VGDd7vv gHd7O/gnZqomw85UmR2Hz4EcaKSKxiHZIj81EYJNTcov5aM/yzMNG3NgVTZ2heHbE7 gxukCo+ge3CP2iM8JRWnhZ5eTogSj4+MS4UsYE/Q= Message-Id: <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Fri, 07 Dec 2012 09:16:17 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <50C21EFC.4060508@pscs.co.uk> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 18:39:23 -0000 Hi Paul, At 08:53 07-12-2012, Paul Smith wrote: >Yes, the MX is for receiving mail only, according to the SMTP >standard, BUT if you work on the assumption that you have to be able >to reply to the sender (which is a common Actually no, or else people would not be using noreply@example. Regards, -sm From darxus@chaosreigns.com Fri Dec 7 10:45:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 217D021F872E for ; Fri, 7 Dec 2012 10:45:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rhuKqIo4GEEP for ; Fri, 7 Dec 2012 10:45:28 -0800 (PST) Received: from panic.chaosreigns.com (panic.chaosreigns.com [IPv6:2600:3c01::f03c:91ff:fe96:340b]) by ietfa.amsl.com (Postfix) with ESMTP id 68C6A21F86B2 for ; Fri, 7 Dec 2012 10:45:28 -0800 (PST) Received: by panic.chaosreigns.com (Postfix, from userid 1000) id 3D4F12C6FC8; Fri, 7 Dec 2012 13:45:28 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=chaosreigns.com; s=mail; t=1354905928; bh=XbCFEtyyFZKesf+zqFL8BxGUl5v1lAgO6RG34SoQiRM=; h=Date:From:To:Subject:References:In-Reply-To; b=Vzm/QKLG57XhtZXOEuKQ+XK3MjW8OCiOe0hgnVAwFaRqHxETCa4uq4xWe0gE3jcRb bntzizjWHBd0eoQP8j5YqXZ0kdwbzJHc5y4AksWVAThTvl8G4nlmyXg+qO7EhF0nOF EiTcszi60zYm8qJVDEgN1FK6lEkeGH9gI84vDT3A= Date: Fri, 7 Dec 2012 13:45:28 -0500 From: darxus@chaosreigns.com To: asrg@irtf.org Message-ID: <20121207184528.GN12261@chaosreigns.com> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 18:45:29 -0000 On 12/07, SM wrote: > Hi Paul, > At 08:53 07-12-2012, Paul Smith wrote: > >Yes, the MX is for receiving mail only, according to the SMTP > >standard, BUT if you work on the assumption that you have to be > >able to reply to the sender (which is a common > > Actually no, or else people would not be using noreply@example. I think that behavior may be in violation of an RFC. (By which I do not mean to imply that it doesn't happen, or that blocking emails which do it would work out for everybody.) -- "Democracy is the theory that the common people know what they want, and deserve to get it good and hard." - H. L. Mencken http://www.ChaosReigns.com From feenberg@nber.org Fri Dec 7 11:25:14 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B94121F8703 for ; Fri, 7 Dec 2012 11:25:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uq+hBzkVw9Dd for ; Fri, 7 Dec 2012 11:25:14 -0800 (PST) Received: from mail2.nber.org (mail2.nber.org [66.251.72.79]) by ietfa.amsl.com (Postfix) with ESMTP id DC74921F86A3 for ; Fri, 7 Dec 2012 11:25:13 -0800 (PST) Received: from nber6 (nber6.nber.org [66.251.72.76]) by mail2.nber.org (8.14.4/8.14.4) with ESMTP id qB7JP99e098190; Fri, 7 Dec 2012 14:25:10 -0500 (EST) (envelope-from feenberg@nber.org) Date: Fri, 7 Dec 2012 14:14:14 -0500 (EST) From: Daniel Feenberg X-X-Sender: feenberg@nber6 To: Anti-Spam Research Group - IRTF In-Reply-To: <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> Message-ID: References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.39/RELEASE, bases: 20121207 #8642434, check: 20121207 clean Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 19:25:14 -0000 On Fri, 7 Dec 2012, SM wrote: > Hi Paul, > At 08:53 07-12-2012, Paul Smith wrote: >> Yes, the MX is for receiving mail only, according to the SMTP standard, >> BUT if you work on the assumption that you have to be able to reply to >> the sender (which is a common > > Actually no, or else people would not be using noreply@example. Anyone sending mail from noreply@example.com would not be seriously inconvenienced if they were required to have a working MTA at example.com, even if they wanted to use a non-working username at that domain. In fact, that is what I generally see in such mail. daniel feenberg > > Regards, > -sm > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg > From prvs=0688AFDA83=paul@pscs.co.uk Fri Dec 7 11:40:24 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5490721F873F for ; Fri, 7 Dec 2012 11:40:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nUHRMM8rrLI6 for ; Fri, 7 Dec 2012 11:40:23 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id 7374321F8615 for ; Fri, 7 Dec 2012 11:40:22 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP for ; Fri, 7 Dec 2012 19:51:26 -0000 Received: from [192.168.57.155] ([217.155.61.157]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP for ; Fri, 7 Dec 2012 19:33:59 -0000 Message-ID: <50C244A6.1040402@pscs.co.uk> Date: Fri, 07 Dec 2012 19:33:58 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121026 Thunderbird/16.0.2 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> In-Reply-To: <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 19:40:24 -0000 On 07/12/2012 17:16, SM wrote: > Hi Paul, > At 08:53 07-12-2012, Paul Smith wrote: >> Yes, the MX is for receiving mail only, according to the SMTP >> standard, BUT if you work on the assumption that you have to be able >> to reply to the sender (which is a common > > Actually no, or else people would not be using noreply@example. Do people really send messages with a return path of 'noreply@example'? Or, do you mean that people use a return path of 'noreply@'? With the former, I'd expect a large number of those messages to be blocked/discarded (it's common to do call back verification, or just simply check that the sender domain exists). I'd only expect that to be done by people who don't really understand what's going on. I know we have to deal with quite a few cases where our customers have errors or missing messages, which turn out to be because they've misspelled the domain part of their email address, and their mail is being blocked/discarded because the return address is invalid. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From johnl@iecc.com Fri Dec 7 12:46:20 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C938F21F8B9E for ; Fri, 7 Dec 2012 12:46:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.262 X-Spam-Level: X-Spam-Status: No, score=-106.262 tagged_above=-999 required=5 tests=[AWL=0.637, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jwTnRATPd3mY for ; Fri, 7 Dec 2012 12:46:20 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id A685C21F8980 for ; Fri, 7 Dec 2012 12:46:19 -0800 (PST) Received: (qmail 49599 invoked from network); 7 Dec 2012 20:46:16 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 7 Dec 2012 20:46:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c25598.xn--3zv.k1211; i=johnl@user.iecc.com; bh=xa3TW4zCPnZBGp3ojcQkr3eiw6NqnGKky83h7gcWsa8=; b=vJbFEO1s7XeZ//LX6rrk86lvfyjsfMhtS7PHeC4ql0ig2XQ3vIYZM9ji/nJ5Rhfu9J9l8S4lEGsa2HGJejp7psYi55eopBa7lPnlgly80uIhTCet8eMT5G7AFbcDPIPePh+MA1B/1VMU3cWOQUTWk6sKiasR9aWSB8Jqb6OmaMo= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c25598.xn--3zv.k1211; olt=johnl@user.iecc.com; bh=xa3TW4zCPnZBGp3ojcQkr3eiw6NqnGKky83h7gcWsa8=; b=Xl2a0lI62JfXdGeP9jfs1Kaz6wiOZ9Fr7cPe4oqMyk3/zXj/XzDvzldRxI1A9wt0HDmLix55WZyY1dNAF9tAPrFoLPgpGRoRrnQoXKsjBJGgkfx0GKry2UIAlTkpdabmcL4yT9f0Gn7OChu1NCv1hEYoj2x0iUMX/LjwcQLRCC0= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 7 Dec 2012 20:45:54 -0000 Message-ID: <20121207204554.18364.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <20121207181908.GM12261@chaosreigns.com> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 20:46:20 -0000 >I think this makes sense, but I think it would make more sense if there was >a way to just specify in the SPF record for, for example, twitter.com, that >all legit senders for all subdomains are included in the highest level SPF >record. This sort of thing has been proposed before. It turns out that anything in the DNS that starts "all names below this node ..." is astonishingly hard to implement. (Yes, I know about zone cuts.) I do agree that it would have been really nice if the SMTP fallback from MX to A records had been deprecated and killed back in the 1980s. I tried to get RFC 5321 not to add fallback to AAAA but the powers that be insisted that it was already too late. From johnl@iecc.com Fri Dec 7 12:50:31 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBFBF21F8BA0 for ; Fri, 7 Dec 2012 12:50:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.152 X-Spam-Level: X-Spam-Status: No, score=-105.152 tagged_above=-999 required=5 tests=[AWL=-0.553, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, MANGLED_SPAM=2.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hXee2F-R2Lab for ; Fri, 7 Dec 2012 12:50:31 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 03D4A21F8A94 for ; Fri, 7 Dec 2012 12:50:30 -0800 (PST) Received: (qmail 50376 invoked from network); 7 Dec 2012 20:50:25 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 7 Dec 2012 20:50:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c25691.xn--hew.k1211; i=johnl@user.iecc.com; bh=w8tllLYZbtBfsic9jdc0wcb/qfmyup/H4N2xlGSfKtk=; b=lMFGRVxg7+uqoscCdnovtLsr0yA8GKwEufuJz12vCQTbeiaJ1vNc4o5sINbt6pbCxFpe4X7Iz+3Y5rQsGg1uQvUqpA/qJnR3lJEyf5ALQKhzIxidHN/scInpGLnZqyjslYfF8S2zmv/6yAGISCKfU8NgsNbP3lhVGuPMJgt6ZVw= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c25691.xn--hew.k1211; olt=johnl@user.iecc.com; bh=w8tllLYZbtBfsic9jdc0wcb/qfmyup/H4N2xlGSfKtk=; b=M/7l1A869pBVaZCXe3xL5wlWG78eAEyXIVsvWvAYwt46xqVhY6GEGllz5of+hJW3muNQIzWWc0UZO3YFFKTXc0r9tYFMwoP4iflooj575MX3arIGysvZOOPaS4nR0NxLC156+jbvabQag9zGO5xgetIkmypi2pCkoI0PZUvez/Y= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 7 Dec 2012 20:50:03 -0000 Message-ID: <20121207205003.18391.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <50C244A6.1040402@pscs.co.uk> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] various anti-spam techniques, was misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 20:50:32 -0000 >With the former, I'd expect a large number of those messages to be >blocked/discarded (it's common to do call back verification, or just >simply check that the sender domain exists). Checking that the sender domain exists is quite common, cheap, and has a very low failure rate. SMTP callbacks are one of those bad ideas that just won't go away. They're quite abusive (consider the 95% of mail that is spam with someone else's return address) and don't work, since your idea of what I should say in response to your MAIL FROM and RCPT TO commands is probably not the same as my idea of what I actually do say. R's, John PS: The wiki at http://wiki.asrg.sp.am has a taxonomy of anti-spam techniques, both the good and the bad. See if your favorite or least favorite is listed there, and if not, please add it. If you don't have a login to edit, just drop me a note and I'll give you one. From rsk@gsp.org Fri Dec 7 13:10:44 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4960721F8AF9 for ; Fri, 7 Dec 2012 13:10:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.227 X-Spam-Level: X-Spam-Status: No, score=-6.227 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1TnSJ68Y-X5z for ; Fri, 7 Dec 2012 13:10:38 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id A47E221F8925 for ; Fri, 7 Dec 2012 13:10:38 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.91.dsl.charm.net [207.114.17.91]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qB7LAZ3O020028 for ; Fri, 7 Dec 2012 16:10:36 -0500 (EST) Date: Fri, 7 Dec 2012 16:10:30 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121207211030.GA21509@gsp.org> References: <50C244A6.1040402@pscs.co.uk> <20121207205003.18391.qmail@joyce.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20121207205003.18391.qmail@joyce.lan> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] various anti-spam techniques, was misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 21:10:44 -0000 On Fri, Dec 07, 2012 at 08:50:03PM -0000, John Levine wrote: > SMTP callbacks are one of those bad ideas that just won't go away. > They're quite abusive (consider the 95% of mail that is spam with > someone else's return address) and don't work, since your idea of what > I should say in response to your MAIL FROM and RCPT TO commands is > probably not the same as my idea of what I actually do say. +1 And: Callbacks enable DDoS-by-proxy attacks. [1] And they violate a fundamental principle of network abuse mitigation: never deal with bad traffic by generating more traffic, it doesn't scale. Moreover: even if they worked perfectly, they'd still have no anti-spam value. Knowing that an address is valid tells you nothing about the intentions of either (a) its putative owner or (b) the current owner, who, as we know, are often not the same entity. ---rsk [1] Consider, as one scenario out of many possibilities: the target is example.net. Attacker registers example[1-500].info. Attacker sets MX for all 500 of those domains to the MX for example.net. Attacker uses 50K bots to open 10 simultaneous connections each to 500K distinct MX's for other domains. All 500K of those MX's look at putative sender (e.g., user456@example123.info), look up MX for that domain (which is of course the MX for example.net), open up a connection to it to do a callback... From sm@resistor.net Fri Dec 7 13:32:17 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B07621F8786 for ; Fri, 7 Dec 2012 13:32:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.63 X-Spam-Level: X-Spam-Status: No, score=-102.63 tagged_above=-999 required=5 tests=[AWL=-0.031, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N4z3t4l33ARU for ; Fri, 7 Dec 2012 13:32:16 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 763EF21F8784 for ; Fri, 7 Dec 2012 13:32:16 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id qB7LWA5j018505 for ; Fri, 7 Dec 2012 13:32:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1354915934; bh=N8XxbTli0SY4ceWgdslxVMpq2/Chd1k/+P6h8Ou2+MI=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=AKa1oNCTekCQ1quSPuF2JqX8NNqXSAmO2p2Umh8Npr004OT7q0YhSYWEwL8JxLAEB BJ9f/XfgkM6uSo3up2CiK6aWEczWs2WxGDAPY+Z6WmIaFCW+t57MZ4xD5v6d+3O13a 6okq/YJ3gY/weGSE4c/lf6mKJkAEgZFstTejj008= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1354915934; i=@resistor.net; bh=N8XxbTli0SY4ceWgdslxVMpq2/Chd1k/+P6h8Ou2+MI=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=gcAVQT2r5yKF/bKtPpcRqCCCShudthScE+RY8qx+MKvz6wb7SxddsBb/P/iEqMSle fT3VE0dOBAZ1tx1ao2AWCuVmz5gH2fmgqjQ+7wBoBnbUjyjbpWzGxYtt0/yT/mADlU jsHKe7rXt8NzxdU70vr29WVlzQ43qCTsFVJu2+MA= Message-Id: <6.2.5.6.2.20121207132220.0b7304f8@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Fri, 07 Dec 2012 13:32:00 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: <50C244A6.1040402@pscs.co.uk> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> <50C244A6.1040402@pscs.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 21:32:17 -0000 Hi Paul, At 11:33 07-12-2012, Paul Smith wrote: >Do people really send messages with a return path of >'noreply@example'? Or, do you mean that people use a return path of >'noreply@'? I used "example" as an example. I misunderstood what you meant by reply. I was referring to what's used as the author address. I don't recall whether noreply@example is used in the envelope for delivery failures (assuming valid messages). There are valid messages with an invalid Return-Path. This may due to some assumptions about how email works. >With the former, I'd expect a large number of those messages to be >blocked/discarded (it's common to do call back verification, or just >simply check that the sender domain Call-back verification can be used to trigger a Denial of Service. Regards, -sm From asrg3@billmail.scconsult.com Fri Dec 7 14:07:35 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A333221F86E2 for ; Fri, 7 Dec 2012 14:07:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UYHRW+8xwe14 for ; Fri, 7 Dec 2012 14:07:35 -0800 (PST) Received: from toaster.scconsult.com (client.scconsult.com [66.73.230.190]) by ietfa.amsl.com (Postfix) with ESMTP id 2F61121F8701 for ; Fri, 7 Dec 2012 14:07:34 -0800 (PST) Received: from [192.168.254.21] (deepfield.scconsult.com [192.168.254.22]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by toaster.scconsult.com (Postfix) with ESMTPSA id 3YJ78L216bzrX81 for ; Fri, 7 Dec 2012 17:07:30 -0500 (EST) From: "Bill Cole" To: "Anti-Spam Research Group - IRTF" Date: Fri, 07 Dec 2012 17:07:24 -0500 Message-ID: In-Reply-To: <20121206212116.10328.qmail@joyce.lan> References: <20121206212116.10328.qmail@joyce.lan> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.5r3119) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 22:07:35 -0000 On 6 Dec 2012, at 16:21, John Levine wrote: > In article > > you write: >> here is the proof of concept ! an email sent to John Levine claiming >> to be from ygii-john@www.johnlevine.com !!! > > Life is too short to publish SPF -all records for every host name that > doesn't send mail. Well, not really. It's not 1999: no one competent and sane manages zones of non-trivial size or significance by editing canonical-format zone files in a 24x80 text editor. As a matter of standard practice, many domains have long been managed with an awareness that the MX/A issue creates problems which are mitigated by never creating an A record without also creating an MX, with non-mailing hosts getting MX records that are easily detected as a declaration of that status. This is useful because there are spam exclusion tactics which detect such declarations and so reject spoofed addresses. It is a simple matter with many (most?) modern MTA's to reject mail in SMTP before DATA if the sender domain has a bogus MX record. The cleanest form of bogosity is the "nullmx" approach proposed and used by Yahoo, but it is also useful for receivers to detect MX records pointing to names without A records or with A records pointing to unusable addresses (i.e. permanently reserved and/or otherwise special address ranges.) If a domain owner is already publishing SPF for mailing names (where it can be problematic) and already publishing anti-functional MX records, they should have no problem with publishing SPF records as well for their non-mailing names. There is a nuisance cost in doing this sort of thing for mid-sized domains which have long been able to function managing their DNS in ad hoc ways, but that condition is pretty much doomed anyway by IPv6 and DNSSEC. We all are destined for needing to think more and more carefully about DNS. I should add that I don't think this issue is significant in the big picture of spam control and it certainly isn't news with respect to SPF. The days of hope for SPF as the FUSSP are long gone. Even with DMARC we will never have a world where SPF plays a primary role in sender authentication and repudiation. SPF has a few narrow applications where it is very useful, but anyone hoping for it to be the fix for all sender spoofing ought to have been disillusioned by real world experience some years ago. From christian.grunfeld@gmail.com Fri Dec 7 16:18:26 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0254A21F8BB6 for ; Fri, 7 Dec 2012 16:18:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=-1.000, BAYES_00=-2.599, MANGLED_SPAM=2.3, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tn4--PdBixAp for ; Fri, 7 Dec 2012 16:18:24 -0800 (PST) Received: from mail-ie0-f176.google.com (mail-ie0-f176.google.com [209.85.223.176]) by ietfa.amsl.com (Postfix) with ESMTP id B206221F8BAE for ; Fri, 7 Dec 2012 16:18:24 -0800 (PST) Received: by mail-ie0-f176.google.com with SMTP id 13so3243246iea.21 for ; Fri, 07 Dec 2012 16:18:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=fg+k1x3ZELyAqU5FS/BaUQfDTo+ng1cwsQxNtZqVacc=; b=Zd//7wraaK+jnDjxpohiJ2YeIs5utgk6LKfh7shwNNXD+qBTL54dNq4QhBo4CKNTkE VUaj8/ucR0yrGaewWm5ZgCMXAEXP6gltDcAd5wKptF/XXnTSkVBGHLRMqAPEZJBpw2Dv AncvE5rW1H/Y7cRsPYk8SVkNpeLg+0oe/0BsNktg1BQPs92Ru2pTmapDmWniFCkgEyhy Mx8PYXNZEqJVdiamditFL+ODCNeR/0x5bkli5l3usLkh4+zJJuetghnoZ3jcFhiONQ1P AU2MfIEQoqMffHB0uRabv7Anxg+GW9/SAN3wpjbPB2dNEWQvW5yr6Q8QyAKtWRemB1yJ jN6Q== MIME-Version: 1.0 Received: by 10.50.187.197 with SMTP id fu5mr672566igc.70.1354925904108; Fri, 07 Dec 2012 16:18:24 -0800 (PST) Received: by 10.231.65.79 with HTTP; Fri, 7 Dec 2012 16:18:23 -0800 (PST) In-Reply-To: <20121207205003.18391.qmail@joyce.lan> References: <50C244A6.1040402@pscs.co.uk> <20121207205003.18391.qmail@joyce.lan> Date: Fri, 7 Dec 2012 21:18:23 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] various anti-spam techniques, was misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 00:18:26 -0000 2012/12/7 John Levine : > PS: The wiki at http://wiki.asrg.sp.am has a taxonomy of anti-spam > techniques, both the good and the bad. See if your favorite or least > favorite is listed there, and if not, please add it. If you don't > have a login to edit, just drop me a note and I'll give you one. John, I didn't find spamtraps or honeypots.....may be I didn't dig enough the wiki From johnl@iecc.com Fri Dec 7 18:03:07 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C25721F8BD5 for ; Fri, 7 Dec 2012 18:03:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.119 X-Spam-Level: X-Spam-Status: No, score=-105.119 tagged_above=-999 required=5 tests=[AWL=-0.520, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, MANGLED_SPAM=2.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hcyYuTNxO1CY for ; Fri, 7 Dec 2012 18:03:07 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id A7FFB21F8BD3 for ; Fri, 7 Dec 2012 18:03:06 -0800 (PST) Received: (qmail 12805 invoked from network); 8 Dec 2012 02:03:02 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 8 Dec 2012 02:03:02 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c29fd6.xn--btvx9d.k1211; i=johnl@user.iecc.com; bh=KFrsKfQl6sT59/0uRqMBLCfI9lz+GlpCJJMSPsvj+q8=; b=RGEpL1YsGUfxkxlM0HrvJwNfooLuWaN9zA3o7G5S7/H08Ud4sn/HTWRKJtznUKPxBkDzmdtN6ddjfNfQyjVpjFxtD+UJKCRI0p6tO6EPEuSVph7hejy7bWslqXZROnZKIsZQW2fFYdCsoiSvzb0V1g7oBEcn7gdoTJf4WjhOri0= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c29fd6.xn--btvx9d.k1211; olt=johnl@user.iecc.com; bh=KFrsKfQl6sT59/0uRqMBLCfI9lz+GlpCJJMSPsvj+q8=; b=JA/mqannVYqGswArJEMwN5G0Pu7NwucnoJR98bC8QVB6E7QvoNZlX43fUebxQGH/9aEH91w53lwIweaA/wPPP0MAwDlKWvnYFjsVPI3eSYIp19yZVTAv4X++9ed36i1b+AB9uiTN2nKMuzHEeg9jv0PahhiXBEGxFzB0I/6I0Bs= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 8 Dec 2012 02:02:40 -0000 Message-ID: <20121208020240.21055.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] various anti-spam techniques, was misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 02:03:07 -0000 >> PS: The wiki at http://wiki.asrg.sp.am has a taxonomy of anti-spam >> techniques, both the good and the bad. See if your favorite or least >> favorite is listed there, and if not, please add it. If you don't >> have a login to edit, just drop me a note and I'll give you one. > > >John, I didn't find spamtraps or honeypots.....may be I didn't dig >enough the wiki That's because it's not done yet. Where should I send your password so you can add those sections? From johnl@iecc.com Fri Dec 7 18:06:21 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1435A21F8BE8 for ; Fri, 7 Dec 2012 18:06:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.24 X-Spam-Level: X-Spam-Status: No, score=-106.24 tagged_above=-999 required=5 tests=[AWL=0.659, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J5UWx6iB-fho for ; Fri, 7 Dec 2012 18:06:20 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 41FCF21F8BD5 for ; Fri, 7 Dec 2012 18:06:20 -0800 (PST) Received: (qmail 13278 invoked from network); 8 Dec 2012 02:06:19 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 8 Dec 2012 02:06:19 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c2a09b.xn--hew.k1211; i=johnl@user.iecc.com; bh=HoGIrGcy7MDiS11iG2GKrrlzrkQjH4F1fc9m9jPg3SY=; b=GKkAZmK7ILnAxYoKYy2aAGoP5/YzFRiVtsRNBdrNm1Baj6sKxwrZqfLMLSvbW1eC1NgqGJ8KNQlia7sAMqXxYupWc5J+Bf0Y1zVGELZhz3XTemfdayhtIWdD+zsJhY/fZSRWgDId+m3J8dwaEmXeLDWDgQa5JEElKT2r/Vxqy2E= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c2a09b.xn--hew.k1211; olt=johnl@user.iecc.com; bh=HoGIrGcy7MDiS11iG2GKrrlzrkQjH4F1fc9m9jPg3SY=; b=E4Ga6R5eerWPjVnQsNGatpmxF28jeoYyScXzHHkS3nEZ30Iz2mdrK3vLPUTbHjEz+/VASqFqp+m+hzWzcsvEz2wvSic+ovGreanpL0JCvsiSghM/kDF4axhutko21T10nSQP+bcuqSAyTv5SS1/9Sfp0Ns/w1MUPGRasbV4w42k= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 8 Dec 2012 02:05:57 -0000 Message-ID: <20121208020557.21177.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 02:06:21 -0000 >already publishing anti-functional MX records I only publish a handful of anti-functional MX records, for a few domains that get a buttload of spam due to having appeared in usenet message IDs that were mis-scraped onto spam lists a long time ago. I probably have two orders of magnitude more A records than MX records, and I'm not inclined to add an MX . and SPF -all for all of them. From vesely@tana.it Sat Dec 8 10:43:09 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 586F621F8546 for ; Sat, 8 Dec 2012 10:43:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.719 X-Spam-Level: X-Spam-Status: No, score=-4.719 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BGfDeE1V33YO for ; Sat, 8 Dec 2012 10:43:08 -0800 (PST) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 4595721F8531 for ; Sat, 8 Dec 2012 10:43:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1354992184; bh=pkiWbN9UroDpRYe7IO0fEhchQBsMEdAGtCBGfTuB/nk=; l=903; h=Date:From:To:References:In-Reply-To; b=PX89Xtv/gsYmV+AJBORWBljijy1J174AqPO/aY2yY6j+hQVfJqHeY1qOIZ5XsRCi7 uAANaAC/dLrwWcOSItdt8JLNjDuxhS0pEYdneTOokA8/r4r6V8UEiVxrEj3fhj2UUN 2A5tukyWTxPKi4v0h7GJKOIs+FgJo76Qxa4mBwdk= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Sat, 08 Dec 2012 19:43:04 +0100 id 00000000005DC031.0000000050C38A38.00000D3C Message-ID: <50C38A37.8050602@tana.it> Date: Sat, 08 Dec 2012 19:43:03 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20121207204554.18364.qmail@joyce.lan> In-Reply-To: <20121207204554.18364.qmail@joyce.lan> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 18:43:09 -0000 On Fri 07/Dec/2012 21:45:54 +0100 John Levine wrote: >>I think this makes sense, but I think it would make more sense if there was >>a way to just specify in the SPF record for, for example, twitter.com, that >>all legit senders for all subdomains are included in the highest level SPF >>record. > > This sort of thing has been proposed before. It turns out that > anything in the DNS that starts "all names below this node ..." is > astonishingly hard to implement. > > (Yes, I know about zone cuts.) It is easy to do the opposite, though. For example, having leila.iecc.com TXT "v=spf1 redirect=iecc.com" would enable receivers, at the cost of an extra lookup, to infer that iecc.com is in the same administrative domain of that mailer, for reputation or reporting purposes. Aren't there generic (i.e. non spf-specific) DNS conventions for publishing such relationships? From asrg3@billmail.scconsult.com Sat Dec 8 11:03:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CF0021F8587 for ; Sat, 8 Dec 2012 11:03:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dHWI4MU3kLks for ; Sat, 8 Dec 2012 11:03:52 -0800 (PST) Received: from toaster.scconsult.com (client.scconsult.com [66.73.230.190]) by ietfa.amsl.com (Postfix) with ESMTP id C787B21F855F for ; Sat, 8 Dec 2012 11:03:51 -0800 (PST) Received: from [192.168.254.21] (deepfield.scconsult.com [192.168.254.22]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by toaster.scconsult.com (Postfix) with ESMTPSA id 3YJg1y5Jy9zrYBR for ; Sat, 8 Dec 2012 14:03:50 -0500 (EST) From: "Bill Cole" To: "Anti-Spam Research Group - IRTF" Date: Sat, 08 Dec 2012 14:03:45 -0500 Message-ID: In-Reply-To: <6.2.5.6.2.20121207132220.0b7304f8@resistor.net> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> <50C244A6.1040402@pscs.co.uk> <6.2.5.6.2.20121207132220.0b7304f8@resistor.net> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.5r3119) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 19:03:52 -0000 On 7 Dec 2012, at 16:32, SM wrote: > I don't recall whether noreply@example is used in the envelope for > delivery failures (assuming valid messages). If that sentence is not mis-worded, it is a declaration of ignorance of important fundamental facts about how email works. RFC5321 is required reading for anyone who wants to be taken seriously in technical discussions of email. > There are valid messages with an invalid Return-Path. This could only be true when using a technically useless definition of "valid messages" which does not refer to any formal standard or even to informal best practice norms. There are many strong arguments for mail systems to refrain from attempting to require strict compliance to many details of the SMTP and email format standards, but it is unhelpful to assume that historically or even currently widespread forbearance of operational enforcement of some facet of the standards grants any sort of validity to non-compliant messages. > This may due to some assumptions about how email works. Indeed. From johnl@iecc.com Sat Dec 8 12:37:20 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC95B21F85CF for ; Sat, 8 Dec 2012 12:37:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.275 X-Spam-Level: X-Spam-Status: No, score=-106.275 tagged_above=-999 required=5 tests=[AWL=0.624, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z6p6aKKpM2KF for ; Sat, 8 Dec 2012 12:37:20 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 1FCA021F84B2 for ; Sat, 8 Dec 2012 12:37:19 -0800 (PST) Received: (qmail 7571 invoked from network); 8 Dec 2012 20:37:16 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 8 Dec 2012 20:37:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c3a4fc.xn--hew.k1211; i=johnl@user.iecc.com; bh=0asBeQrjMB5v+fvaI5kesKkzN9DOjPEc5NfztJcSiAM=; b=F3tMA5eqRkbRe3KKBMUbVUTviEyETXoka2nYXHzffyd5+237Up9x8bALuBSRP4Q0NEPmKt4+yRdhMzotGF4pkgm0TdcwEGxUeY8WgPAl5RZ/boXl42Fxmt4ZjiHqzgtewHGkvPSPdQ2+VpihTtkbwCdpb9wB6wHjGXRRtR/TR+A= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c3a4fc.xn--hew.k1211; olt=johnl@user.iecc.com; bh=0asBeQrjMB5v+fvaI5kesKkzN9DOjPEc5NfztJcSiAM=; b=mrlo2af2npZv3XdobgWEsyipPsDBMHBADCcpHPhPXlBwxGMBpr/G4GcqbTC1iv+Qvs4NiJSd/0H5O+KfDpFfc+3zswbJQyyh6llr/xBzWOPOGm4pENqO3/pbwV+mIuK/TKuEyW0GBf1Je4FaYOCeBQmRCkG16VtfPeRANp4+0m0= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 8 Dec 2012 20:36:54 -0000 Message-ID: <20121208203654.62106.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <50C38A37.8050602@tana.it> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 20:37:21 -0000 >It is easy to do the opposite, though. For example, having > > leila.iecc.com TXT "v=spf1 redirect=iecc.com" It's not easy if I have to add an extra TXT record for each of the thousands of A records in my DNS zones. >Aren't there generic (i.e. non spf-specific) DNS conventions for >publishing such relationships? There's CNAME, but that doesn't do what we want here. From ajs@anvilwalrusden.com Sat Dec 8 15:38:09 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C070B21F89E9 for ; Sat, 8 Dec 2012 15:38:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.84 X-Spam-Level: X-Spam-Status: No, score=-0.84 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HELO_MISMATCH_INFO=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v+C+PtZkMi0d for ; Sat, 8 Dec 2012 15:38:09 -0800 (PST) Received: from mx1.yitter.info (ow5p.x.rootbsd.net [208.79.81.114]) by ietfa.amsl.com (Postfix) with ESMTP id 13ADC21F88C1 for ; Sat, 8 Dec 2012 15:38:08 -0800 (PST) Received: from mx1.yitter.info (69-196-144-227.dsl.teksavvy.com [69.196.144.227]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.yitter.info (Postfix) with ESMTPSA id 6C59C8A031 for ; Sat, 8 Dec 2012 23:38:06 +0000 (UTC) Date: Sat, 8 Dec 2012 18:38:10 -0500 From: Andrew Sullivan To: asrg@irtf.org Message-ID: <20121208233809.GA9196@mx1.yitter.info> References: <20121207204554.18364.qmail@joyce.lan> <50C38A37.8050602@tana.it> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50C38A37.8050602@tana.it> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 23:38:09 -0000 On Sat, Dec 08, 2012 at 07:43:03PM +0100, Alessandro Vesely wrote: > would enable receivers, at the cost of an extra lookup, to infer > that iecc.com is in the same administrative domain of that mailer, for > reputation or reporting purposes. I wrote a draft discussing some of these problems, and have talked about it on the Applications Area list (and in one of the meetings). > Aren't there generic (i.e. non spf-specific) DNS conventions for > publishing such relationships? No, but comments on http://tools.ietf.org/html/draft-sullivan-domain-origin-assert-02 would be most welcome. A -- Andrew Sullivan ajs@anvilwalrusden.com From prvs=0690ADBB90=paul@pscs.co.uk Sat Dec 8 16:00:27 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 193FF21F8AAC for ; Sat, 8 Dec 2012 16:00:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrlafSNeYT1G for ; Sat, 8 Dec 2012 16:00:26 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id D6DFF21F897A for ; Sat, 8 Dec 2012 16:00:25 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP for ; Sun, 9 Dec 2012 00:11:33 -0000 Received: from [192.168.57.155] ([217.155.61.157]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP for ; Sat, 8 Dec 2012 23:17:21 -0000 Message-ID: <50C3CA7A.6080304@pscs.co.uk> Date: Sat, 08 Dec 2012 23:17:14 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121207204554.18364.qmail@joyce.lan> In-Reply-To: <20121207204554.18364.qmail@joyce.lan> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 00:00:27 -0000 On 07/12/2012 20:45, John Levine wrote: >> I think this makes sense, but I think it would make more sense if there was >> a way to just specify in the SPF record for, for example, twitter.com, that >> all legit senders for all subdomains are included in the highest level SPF >> record. > This sort of thing has been proposed before. It turns out that > anything in the DNS that starts "all names below this node ..." is > astonishingly hard to implement. Could we have a "direct parent" check rather than going up lots of levels? Eg, if you are having to fall back to an A record, look at the direct parent for a TXT record with appropriate data in So, if you are checking a message from xyz@bibble.twitter.com, you are doing your check back that bibble.twitter.com exists, and see that it only has an A record (if it has an MX record, that satisfies your checks). Now, you do a TXT lookup on 'twitter.com' and if the result has a record saying 'mx only' (or some such) you know that 'bibble.twitter.com' isn't valid as an email domain. This would be quicker than going up the tree, but would catch the most common case of having lots of hosts defined in a domain, any of which could be used for 'spoofing'. It would only be needed in the (hopefully, rare) case of having to fall back to the 'A' record. Checking for the TXT record would be slower than not doing so, but would be a lot more efficient than attempting to connect to a non-existent mail server at the A record. > I do agree that it would have been really nice if the SMTP fallback > from MX to A records had been deprecated and killed back in the 1980s. > I tried to get RFC 5321 not to add fallback to AAAA but the powers > that be insisted that it was already too late. > I wish it could be deprecated (but still required) now (ie, you MAY just have an A record to indicate where mail is to be delivered, but you SHOULD have an MX record instead). That way if we came across an A record only, we would have a stronger argument for persuading domain admins to add MX records. Currently some say 'well the standards say it's OK, so we're not changing anything'. It could be worth logging how many times we have to fall back to an A/AAAA record, AND the delivery succeeds - I may have a go at that ourselves. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From ajs@anvilwalrusden.com Sat Dec 8 16:35:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D92321F8AD2 for ; Sat, 8 Dec 2012 16:35:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.84 X-Spam-Level: X-Spam-Status: No, score=-0.84 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_INFO=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qK9BT0pLIGb8 for ; Sat, 8 Dec 2012 16:35:28 -0800 (PST) Received: from mx1.yitter.info (ow5p.x.rootbsd.net [208.79.81.114]) by ietfa.amsl.com (Postfix) with ESMTP id 9C83321F8ACA for ; Sat, 8 Dec 2012 16:35:28 -0800 (PST) Received: from mx1.yitter.info (69-196-144-227.dsl.teksavvy.com [69.196.144.227]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.yitter.info (Postfix) with ESMTPSA id C536E8A031 for ; Sun, 9 Dec 2012 00:35:25 +0000 (UTC) Date: Sat, 8 Dec 2012 19:35:33 -0500 From: Andrew Sullivan To: asrg@irtf.org Message-ID: <20121209003532.GC9196@mx1.yitter.info> References: <20121207204554.18364.qmail@joyce.lan> <50C3CA7A.6080304@pscs.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50C3CA7A.6080304@pscs.co.uk> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 00:35:29 -0000 On Sat, Dec 08, 2012 at 11:17:14PM +0000, Paul Smith wrote: > Could we have a "direct parent" check rather than going up lots of levels? No. > Eg, if you are having to fall back to an A record, look at the > direct parent for a TXT record with appropriate data in You have _no reason_ whatever to suppose that the parent is the appropriate place to ask this. Indeed, you don't even have a reason to suppose that the parent isn't part of the same zone delegation you're looking at (where's the SOA? And why does the SOA tell you anything anyway, since organizations can cheerfully introduce zone cuts for administrative purposes that have nothing to do with delegating outside the controlling organization). > It could be worth logging how many times we have to fall back to an > A/AAAA record, AND the delivery succeeds - I may have a go at that > ourselves. That would indeed be useful empirical evidence. Best, A -- Andrew Sullivan ajs@anvilwalrusden.com From sm@resistor.net Sun Dec 9 00:50:28 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54F8A21F89BD for ; Sun, 9 Dec 2012 00:50:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.629 X-Spam-Level: X-Spam-Status: No, score=-102.629 tagged_above=-999 required=5 tests=[AWL=-0.030, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MHfoyB7gTR1n for ; Sun, 9 Dec 2012 00:50:25 -0800 (PST) Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id B310821F8538 for ; Sun, 9 Dec 2012 00:50:25 -0800 (PST) Received: from SUBMAN.resistor.net (IDENT:sm@localhost [127.0.0.1]) (authenticated bits=0) by mx.elandsys.com (8.14.5/8.14.5) with ESMTP id qB98oHVC023487 for ; Sun, 9 Dec 2012 00:50:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1355043023; bh=UErr3y+zi3+PjKGAi619f+T3n782d/gUGpNPVArInbI=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=mnJ7jnxXBDkpnbsBup5I00WJtcjL/xIHVtWD6KfdUh1VL1X/k+Zs1FBZk5E9PbRbE GPmpxl6gxG8S9iotQe7u+hWc5d54cfcsgmQhIfutWkKLN7Yr2xkaBLwCHb52MP2wng gnH9CCNppZbYtn/lQRNM5RJDLuG0ipybUFyuNz14= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1355043023; i=@resistor.net; bh=UErr3y+zi3+PjKGAi619f+T3n782d/gUGpNPVArInbI=; h=Date:To:From:Subject:In-Reply-To:References:Cc; b=aBaJegssPsilIyPkJkQlU9e7N51fsjjnrb1hJVjZ6z6tZsWX6GvTDwXqRDcDF1Odw LBwn9ylE2u5ieXEcZxAkUYqUtRMUfe5QUzg1I8UFFho9NdTCeiM2VBr6nO6X5kT1Gq ugCUASaAQszI+fXipGwgHCuONcZwJ8r8MyAaqxtg= Message-Id: <6.2.5.6.2.20121209003503.095b5758@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Sun, 09 Dec 2012 00:42:24 -0800 To: Anti-Spam Research Group - IRTF From: SM In-Reply-To: References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C21EFC.4060508@pscs.co.uk> <6.2.5.6.2.20121207091426.0b4ecdf0@resistor.net> <50C244A6.1040402@pscs.co.uk> <6.2.5.6.2.20121207132220.0b7304f8@resistor.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 08:50:28 -0000 At 11:03 08-12-2012, Bill Cole wrote: >If that sentence is not mis-worded, it is a declaration of ignorance >of important fundamental facts about how email works. RFC5321 is >required reading for anyone who wants The sentence is likely incorrectly phrased. >There are many strong arguments for mail systems to refrain from >attempting to require strict compliance to many details of the SMTP >and email format standards, but it is unhelpful to assume that >historically or even currently widespread forbearance of operational >enforcement of some facet of the standards grants any sort of >validity to non-compliant messages. Yes. Regards, -sm From dhc@dcrocker.net Sun Dec 9 07:02:24 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F4F921F85C6 for ; Sun, 9 Dec 2012 07:02:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-HS0C-tGWcK for ; Sun, 9 Dec 2012 07:02:21 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 6BD2521F8538 for ; Sun, 9 Dec 2012 07:02:21 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qB9F2JZO015869 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Sun, 9 Dec 2012 07:02:20 -0800 Message-ID: <50C4A7F8.3010201@dcrocker.net> Date: Sun, 09 Dec 2012 07:02:16 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> In-Reply-To: <50C1A95A.5000001@pscs.co.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Sun, 09 Dec 2012 07:02:20 -0800 (PST) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 15:02:24 -0000 On 12/7/2012 12:31 AM, Paul Smith wrote: > While I agree totally, I understand the OP's point about semi-tech-savvy > people being more trusting of Twitter mail coming from > 'bibble.twitter.com' than if it came from 'random.ru' Strange thread. Mostly seems to be based on using SPF in ways that it is not designed to be used. It's always problematic to criticize a technology for failing to provide services that it is not intended to provide. An essential point, above, is worrying about "semi-tech-savvy people". First, SPF is not for end-users. It is for receive-side operators and their filtering engines. Second, embedded technologies, like SPF, cannot be mail fool-proof against poor use by operators who misunderstand one or another aspect of the technology. Better software and better documentation are the best one can do for them. This thread seems a bit like worrying about the inability of an automobile braking system's failure to prevent the driver from running a red light. Absent a concise and compelling summary statement of the problem at issue here, I suggest terminating this fruitless thread. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From christian.grunfeld@gmail.com Sun Dec 9 07:43:12 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B03C221F87E1 for ; Sun, 9 Dec 2012 07:43:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.249 X-Spam-Level: X-Spam-Status: No, score=-3.249 tagged_above=-999 required=5 tests=[AWL=0.350, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6RVIzj1W9k4Q for ; Sun, 9 Dec 2012 07:43:11 -0800 (PST) Received: from mail-ie0-f176.google.com (mail-ie0-f176.google.com [209.85.223.176]) by ietfa.amsl.com (Postfix) with ESMTP id 8368021F8681 for ; Sun, 9 Dec 2012 07:43:11 -0800 (PST) Received: by mail-ie0-f176.google.com with SMTP id 13so5949502iea.7 for ; Sun, 09 Dec 2012 07:43:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=K5hBGavCyCSJO/eeNM0RcmNoslj8frfiOlWiqCsBs6I=; b=KmICVOBE30f7Qkt1jyBKC8/Zq4l/L2DO+pJqHHHqmIkegHTmdF2nCLi6KzjXHfhjRA 5kcLP7vN8LabHlvUAYiYC5tBhBagxDk3s6r0rKD/OtZdIhSeu7rsD1VS+rN7yWEAaTQx p+Jl3S6G7f/w9oc1lHWF41ohpKXsaPELUHIgXySXvRyDFkTjAXIys4SW0cHzCSUPYvOy 2J8gKqOtmYPoGtUX69xwdRE7ZLfj2Mkw1PiV+G5B2L1SznWuLTw0IhwNntMygupQM0zu B4f5lWKYe07jvGZZRtXmXjhwEQSC3JXxUpEtI/QoFrVg3gpbAB2ou5ymXeSm/zsXn1HC fq/w== MIME-Version: 1.0 Received: by 10.50.40.225 with SMTP id a1mr4251766igl.7.1355067790481; Sun, 09 Dec 2012 07:43:10 -0800 (PST) Received: by 10.231.65.79 with HTTP; Sun, 9 Dec 2012 07:43:10 -0800 (PST) In-Reply-To: <50C4A7F8.3010201@dcrocker.net> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> Date: Sun, 9 Dec 2012 12:43:10 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 15:43:12 -0000 2012/12/9 Dave Crocker : > Strange thread. Mostly seems to be based on using SPF in ways that it is > not designed to be used. It's always problematic to criticize a technology > for failing to provide services that it is not intended to provide. > An essential point, above, is worrying about "semi-tech-savvy people". > First, SPF is not for end-users. It is for receive-side operators and their > filtering engines. When operators believes that SPF and their filtering engines are well configurated but a forged email pass anyway (by means of this thread), it finally reaches a "semi-tech-savvy user" who is more trusting of Twitter mail coming from 'bibble.twitter.com' than if it came from 'random.ru'. None of us are saying that simple users deals with SPF directly ! > Second, embedded technologies, like SPF, cannot be mail fool-proof against > poor use by operators who misunderstand one or another aspect of the > technology. Better software and better documentation are the best one can > do for them. yes, this is a misunderstanding and I believe this is a good place to discuss, isn't it?....but I think is a misunderstanding of a huge part of the operators..excluding you of course ! From dhc@dcrocker.net Sun Dec 9 08:09:19 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4770B21F8C54 for ; Sun, 9 Dec 2012 08:09:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aiTm+t41TDGm for ; Sun, 9 Dec 2012 08:09:18 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id B059921F8C08 for ; Sun, 9 Dec 2012 08:09:18 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qB9G9F1U017080 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Sun, 9 Dec 2012 08:09:15 -0800 Message-ID: <50C4B7A7.90102@dcrocker.net> Date: Sun, 09 Dec 2012 08:09:11 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Sun, 09 Dec 2012 08:09:16 -0800 (PST) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 16:09:19 -0000 On 12/9/2012 7:43 AM, Christian Grunfeld wrote: > When operators believes that SPF and their filtering engines are well > configurated but a forged email pass anyway (by means of this thread), > it finally reaches a "semi-tech-savvy user" who is more trusting of > Twitter mail coming from 'bibble.twitter.com' than if it came from > 'random.ru'. None of us are saying that simple users deals with SPF > directly ! Anyone who believes that SPF can 'guarantee' that no forged mail will get delivered is suffering a very basic failure in their understanding. No changes to SPF can fix this. The best line of action is to develop better statements about what SPF does and does not do, rather than discuss SPF 'failings'. That is, try to help the understanding of operators. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From martijn.grooten@virusbtn.com Sun Dec 9 08:13:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF4E021F8C08 for ; Sun, 9 Dec 2012 08:13:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.74 X-Spam-Level: X-Spam-Status: No, score=-8.74 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mFofgV-gOcdf for ; Sun, 9 Dec 2012 08:13:37 -0800 (PST) Received: from mx6.sophos.com (mx6.sophos.com [195.171.192.176]) by ietfa.amsl.com (Postfix) with ESMTP id 4DAB721F8BE2 for ; Sun, 9 Dec 2012 08:13:37 -0800 (PST) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id DCF9375192B for ; Sun, 9 Dec 2012 16:13:32 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx6.sophos.com (Postfix) with ESMTPS id B114D751910 for ; Sun, 9 Dec 2012 16:13:32 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Sun, 9 Dec 2012 16:13:32 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgAALbQCAAAOZCg== Date: Sun, 9 Dec 2012 16:13:31 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net>, In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 16:13:38 -0000 > a forged email pass anyway A forged email using a subdomain for which no SPF record exists will pass t= he test checks against SPF fails, something which some spam-filters include= , as it's a cheap way to get rid of a chunk of spam. Such a forged email wi= ll NOT "pass" SPF. It is in theory possible that there is a incorrectly configured spam-filter= out there that gives you an easy ride if you use an SPF-less subdomain in = the SMTP envelope. I doubt this is the case, but if it does exist, please d= o tell its developers to fix their filter. > I think is a misunderstanding of a huge part > of the operators Is it? Have you evidence, even if it is only anecdotal, that such a misunde= rstanding exists? If so, as Dave said, we should consider writing better documentation. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From dhc@dcrocker.net Sun Dec 9 08:23:30 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F69C21F893C for ; Sun, 9 Dec 2012 08:23:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BpegDpWUJZMj for ; Sun, 9 Dec 2012 08:23:29 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 7E91F21F8821 for ; Sun, 9 Dec 2012 08:23:29 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qB9GNRHD017393 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Sun, 9 Dec 2012 08:23:28 -0800 Message-ID: <50C4BAFC.8040604@dcrocker.net> Date: Sun, 09 Dec 2012 08:23:24 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Sun, 09 Dec 2012 08:23:28 -0800 (PST) Subject: [Asrg] anti-abuse research statistics examples X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 16:23:30 -0000 Folks, I'm looking for some example studies that report abuse or anti-abuse statistics. That is, a series of examples having statistics in the abuse realm, with surrounding information to explain the need, benefit and meaning of the statistics. The types of studies I'd like to get are: 1. Simple study with basic statistics that are obviously useful. 2. Somewhat more complex study, with statistics that require some explanation, but don't require a math degree to comprehend. (I'm talking about comprehending the results, not the underlying calculations.) 3. Overly complicated study with questionable statistics. While trend-analysis seems most common, I need some that are more in an 'experimental' model, such as before/after testing. This type would use t-test, ANOVA or the like. Any suggestions? Feel free to just send any that seem plausible; don't edit. I'll figure out which ones make the most sense for my suggestion, as I develop it. Thanks. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From johnl@iecc.com Sun Dec 9 11:16:40 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5AA121F843B for ; Sun, 9 Dec 2012 11:16:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.306 X-Spam-Level: X-Spam-Status: No, score=-106.306 tagged_above=-999 required=5 tests=[AWL=0.593, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WrhXa2JvOlqd for ; Sun, 9 Dec 2012 11:16:40 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 06C0621F842C for ; Sun, 9 Dec 2012 11:16:39 -0800 (PST) Received: (qmail 44584 invoked from network); 9 Dec 2012 19:16:36 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 9 Dec 2012 19:16:36 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c4e394.xn--btvx9d.k1211; i=johnl@user.iecc.com; bh=sIXqkKonlFqnktUfsasjhmVMJ5zMXXjHI/PWTdU+hYk=; b=z7chItU1Qqoxd8CM3eO6VUlX5sTNl7jPAn2DG7oNkk5tScBOieDGojNc+QbyIdXdTjg27287xraPe4gUYOl6GYQtzGMkbOUA2o/U4SOpGG3WIBf3tFRjOsZAWUMJ51b9xwTzQDVWiWI2DkkR3eF9WDIuzSuClrgT7LdoY+o64v0= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c4e394.xn--btvx9d.k1211; olt=johnl@user.iecc.com; bh=sIXqkKonlFqnktUfsasjhmVMJ5zMXXjHI/PWTdU+hYk=; b=J8CAY9oHEKMno8Um8Fqujy8Jn28hEC4/F5ucL/ePagegEiqT5gGyPf4xw6WErag6b/qR3iVje7u36MF8mSH5/fo/4IQHM+6ZlNHwJF8Ysavllf33FEMcLpJJaOk6jfNWguWNFZacpPZChPI9HuoJs3iVlaNHLtIznXRP4xTSASQ= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 9 Dec 2012 19:16:14 -0000 Message-ID: <20121209191614.11143.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 19:16:40 -0000 >> a forged email pass anyway No antiforgery scheme can defend against fakes that only sort of match the forgery target. We call this the paypai problem. The only approach I can see that has any hope of success is to figure out some way to mark real mail from a category of targets (banks, say) in a way that bad guys can't fake. But this is specific to each target group. The fact that mail from me doesn't have a seal saying that it's from a bank doesn't mean that it's forged or otherwise bad. >> I think is a misunderstanding of a huge part of the operators > >Is it? Have you evidence, even if it is only anecdotal, that such a misunderstanding exists? I'm with Martijn. Other than the test message you sent the other day, I don't think I have ever seen a phish that used a subdomain of the target. Ever. From sethb@panix.com Sun Dec 9 13:33:09 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F72721F8CEF for ; Sun, 9 Dec 2012 13:33:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JbtIW0xaKBDU for ; Sun, 9 Dec 2012 13:33:08 -0800 (PST) Received: from mailbackend.panix.com (mailbackend.panix.com [166.84.1.89]) by ietfa.amsl.com (Postfix) with ESMTP id 9F30021F8CDB for ; Sun, 9 Dec 2012 13:33:08 -0800 (PST) Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mailbackend.panix.com (Postfix) with ESMTP id EAF892E847 for ; Sun, 9 Dec 2012 16:33:07 -0500 (EST) Received: by panix5.panix.com (Postfix, from userid 756) id D90C12429B; Sun, 9 Dec 2012 16:33:07 -0500 (EST) From: Seth To: Anti-Spam Research Group - IRTF In-reply-to: <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> (message from Martijn Grooten on Sun, 9 Dec 2012 16:13:31 +0000) References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net>, <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> Message-Id: <20121209213307.D90C12429B@panix5.panix.com> Date: Sun, 9 Dec 2012 16:33:07 -0500 (EST) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 21:33:09 -0000 Martijn Grooten wrote: > A forged email using a subdomain for which no SPF record exists will > pass the test checks against SPF fails, something which some > spam-filters include, as it's a cheap way to get rid of a chunk of > spam. Such a forged email will NOT "pass" SPF. There is no way for the owner of the overlying domain (who also owns the subdomain) to force such email to FAIL. There should be a way to specify "all valid email from this domain and subdomains comes only from this set of IPs and no others" and SPF fails to provide one. That's a weakness in the structure of SPF which ought to be fixed. Seth From christian.grunfeld@gmail.com Sun Dec 9 15:39:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A998C21F846B for ; Sun, 9 Dec 2012 15:39:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.307 X-Spam-Level: X-Spam-Status: No, score=-3.307 tagged_above=-999 required=5 tests=[AWL=0.292, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rCWy7Ui2sDiE for ; Sun, 9 Dec 2012 15:39:08 -0800 (PST) Received: from mail-ia0-f182.google.com (mail-ia0-f182.google.com [209.85.210.182]) by ietfa.amsl.com (Postfix) with ESMTP id 2DC8321F8681 for ; Sun, 9 Dec 2012 15:39:08 -0800 (PST) Received: by mail-ia0-f182.google.com with SMTP id x2so3994933iad.13 for ; Sun, 09 Dec 2012 15:39:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=8Mm9beYAhjcIc0npF248jAxKdznCBOoZttKomhjVvKs=; b=w7TKCvlKgSmez4asEkG8swhVQVVm946f1sAP38+/gMww1z00yLkBJEGhTxY3UX4IPb tN1fwaMTk1+yau+EAypVP6X3flMap5LlaBz8EG23rRYodV+2lykCgO92rwuNCSDy8li7 ewkyWHZtnWd/meX8U1CpbLPWx731jKBjn4Pv7S1pVpisuRIE6qThYMQHK4S+ZsY4ZcA+ Jjgs7SFb43WopqVSkC7DmmX+4ygX/3pUSL4FRj0+tLwLgRelbfiOp2884aUWINrWcAOU OmfhaHZNDMK8pZeh7Oppge687S7sgG0542HI8JbM/xIugjxL8IYFNi7HJGOwzW0TQU6D H3zg== MIME-Version: 1.0 Received: by 10.50.40.225 with SMTP id a1mr5083327igl.7.1355096347614; Sun, 09 Dec 2012 15:39:07 -0800 (PST) Received: by 10.231.65.79 with HTTP; Sun, 9 Dec 2012 15:39:07 -0800 (PST) In-Reply-To: <20121209213307.D90C12429B@panix5.panix.com> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> Date: Sun, 9 Dec 2012 20:39:07 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Dec 2012 23:39:08 -0000 > There is no way for the owner of the overlying domain (who also owns > the subdomain) to force such email to FAIL. There should be a way to > specify "all valid email from this domain and subdomains comes only > from this set of IPs and no others" and SPF fails to provide one. > That's a weakness in the structure of SPF which ought to be fixed. there is ! you have to publish your sending IPs and also your not sending IPs/hosts/subdomains. > I'm with Martijn. Other than the test message you sent the other day, > I don't think I have ever seen a phish that used a subdomain of the > target. Ever. ...so the "vulneravility" exists ! may be spammers don't know it yet ! don't you believe that a phish with these characteristics could be worse than other? At my institution I have told my users to check mail headers whenever possible. They are physicists ... the ones who invented the www time ago, so they have some skill level to do it. I always told them: do not believe in what you see in the From: also check the envelope and any hop in between ! ....but what will I say them when they=B4ll see mails "comming" from a subdomain of the real domain that the mail claims to be from and no checks failed? I personally think this kind of phishing worse than common ones! For the ones that said we are treating SPF as the FUSSP or the best solution...the answer is no ! I use SMTP level client checks, helo checks, sender checks, recipient checks, rate limits, SPF, DKIM, greylists, spamassassin, etc. SPF is only one of which we are discussing now a misconception, misunderstanding or what you prefer. We can also disscuss about any of the other methods. From johnl@iecc.com Sun Dec 9 16:12:22 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53D2921F887B for ; Sun, 9 Dec 2012 16:12:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.335 X-Spam-Level: X-Spam-Status: No, score=-106.335 tagged_above=-999 required=5 tests=[AWL=0.564, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FWd7ztodmoJT for ; Sun, 9 Dec 2012 16:12:21 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 770CB21F89CB for ; Sun, 9 Dec 2012 16:12:21 -0800 (PST) Received: (qmail 1664 invoked from network); 10 Dec 2012 00:12:19 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 10 Dec 2012 00:12:19 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c528e3.xn--3zv.k1211; i=johnl@user.iecc.com; bh=xjoso0V/BDaWch+mfO82L2oLUBNjbzkPGkPftjXeDUA=; b=PmZZb9hjg8U/LzMst76m0KfuAnIAHLwPMp4G6G/YPI+sNNEXyZdZ3RAHr1qgpvCuApbJ9hTiHQu5LzbIyNgxPzwWv0fw92jAYI12WTtYpBEi7f/xAidyI1B0MIxrfzmk8raSGzA7wAlvEBYnsQujNUGrSnx8ZBxZWGFlkw2vCSg= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c528e3.xn--3zv.k1211; olt=johnl@user.iecc.com; bh=xjoso0V/BDaWch+mfO82L2oLUBNjbzkPGkPftjXeDUA=; b=pyva7Pg/hCj7ZNHZrAh1M0okzAEmb2lUMyLKg46mfxLj+Alp3NV4yu64lkNKgB+U2s/BlAiVET3hTiGa1FE8yzaEk1zUtTGu+ej9zmvLmfYcudsRnex13Lu3P+Vk9XDKI/qFhTLlIv7mqwScVbNP8wCeCd/V7AzMfYCQ2Z7yYR4= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 10 Dec 2012 00:11:57 -0000 Message-ID: <20121210001157.20870.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <20121209213307.D90C12429B@panix5.panix.com> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 00:12:22 -0000 >There is no way for the owner of the overlying domain (who also owns >the subdomain) to force such email to FAIL. There should be a way to >specify "all valid email from this domain and subdomains comes only >from this set of IPs and no others" and SPF fails to provide one. >That's a weakness in the structure of SPF which ought to be fixed. How do you propose to implement it, other than tree climbing and gross hacks like the public suffix list? From johnl@iecc.com Sun Dec 9 16:17:16 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BCF121F8D92 for ; Sun, 9 Dec 2012 16:17:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.36 X-Spam-Level: X-Spam-Status: No, score=-106.36 tagged_above=-999 required=5 tests=[AWL=0.539, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1K0f2EYrlSOQ for ; Sun, 9 Dec 2012 16:17:15 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 4330621F8D95 for ; Sun, 9 Dec 2012 16:17:15 -0800 (PST) Received: (qmail 3035 invoked from network); 10 Dec 2012 00:17:14 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 10 Dec 2012 00:17:14 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c52a0a.xn--9vv.k1211; i=johnl@user.iecc.com; bh=PuZGlEFjcOfhnN0iQw3xtkXtrceY92ijhKh3Y5HccnM=; b=wLH2Nza9rGRF7datlg5Fu5vTdZVqVbL++D0W5+5dLPMg4QyyJ+oHo7+lZjmvJbNQGE4hmJ+YuJZq+ZbnR2wiA0xv2JvTks2oqIIDB6kiW7pZeYr/pyXFG+56NuWcxMh850LHcJN0w2PpZd8s9EDchiiX0lQ0m6hX0sXYJUwMZMs= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c52a0a.xn--9vv.k1211; olt=johnl@user.iecc.com; bh=PuZGlEFjcOfhnN0iQw3xtkXtrceY92ijhKh3Y5HccnM=; b=d75LdI2SZ1JKwrwVYR0RORGB+Qd0jNtEfwlWRNqRsFiM5nQOWsyRe1pWjr1+p9w71OgBVD40FEgDYFtsrIn0mClFk0ZR+t2WLpJFbTb6+WI9kLkygZUqe9Ijj8IjuCqebzKGoAbVPL91UCsuGL3WQfqVlTTc/l4y/DFH1VxbEwo= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 10 Dec 2012 00:16:52 -0000 Message-ID: <20121210001652.21070.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 00:17:16 -0000 >...so the "vulneravility" exists ! may be spammers don't know it yet ! >don't you believe that a phish with these characteristics could be >worse than other? No, I don't see any reason to think that www.paypal.com is more likely to fool users than paypaI.com. Because of the way that Paypal uses Akamai to distribute its load, adding a TXT record to www.paypal.com would be rather difficult. SPF has been around for about a decade. If this hack were useful, I think we can assume that spammers would use it. R's, John From franck@peachymango.org Sun Dec 9 20:34:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7C3A21F8DF1 for ; Sun, 9 Dec 2012 20:34:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_16=0.6] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdeqGZzjKX2x for ; Sun, 9 Dec 2012 20:34:38 -0800 (PST) Received: from smtp.01.com (smtp.01.com [199.36.142.181]) by ietfa.amsl.com (Postfix) with ESMTP id 3592C21F8DC7 for ; Sun, 9 Dec 2012 20:34:36 -0800 (PST) Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 79A763900C8 for ; Sun, 9 Dec 2012 22:34:35 -0600 (CST) X-Virus-Scanned: amavisd-new at smtp-out-2.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-2.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xu6Ctzoc1+FH for ; Sun, 9 Dec 2012 22:34:35 -0600 (CST) Received: from smtp.01.com (localhost.localdomain [127.0.0.1]) by smtp-out-2.01.com (Postfix) with ESMTP id 51DB539013F for ; Sun, 9 Dec 2012 22:34:35 -0600 (CST) Received: from mail-2.01.com (mail.01.com [172.18.30.178]) by smtp-out-2.01.com (Postfix) with ESMTP id 4C8A63900C8 for ; Sun, 9 Dec 2012 22:34:35 -0600 (CST) Date: Sun, 9 Dec 2012 22:34:35 -0600 (CST) From: Franck Martin To: Anti-Spam Research Group - IRTF Message-ID: <1915198247.6651.1355114075018.JavaMail.root@peachymango.org> In-Reply-To: <20121210001652.21070.qmail@joyce.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [69.28.149.29] X-Mailer: Zimbra 7.2.1_GA_2790 (ZimbraWebClient - FF3.0 (Mac)/7.2.1_GA_2790) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 04:34:38 -0000 This issue is handled by DMARC, as it can work on all subdomains with only one TXT record. If you try to do the same with SPF only, this may be complicated. But then DMARC p=reject is not for all. From martijn.grooten@virusbtn.com Mon Dec 10 00:43:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56B3321F8E66 for ; Mon, 10 Dec 2012 00:43:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.669 X-Spam-Level: X-Spam-Status: No, score=-9.669 tagged_above=-999 required=5 tests=[AWL=0.929, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B3v6TgrO6WpZ for ; Mon, 10 Dec 2012 00:43:47 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id C34FB21F8E58 for ; Mon, 10 Dec 2012 00:43:46 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id D5D69540B72 for ; Mon, 10 Dec 2012 08:43:44 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id B49CE540A08 for ; Mon, 10 Dec 2012 08:43:44 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 08:43:44 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtK Date: Mon, 10 Dec 2012 08:43:44 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com>, In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 08:43:48 -0000 > but what will I say them when they=B4ll see > mails "comming" from a subdomain of the real domain that the mail > claims to be from and no checks failed? As others have pointed out, SPF is not for end-users. If you desperately wa= nt them to make sense of SPF checks, make sure you tell them that not faili= ng SPF means exactly nothing; it definitely does not mean the emails passed= SPF, or anything else that should give you extra reason to assume the doma= in is not forged. If you believe they are really clever, you may consider telling them that i= n case of important emails, not passing SPF is a reason to be extra suspici= ous. But I personally wouldn't go there, even if the users had invented the= Internet. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From prvs=0691FCDE2A=paul@pscs.co.uk Mon Dec 10 01:40:16 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 884B921F8E1D for ; Mon, 10 Dec 2012 01:40:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kcNXU6iQcRgx for ; Mon, 10 Dec 2012 01:40:15 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id 46DDA21F8E18 for ; Mon, 10 Dec 2012 01:40:14 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP; Mon, 10 Dec 2012 09:52:46 -0000 Received: from [192.168.66.100] ([192.168.66.100]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP; Mon, 10 Dec 2012 09:21:37 -0000 Message-ID: <50C5A9A0.105@pscs.co.uk> Date: Mon, 10 Dec 2012 09:21:36 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com>, <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 09:40:16 -0000 On 10/12/2012 08:43, Martijn Grooten wrote: >> but what will I say them when they´ll see >> mails "comming" from a subdomain of the real domain that the mail >> claims to be from and no checks failed? > As others have pointed out, SPF is not for end-users. If you desperately want them to make sense of SPF checks, make sure you tell them that not failing SPF means exactly nothing; it definitely does not mean the emails passed SPF, or anything else that should give you extra reason to assume the domain is not forged. > > If you believe they are really clever, you may consider telling them that in case of important emails, not passing SPF is a reason to be extra suspicious. But I personally wouldn't go there, even if the users had invented the Internet. Well, it generally doesn't actually matter who an email is from - if you're just going to read it. It only matters if you're going to click on links in it, or open attachments. It doesn't really even matter who the email is from if you're going to click on links - all that matters is where those links go. If I get a forged email telling me to click on 'www.facebook.com', then what harm will it do - as long as the link REALLY is www.facebook.com. So, what we really need (AFAICS) is not a way to detect forged messages, but a way to check that links in the message go to where the user would expect them to go. So, two things: 1) I believe that any prime 'phishing target' (banks, Facebook, etc) should not put links in their emails - EVER. If you get an email from Facebook telling you you have new notifications, then the user should just go to Facebook independently. That way, you're pretty much protected from phishing emails. Unfortunately, this isn't going to happen, because users are generally too lazy, so want the emails they do get from Facebook etc to contain easy to click links/'buttons'. 2) A possible solution. Nothing amazingly clever, but AFAICS it would make it easier for users if it was implemented. I don't doubt it'll get shot down, but here goes... (this isn't the "final" description of the idea, given that its likely to get shot down. it's just a rough outline) - The mail receiver (MUA or a spam checker) gets the message, and either looks at the return path domain, or some other 'marker' in the email to find the 'canonical domain' (doesn't have to be encrypted or secret) - The mail received software checks a DNS record at that domain to see if they support this facility. (as a method of protecting against a DDOS against random companies) - The mail receiver software checks a certificate at the domain it found in the step above (eg by going to https://www., or some other). It checks that the certificate is a valid, CA signed certificate, and can thus, reasonably confidently, give an organisation name where this message purports to be from. It can display this to the user. - The mail receiver software then checks the links in the message against something at that domain - eg download a list of valid link hostnames from the domain (using https), or use a surbl-like check using that domain as the database, or whatever - The mail receiver software now has a bit more confidence that the email only contains links which the purported originator would approve of. Possible flaws I can see - the DNS/website of the phish target could be hacked. If that is done, then there's a bigger problem... - the certificate may show that the organisation is www.paypaI.com, because the phisher has got a certificate which only verifies the domain name, not the organisation. This may fool some users. Could we mandate certain types of certificate for this facility? - extra work by the receiving software. But, given that things like Thunderbird already look at email links and suggest that they may be dodgy, the extra load may be considered acceptable - possible DDOS vector against someone's DNS/web servers - if the phish target uses unprotected redirection URLs, those could be used to get around it - if the phish target doesn't know what domains they use, that could cause false positives - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From vesely@tana.it Mon Dec 10 03:13:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BF5521F8E7E for ; Mon, 10 Dec 2012 03:13:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.719 X-Spam-Level: X-Spam-Status: No, score=-4.719 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id flbjutv2sH1j for ; Mon, 10 Dec 2012 03:13:52 -0800 (PST) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id E33AA21F8D8E for ; Mon, 10 Dec 2012 03:13:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1355138030; bh=z0NUaZOqw4TfU3IDEpG+GI8276HaMVPi4ErDvE1RurY=; l=1796; h=Date:From:To:References:In-Reply-To; b=Az8L0cyhh/WGpur1VIoS1E3eTzcYhGk3v8olgIH/c/lxqiLtut9vLG6WNRB5wYclr Igvy9u/A7REhYMmwtMZIE/RQ8+P2E+xWxYP3Xe65QrNieyp4aKcRzvs0nuvs0sb/Om EmpSXDP45jxFaufc0XYrnrw7mG+xyhqYH40KaykI= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Mon, 10 Dec 2012 12:13:49 +0100 id 00000000005DC031.0000000050C5C3ED.00005C52 Message-ID: <50C5C3E4.3090901@tana.it> Date: Mon, 10 Dec 2012 12:13:40 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20121207204554.18364.qmail@joyce.lan> <50C38A37.8050602@tana.it> <20121208233809.GA9196@mx1.yitter.info> In-Reply-To: <20121208233809.GA9196@mx1.yitter.info> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 11:13:52 -0000 On Sun 09/Dec/2012 00:38:10 +0100 Andrew Sullivan wrote: > On Sat, Dec 08, 2012 at 07:43:03PM +0100, Alessandro Vesely wrote: > >> Aren't there generic (i.e. non spf-specific) DNS conventions for >> publishing such relationships? > > No, but comments on > http://tools.ietf.org/html/draft-sullivan-domain-origin-assert-02 > would be most welcome. Those SOPA records, at least in the "names-only" strategy, would be an easy way to lightheartedly use wildcard records so as to cover all the subdomains. I'm surprised there are no established hacks, such as capturing part of the SOA, as it might be part of a negative reply to a TXT query, e.g. RNAME =~ /hostmaster\.([-.a-z0-9]{2,63})/i. While RNAMEs may get filled in unwittingly of such use, SOPA is sound because of the clearness of its semantics. However, it is also true that its precise meaning depends on the kind of policy. One then has to turn to "port-and-scheme" strategy, and complicate the subject beyond ease of reach. In comparison, the overloaded-redirect hack has some nice properties: *semantics*: the same mail abuse team looks after both domains. *hierarchy*: a loop entails the setup is broken. *conciseness*: the vertex must be reachable withing 10 queries. *awareness*: SPF never suggested to use redirect for helo records, so anyone using it must be aware of it. For a more stringent check, it could be conceived as, say, redirect=_spf_policy_hack.master.tld. That doesn't address the OP concern about non-mailing subdomains, albeit in some cases it can. It just reduces the number of entries in a receiver's senders database. Since each of those entries is likely to cost some fraction of human operator's time, reducing them seems to be worth an extra lookup on each message. From martijn.grooten@virusbtn.com Mon Dec 10 05:48:49 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 763BE21F8E25 for ; Mon, 10 Dec 2012 05:48:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.134 X-Spam-Level: X-Spam-Status: No, score=-10.134 tagged_above=-999 required=5 tests=[AWL=0.465, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uocekMXPs7Ta for ; Mon, 10 Dec 2012 05:48:48 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id 80B7F21F8C02 for ; Mon, 10 Dec 2012 05:48:47 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 4A692540B55 for ; Mon, 10 Dec 2012 13:48:46 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id 5975A540B72 for ; Mon, 10 Dec 2012 13:48:08 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 13:47:19 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtKgAAmAwCAAClNow== Date: Mon, 10 Dec 2012 13:47:18 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com>, <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos>, <50C5A9A0.105@pscs.co.uk> In-Reply-To: <50C5A9A0.105@pscs.co.uk> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 13:48:49 -0000 Paul Smith wrote: > It doesn't really even matter who the email is from if you're going to > click on links - all that matters is where those links go. While not all bad things that can happen as a consequence of taking a fake = email to be real involve clicking links, I agree it would be very helpful i= f we could somehow determine the legitimacy of links at the MTA/MUA level. However, we can't. There are simply too many examples of bad links that mat= ch the sender's address (paypai being just one of them) and even more examp= les of 'good' links that don't match, that in general you can't tell from j= ust analysing the URL. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From dotzero@gmail.com Mon Dec 10 06:22:23 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF00321F8E74 for ; Mon, 10 Dec 2012 06:22:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gau70TXiwBhq for ; Mon, 10 Dec 2012 06:22:23 -0800 (PST) Received: from mail-ia0-f176.google.com (mail-ia0-f176.google.com [209.85.210.176]) by ietfa.amsl.com (Postfix) with ESMTP id 4AE9821F8C02 for ; Mon, 10 Dec 2012 06:22:23 -0800 (PST) Received: by mail-ia0-f176.google.com with SMTP id y26so1070363iab.35 for ; Mon, 10 Dec 2012 06:22:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=R2VYHvF4NpTQoLSfjN/DaJrCkanV/xrB1mibx8NH1sY=; b=w7liDC3icglLkEQf2tSbaH/aK30y+AxR9AweUb6Wt4v/7ovDMC8OQ2SGTcSSGbxBCy nrTPDW2ppPuJRRrGmvrOPlU7yOQ9qHY79DTD+EAXRmbL+e063CjkSGjXHTSXm/x4FNz0 ntPwK1ownK260msRYUSXLsN+qfuTTgRZtV0EjlPU3Sb/1MA7+TDxFrH6wwzsfNte5s7D gfOicsd/mOcWSW8GS+kQpx3rzcSRAp0nxbSlYTvfhF5AzZKwfOD4Bpi9U9wEfBSz9H2B MPqNaCCNqTMc4T6GX5QSeaAY+8qGKNnKMY3oJ14T0gd7Hra8n1yQg2ilbTLX7IRbzeeR irbA== MIME-Version: 1.0 Received: by 10.50.6.169 with SMTP id c9mr6765247iga.24.1355149342714; Mon, 10 Dec 2012 06:22:22 -0800 (PST) Received: by 10.64.110.138 with HTTP; Mon, 10 Dec 2012 06:22:22 -0800 (PST) In-Reply-To: References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> Date: Mon, 10 Dec 2012 09:22:22 -0500 Message-ID: From: Dotzero To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 14:22:23 -0000 On Sun, Dec 9, 2012 at 6:39 PM, Christian Grunfeld wrote: > > At my institution I have told my users to check mail headers whenever > possible. Not a very scalable solution for the community at large even if it were a good use of their time. >They are physicists ... the ones who invented the www time > ago, so they have some skill level to do it. I always told them: do > not believe in what you see in the From: also check the envelope and > any hop in between ! ....but what will I say them when they=B4ll see > mails "comming" from a subdomain of the real domain that the mail > claims to be from and no checks failed? > Is manually checking email headers a very good use of their time? How much does a physicist at CERN get paid? Are they trained at identifying forged headers? Mike From rsk@gsp.org Mon Dec 10 06:56:36 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF4C021F8501 for ; Mon, 10 Dec 2012 06:56:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.351 X-Spam-Level: X-Spam-Status: No, score=-6.351 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nBogog1bn4A1 for ; Mon, 10 Dec 2012 06:56:36 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id 3F31521F8500 for ; Mon, 10 Dec 2012 06:56:36 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qBAEuWEe030944 for ; Mon, 10 Dec 2012 09:56:34 -0500 (EST) Date: Mon, 10 Dec 2012 09:56:27 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121210145627.GA21217@gsp.org> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 14:56:36 -0000 On Mon, Dec 10, 2012 at 01:47:18PM +0000, Martijn Grooten wrote: > While not all bad things that can happen as a consequence of taking a > fake email to be real involve clicking links, I agree it would be very > helpful if we could somehow determine the legitimacy of links at the > MTA/MUA level. > > However, we can't. [...] Precisely. Moreover, there is no way to know that a link L, which is good/legitimate/wholesome/nutritious at the moment at which some piece of software examines it, will still be in that state at some later moment when a user accesses it. We see examples all day, every day, of sites that have been hijacked by attackers and now host malicious content where formerly there was something innocuous. I think this best approach to solving this problem is not to solve this problem. Hmmm...perhaps "best" is a poor choice of words, as what I'm about to suggest is, in practice, mediocre; but I'll stick with "best" because I think it's the best available. To wit: users should never follow "important" links in email. They should (for example) bookmark their bank's web site, and *always* use the bookmark. [1] Senders should never send "important" links in email, e.g., banks should not include URLs in their messages. I'll pause now while you all enjoy a hearty laugh at the prospect of both of these things happening. But the serious side is that the problem, as Martijn observes, is unsolvable with software, so if we want to truly deal with it, then (shudder) we need to deal with human behavior. And I really do know how hard that is: I often quote Marcus Ranum's Six Dumbest Ideas in Computer Security, and "Educating Users" is #5. But I don't think we have any better alternatives. Do we? ---rsk [1] Of course if the bookmark is altered by an attacker, they're already 0wned, so this is no worse. From christian.grunfeld@gmail.com Mon Dec 10 07:59:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8861E21F8529 for ; Mon, 10 Dec 2012 07:59:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.349 X-Spam-Level: X-Spam-Status: No, score=-3.349 tagged_above=-999 required=5 tests=[AWL=0.250, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lYXYYaMYZx6F for ; Mon, 10 Dec 2012 07:59:51 -0800 (PST) Received: from mail-ia0-f180.google.com (mail-ia0-f180.google.com [209.85.210.180]) by ietfa.amsl.com (Postfix) with ESMTP id A59BD21F8528 for ; Mon, 10 Dec 2012 07:59:51 -0800 (PST) Received: by mail-ia0-f180.google.com with SMTP id t4so4231998iag.11 for ; Mon, 10 Dec 2012 07:59:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=os3kpKHPz5NBZWyfT1ManRTyD5i4LBP0iujf/tON96I=; b=XuwBvQypP1zjlrtZxN063lAgu9kQOEvVQw6Om2AWZamO2Z1p6vjdpdEYF8FdtVWd2k bEMprroVLIIbbsZECUuyJiRX0lgPgSFcLleorn+mQ+PbVB9d0kjwBCN8RjLsujFBwFTL Jk/8q9ETZmfi7gFDR1Ig4tpdmjraepRkdke5Us6SFWNT5oDVyyDLqQY9xCrHMnbg5/mp yBnS+VURv5HUvhVjzIHP5/7qQMsJThREOoz+igUWirHfEFZRI/DKSOwUqrXV7/jUulux 4gJtrxNj0WdZZY61/V4f7Raz3QRkZAhEli23Qh3BbSk2SiTvFvWeRlAYOC173FnyX7yU g1fw== MIME-Version: 1.0 Received: by 10.50.13.133 with SMTP id h5mr7049925igc.2.1355155190776; Mon, 10 Dec 2012 07:59:50 -0800 (PST) Received: by 10.231.65.79 with HTTP; Mon, 10 Dec 2012 07:59:50 -0800 (PST) In-Reply-To: <20121210145627.GA21217@gsp.org> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> Date: Mon, 10 Dec 2012 12:59:50 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 15:59:52 -0000 I'm really surprised to see how discussions diverges on this list ! The problem statement is very simple: 1) How many people on this list saying that SPF is bad have TXT records published on their domains ? Why do you use it in real life and deplore it here ? 2) How many people on this list that use SPF have only one TXT record at the top domain and remain relaxed having [?~-]all, ignoring this thread ? I accept that some of you don't mind that a third party can use your subdomains to send forged emails claiming that are from you. I personally don't like that and applied the fix ! I repeat, this thread started discussing an SPF problem and then derived in a lot of other problems. We can discuss any, but please don't blame it on SPF of all of them ! over and out! From dhc@dcrocker.net Mon Dec 10 08:35:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4FBD21F8523 for ; Mon, 10 Dec 2012 08:35:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.551 X-Spam-Level: X-Spam-Status: No, score=-6.551 tagged_above=-999 required=5 tests=[AWL=0.048, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ac3TXaQs3V-Y for ; Mon, 10 Dec 2012 08:35:38 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 1D88121F84FC for ; Mon, 10 Dec 2012 08:35:38 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBAGZakI012512 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 08:35:37 -0800 Message-ID: <50C60F53.20608@dcrocker.net> Date: Mon, 10 Dec 2012 08:35:31 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 08:35:37 -0800 (PST) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 16:35:38 -0000 On 12/10/2012 6:22 AM, Dotzero wrote: > On Sun, Dec 9, 2012 at 6:39 PM, Christian Grunfeld > wrote: >> >> At my institution I have told my users to check mail headers whenever >> possible. > > Not a very scalable solution for the community at large even if it > were a good use of their time. It is much worse than merely being not scalable. It doesn't work at all, for anyone. Absent diligent and continuing training, human attention-related behavior decays rapidly, to a steady state that is, at best, highly erratic. Expecting /anyone/ to be attentive in the way described above is not realistic. Ever. For anyone. No matter their skill level. > Is manually checking email headers a very good use of their time? Right. This highlights that even if people could be expected to perform the task properly and always, it would be more expensive than it is worth. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From clewis+ietf@mustelids.ca Mon Dec 10 08:36:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1C9721F84FB for ; Mon, 10 Dec 2012 08:36:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZStLrRB1zf30 for ; Mon, 10 Dec 2012 08:36:48 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 5590B21F84CA for ; Mon, 10 Dec 2012 08:36:48 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBAGalon012826 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 10 Dec 2012 11:36:47 -0500 Message-ID: <50C60F9E.1060202@mustelids.ca> Date: Mon, 10 Dec 2012 11:36:46 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 16:36:48 -0000 On 12-12-10 10:59 AM, Christian Grunfeld, christian.grunfeld@gmail.com wrote: > I'm really surprised to see how discussions diverges on this list ! > > The problem statement is very simple: > > 1) How many people on this list saying that SPF is bad have TXT > records published on their domains ? Why do you use it in real life > and deplore it here ? Maybe they're experimenting with DMARC. Maybe they're listening to PHBs who insist on it. Maybe they wanted to get email into hotmail. Or simply that that it's useless, and it don't matter whether they have one or not. > 2) How many people on this list that use SPF have only one TXT record > at the top domain and remain relaxed having [?~-]all, ignoring this > thread ? See below > I accept that some of you don't mind that a third party can use your > subdomains to send forged emails claiming that are from you. I > personally don't like that and applied the fix ! You mean like this? _spf.google.com. 300 IN TXT "v=spf1 include:_netblocks.google.com ?all" From dhc@dcrocker.net Mon Dec 10 08:47:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B97521F8514 for ; Mon, 10 Dec 2012 08:47:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h3LnrwZskbAO for ; Mon, 10 Dec 2012 08:47:47 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id CDF4A21F850D for ; Mon, 10 Dec 2012 08:47:47 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBAGlULN012700 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 08:47:30 -0800 Message-ID: <50C6121D.9040607@dcrocker.net> Date: Mon, 10 Dec 2012 08:47:25 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> In-Reply-To: <20121210145627.GA21217@gsp.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 08:47:30 -0800 (PST) Subject: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 16:47:48 -0000 On 12/10/2012 6:56 AM, Rich Kulawiec wrote: > We see examples all day, every day, of sites > that have been hijacked by attackers and now host malicious content where > formerly there was something innocuous. ... > To wit: users should never follow "important" links in email. They > should (for example) bookmark their bank's web site, and *always* > use the bookmark. There is the kernel of an implementable idea here: 1. Create a whitelist of links the user employes regularly through its browser. For an extra measure of safety, query the user about how much they 'trust' the site associated with each link. (The question needs to be put to them with better language than asking about trust.) 2. Have the email client distinguish between links that are whitelisted and those that aren't. I don't have any idea how much incremental safety this actually would provide, but I think it's worthy of testing. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From dhc@dcrocker.net Mon Dec 10 08:48:14 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF9B521F8507 for ; Mon, 10 Dec 2012 08:48:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.554 X-Spam-Level: X-Spam-Status: No, score=-6.554 tagged_above=-999 required=5 tests=[AWL=0.045, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EVkOm7RxTm-5 for ; Mon, 10 Dec 2012 08:48:14 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 5451E21F850B for ; Mon, 10 Dec 2012 08:48:14 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBAGmDvo012715 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 08:48:13 -0800 Message-ID: <50C61248.8030903@dcrocker.net> Date: Mon, 10 Dec 2012 08:48:08 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 08:48:13 -0800 (PST) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 16:48:15 -0000 This posting demonstrates why the main line of this thread is useless. d/ On 12/10/2012 7:59 AM, Christian Grunfeld wrote: > I'm really surprised to see how discussions diverges on this list ! > > The problem statement is very simple: > > 1) How many people on this list saying that SPF is bad have TXT > records published on their domains ? Why do you use it in real life > and deplore it here ? > > 2) How many people on this list that use SPF have only one TXT record > at the top domain and remain relaxed having [?~-]all, ignoring this > thread ? > > I accept that some of you don't mind that a third party can use your > subdomains to send forged emails claiming that are from you. I > personally don't like that and applied the fix ! > > I repeat, this thread started discussing an SPF problem and then > derived in a lot of other problems. We can discuss any, but please > don't blame it on SPF of all of them ! > > over and out! > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg > -- Dave Crocker Brandenburg InternetWorking bbiw.net From christian.grunfeld@gmail.com Mon Dec 10 09:00:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CA4821F8532 for ; Mon, 10 Dec 2012 09:00:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.38 X-Spam-Level: X-Spam-Status: No, score=-3.38 tagged_above=-999 required=5 tests=[AWL=0.219, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N3huOw6lObua for ; Mon, 10 Dec 2012 09:00:51 -0800 (PST) Received: from mail-vb0-f54.google.com (mail-vb0-f54.google.com [209.85.212.54]) by ietfa.amsl.com (Postfix) with ESMTP id A60EF21F8528 for ; Mon, 10 Dec 2012 09:00:51 -0800 (PST) Received: by mail-vb0-f54.google.com with SMTP id l1so3526422vba.13 for ; Mon, 10 Dec 2012 09:00:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=UxqxRq/yBYlhlsQURwZGbQ55gYMQkZmVBTX6rPDgZ5A=; b=MegpptizEMyVJ2WQok2qRKxrD9TRV2QxrMsxVqsKe0Enbx+kWRQAt31bdAJ4z690eq M625okdnHIbv4CCoth9nZmN9g6vbbrbJ7HaMEDgc/IQxW0bPk/wMC+T4DVtcteHQle4A 4I75ah/fWdLaXZMqCXUWYBO/hFQJjiLXPGw2Gl5AUeOzjYUSoYsiNVD2O7vTDhTPiuR9 5ulVsUzQ4edTFDdMrJcaJDw9R8ALVdDnT6eyL/UlMsUgfR2IgETdvesZhY1wJkVPrrfi zIoXBOnacQPFk5FxUxb/uGlul8nvPpKDtEb9e35MvoTx48i6yy5IEMLSmcn+pAaJOFmz cGkg== MIME-Version: 1.0 Received: by 10.220.239.143 with SMTP id kw15mr9108989vcb.62.1355158850727; Mon, 10 Dec 2012 09:00:50 -0800 (PST) Received: by 10.58.235.131 with HTTP; Mon, 10 Dec 2012 09:00:50 -0800 (PST) In-Reply-To: <50C60F9E.1060202@mustelids.ca> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca> Date: Mon, 10 Dec 2012 14:00:50 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 17:00:52 -0000 2012/12/10 Chris Lewis : > You mean like this? > > _spf.google.com. 300 IN TXT "v=3Dspf1 include:_netblo= cks.google.com ?all" google=B4s domain for sending mail is gmail.com. gmail.com is a virtual domain with no subdomains (afaik) and is mapped onto google, so if you check the senders no aa@bb.gmail.com could pass even using SPF or not. as you said, if you dig: dig -t txt gmail.com ;; ANSWER SECTION: gmail.com. 244 IN TXT "v=3Dspf1 redirect=3D_spf.google.com" dig -t txt _spf.google.com ;; ANSWER SECTION: _spf.google.com. 300 IN TXT "v=3Dspf1 include:_netblocks.google.com ?all" if you dig a bit more: dig -t txt www.google.com you get no answer because there is not SPF record for www.google.com, so you can forge emails as if they come from www.google.com even if there exists an SPF record for google.com ! From prvs=0691FCDE2A=paul@pscs.co.uk Mon Dec 10 09:20:30 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BEF521F8557 for ; Mon, 10 Dec 2012 09:20:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id raXOt303frfN for ; Mon, 10 Dec 2012 09:20:29 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id BE6BC21F8552 for ; Mon, 10 Dec 2012 09:20:28 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP; Mon, 10 Dec 2012 17:32:55 -0000 Received: from [192.168.66.100] ([192.168.66.100]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP; Mon, 10 Dec 2012 17:10:58 -0000 Message-ID: <50C617A2.8090602@pscs.co.uk> Date: Mon, 10 Dec 2012 17:10:58 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> In-Reply-To: <50C6121D.9040607@dcrocker.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Cc: Dave Crocker Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 17:20:30 -0000 On 10/12/2012 16:47, Dave Crocker wrote: > > On 12/10/2012 6:56 AM, Rich Kulawiec wrote: >> We see examples all day, every day, of sites >> that have been hijacked by attackers and now host malicious content >> where >> formerly there was something innocuous. > ... >> To wit: users should never follow "important" links in email. They >> should (for example) bookmark their bank's web site, and *always* >> use the bookmark. > > > There is the kernel of an implementable idea here: > > 1. Create a whitelist of links the user employes regularly through > its browser. For an extra measure of safety, query the user about how > much they 'trust' the site associated with each link. (The question > needs to be put to them with better language than asking about trust.) > > 2. Have the email client distinguish between links that are > whitelisted and those that aren't. > > I don't have any idea how much incremental safety this actually would > provide, but I think it's worthy of testing. Surely this would be a browser feature (or 'Internet Security Software' feature) rather than an email client feature. The email client will not necessarily have any access to web browser history. The web browser should know that being called from an email client is 'different' from the user clicking on a bookmark or typing in a URL in the browser. Then, the browser could say to the user 'You've never accessed this site before, are you sure you want to do it?', or whatever The problem is that to have any idea of reputation you'd have to go on the hostname, not the full URL, as many email URLs will be 'unique' to have some tracking information in them (yes, I know it's bad, but you won't get banks to get rid of that, unfortunately), so each email will have different URLs in, even if the final destination is the same. So, the question is, is having a hostname reputation for the user better than having no reputation, or not? I'd say yes because it would probably catch 99% of the bad links that I see in phishing/spam, others would say no because it won't catch 100%. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From martijn.grooten@virusbtn.com Mon Dec 10 09:32:53 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4574821F8563 for ; Mon, 10 Dec 2012 09:32:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.289 X-Spam-Level: X-Spam-Status: No, score=-10.289 tagged_above=-999 required=5 tests=[AWL=0.310, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ud4csQnwn7QO for ; Mon, 10 Dec 2012 09:32:52 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id 86A2421F84CE for ; Mon, 10 Dec 2012 09:32:51 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 02924540C69 for ; Mon, 10 Dec 2012 17:32:50 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id C9D29540C60 for ; Mon, 10 Dec 2012 17:32:49 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 17:32:49 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtKgAAmAwCAAClNo4AANEKAgAARtQCAAApSAIAABrkAgAAC+7M= Date: Mon, 10 Dec 2012 17:32:48 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca>, In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 17:32:53 -0000 > so you can forge emails as if they come from www.google.com even if > there exists an SPF record for google.com ! You can also put go0gle[dot]com or googgle[dot]com in the envelope as neith= er have an SPF record. Heck, you can even use google.com, the SPF record of which only tells the r= eceiving MTA that it probably wasn't Google who sent the email, for it uses= ~all rather than -all. And even if it did use -all, it doesn't necessarily= mean that the email wouldn't get delivered as not all spam filters/MTAs bl= ock SPF fails. So the 'problem' you've stated is ONE OF MANY WAYS in which a forged email = can avoid being blocked by ONE OF MANY TESTS that is applied by SOME MTAs. = Incidentally, it is ONE OF MANY WAYS that could confuse an end user who is = looking at something most of us agree they shouldn't be looking in the firs= t place and that BARELY ANY END USER looks at. Unless you can finally come up with actual evidence that such emails are a)= more likely to be delivered than other emails claiming to come from the ta= rget domain AND b) are more likely to be taken for real by the average end = user, I think we're wasting our time here. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From martijn.grooten@virusbtn.com Mon Dec 10 09:49:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C97821F856E for ; Mon, 10 Dec 2012 09:49:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.367 X-Spam-Level: X-Spam-Status: No, score=-10.367 tagged_above=-999 required=5 tests=[AWL=0.232, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IKfQJPEwR52r for ; Mon, 10 Dec 2012 09:49:04 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id B07F221F8519 for ; Mon, 10 Dec 2012 09:49:03 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 7FC45540C6B for ; Mon, 10 Dec 2012 17:49:02 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id 58A23540C69 for ; Mon, 10 Dec 2012 17:49:02 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 17:49:02 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] whitelisting links (was Re: misconception in SPF) Thread-Index: AQHN1vYbjsWeST+ksEyDfvs1anZEDJgSRLgAgAAGNZk= Date: Mon, 10 Dec 2012 17:49:01 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD093A@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>,<50C617A2.8090602@pscs.co.uk> In-Reply-To: <50C617A2.8090602@pscs.co.uk> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 17:49:04 -0000 > 2. Have the email client distinguish between links that are > whitelisted and those that aren't. I'm with Paul in that I think the web browser and/or a web proxy is a more = appropriate place to do that. Other than the fact that they are simply better at anything web-related (th= ey can, for instance, do some heuristics on the actual content that's being= delivered by the web server), I'm worried that a "this link is fine" messa= ge displayed by a MUA is easily confused with "this email is fine", which I= don't think is desirable. Also, the overwhelming majority of websites are completely fine and harmles= s, yet most are probably too obscure to end up on some kind of whitelist, l= et alone a personalised one. So I think you're going to have a lot of colla= toral damage. Having said all this, maliciious links in email are a serious problem today= . Whenever I need a link to the Blackhole exploit kit for research purposes= , I simply dig into my spam folder and look for a fake Facebook/LinkedIn/Tw= itter/YouTube/UPS email. More often than not it contains such a link. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From darxus@chaosreigns.com Mon Dec 10 09:51:54 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A74721F850D for ; Mon, 10 Dec 2012 09:51:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HS_INDEX_PARAM=0.001, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gx4sWxi6536H for ; Mon, 10 Dec 2012 09:51:53 -0800 (PST) Received: from panic.chaosreigns.com (panic.chaosreigns.com [IPv6:2600:3c01::f03c:91ff:fe96:340b]) by ietfa.amsl.com (Postfix) with ESMTP id 94AF721F84E8 for ; Mon, 10 Dec 2012 09:51:52 -0800 (PST) Received: by panic.chaosreigns.com (Postfix, from userid 1000) id 3034CB3344; Mon, 10 Dec 2012 12:51:52 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=chaosreigns.com; s=mail; t=1355161912; bh=mWNpLA31S617JlFpuaeR6DdWdI/M6t21S37AHl69114=; h=Date:From:To:Subject:References:In-Reply-To; b=t4ydsI+ERhcVydQIHBAuKZaQRN84nNe5lOUAoOM3Ez5Uf6wrS01xCOGoLP1JpZVZH tOUf/xGWbROg0Jd6QS6Mzeib8Ae+7y/i/E3GVcXc2ddmBeetPZqvEqrkx7vie1tgTE 1/PyVfowwJP+bCLjh6H1QcdG0GtpsNtt9c1Rhzug= Date: Mon, 10 Dec 2012 12:51:52 -0500 From: darxus@chaosreigns.com To: asrg@irtf.org Message-ID: <20121210175152.GU12261@chaosreigns.com> References: <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50C6121D.9040607@dcrocker.net> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 17:51:54 -0000 On 12/10, Dave Crocker wrote: > 1. Create a whitelist of links the user employes regularly > through its browser. For an extra measure of safety, query the user > about how much they 'trust' the site associated with each link. If we could get that kind of information from end users, reliably, I don't think we'd have a spam problem. -- '1960: "I have a great idea! lets have every person in the country carry a radio tracking beacon!" "That'll never fly!" 2012: "I can has TWO iphones??"' - http://bash.org/?952948 http://www.ChaosReigns.com From lars@netapp.com Mon Dec 10 10:03:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 738FD21F8519 for ; Mon, 10 Dec 2012 10:03:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.53 X-Spam-Level: X-Spam-Status: No, score=-9.53 tagged_above=-999 required=5 tests=[AWL=1.069, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mUlEvT2kD4FG for ; Mon, 10 Dec 2012 10:03:04 -0800 (PST) Received: from mx2.netapp.com (mx2.netapp.com [216.240.18.37]) by ietfa.amsl.com (Postfix) with ESMTP id 8CCE221F84F6 for ; Mon, 10 Dec 2012 10:03:04 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.84,252,1355126400"; d="scan'208";a="717694942" Received: from smtp2.corp.netapp.com ([10.57.159.114]) by mx2-out.netapp.com with ESMTP; 10 Dec 2012 10:02:49 -0800 Received: from vmwexceht04-prd.hq.netapp.com (vmwexceht04-prd.hq.netapp.com [10.106.77.34]) by smtp2.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id qBAI2nVC015064 for ; Mon, 10 Dec 2012 10:02:49 -0800 (PST) Received: from SACEXCMBX01-PRD.hq.netapp.com ([169.254.2.26]) by vmwexceht04-prd.hq.netapp.com ([10.106.77.34]) with mapi id 14.02.0318.004; Mon, 10 Dec 2012 10:02:49 -0800 From: "Eggert, Lars" To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+udaYECIbK7/UmgEWD3FGd7iJgMuwKAgAASgwCAALs5AIADkeEA///nIX2AAKlHgIAAmCoAgAAKlACAAEo9AIAAE1KAgAARtQCAACJcAA== Date: Mon, 10 Dec 2012 18:02:49 +0000 Message-ID: References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.104.60.118] Content-Type: text/plain; charset="us-ascii" Content-ID: <0CF757DA7F5D82408F3CE13A528F6415@tahoe.netapp.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 18:03:05 -0000 On Dec 10, 2012, at 16:59, Christian Grunfeld wrote: > 2) How many people on this list that use SPF have only one TXT record > at the top domain and remain relaxed having [?~-]all, ignoring this > thread ? Tangential point, but maybe it's useful. All the raw data behind http://egg= ert.org/meter/spf is available. For example, the latest snapshot for SPF us= e by the IETF author community domain set is http://eggert.org/meter/data/2= 012-01-01@21:00-ietf-spf.txt Lars= From dcrocker@bbiw.net Mon Dec 10 10:05:12 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A90E21F8563 for ; Mon, 10 Dec 2012 10:05:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.413 X-Spam-Level: X-Spam-Status: No, score=-6.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yf0gN2cUO0WG for ; Mon, 10 Dec 2012 10:05:11 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id BA01C21F855D for ; Mon, 10 Dec 2012 10:05:11 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBAI5AtL014015 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 10:05:10 -0800 Message-ID: <50C62451.30608@bbiw.net> Date: Mon, 10 Dec 2012 10:05:05 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Paul Smith References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> In-Reply-To: <50C617A2.8090602@pscs.co.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 10:05:11 -0800 (PST) Cc: Dave Crocker , Anti-Spam Research Group - IRTF Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 18:05:12 -0000 On 12/10/2012 9:10 AM, Paul Smith wrote: > Surely this would be a browser feature (or 'Internet Security Software' > feature) rather than an email client feature. > > The email client will not necessarily have any access to web browser > history. Sorry. I was too cryptic. My suggestion was a whitelist that is shared with the browser and the MUA, vetted by the user. It's not about one agent calling the other but of a shared whitelist. (Bitdefender seems to have a feature that is related, which provides very distinctive controls over sites that are used for payment, like banks, based on a special list of such sites.) > The web browser should know that being called from an email client is > 'different' from the user clicking on a bookmark or typing in a URL in > the browser. Then, the browser could say to the user 'You've never > accessed this site before, are you sure you want to do it?', or whatever Development of the list could include various kinds of user consultation, yes. > The problem is that to have any idea of reputation you'd have to go on > the hostname, not the full URL, right. > So, the question is, is having a hostname reputation for the user better > than having no reputation, or not? I'd say yes because it would probably > catch 99% of the bad links that I see in phishing/spam, others would say > no because it won't catch 100%. +1 d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From martijn.grooten@virusbtn.com Mon Dec 10 10:23:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D51621F8506 for ; Mon, 10 Dec 2012 10:23:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M0pkcehy5YFU for ; Mon, 10 Dec 2012 10:23:45 -0800 (PST) Received: from mx4.sophos.com (mx4.sophos.com [216.47.234.213]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD4F21F84FC for ; Mon, 10 Dec 2012 10:23:43 -0800 (PST) Received: from mx4.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id DB03A4E03A0 for ; Mon, 10 Dec 2012 18:23:40 +0000 (GMT) Received: from abn-exch1b.green.sophos (abn-exch1b.green.sophos [10.100.70.62]) by mx4.sophos.com (Postfix) with ESMTPS id D673F4E0419 for ; Mon, 10 Dec 2012 18:23:32 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 18:23:31 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] whitelisting links (was Re: misconception in SPF) Thread-Index: AQHN1vYbjsWeST+ksEyDfvs1anZEDJgSRLgAgAARP0k= Date: Mon, 10 Dec 2012 18:23:31 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>,<50C617A2.8090602@pscs.co.uk> In-Reply-To: <50C617A2.8090602@pscs.co.uk> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 18:23:47 -0000 > I'd say yes because it would probably > catch 99% of the bad links that I see in phishing/spam No it would not, not even close to that. A lot of spam links to legitimate = but compromised domains. Note that just about any security vendors offers a web security product, wh= ich runs either inside the browser or at the corporate gateway. Most use a = combination of blacklists, whitelists and content-inspection. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From mike@mtcc.com Mon Dec 10 10:50:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70F5F21F855D for ; Mon, 10 Dec 2012 10:50:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B02GvJDwxL8u for ; Mon, 10 Dec 2012 10:50:37 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id C6E1021F862E for ; Mon, 10 Dec 2012 10:50:30 -0800 (PST) Received: from piolinux.mtcc.com (63-171-70-53.dsl.volcano.net [63.171.70.53] (may be forged)) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id qBAIoKwq016282 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 10 Dec 2012 10:50:21 -0800 Message-ID: <50C62EE8.7010908@mtcc.com> Date: Mon, 10 Dec 2012 10:50:16 -0800 From: Michael Thomas User-Agent: Thunderbird 2.0.0.14 (X11/20080501) MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <50C62451.30608@bbiw.net> In-Reply-To: <50C62451.30608@bbiw.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=729; t=1355165422; x=1356029422; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20Re=3A=20[Asrg]=20whitelisting=20links=20(was=20 Re=3A=20=20misconception=20in=20SPF) |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=yYbmM/xd9TI4w6NRW0NfmoUF7Hr5TOtctGAULncoxNM=; b=tB4+f5gSClGwCfOmJDlHYE/aUGq30nQDZn+YHTxFb5WumoACrdjEprnQGJ 3rrrmNEGBv4JejXMAT/YQcYN9o45EaU+ORS+DSrBkdWfZJVJVnGZnp374Tp+ hz2fwnKOxM1xrjWhqABbYbr8Lgmihv8yetQ6lXCP5XMfe+BbXg5T0=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Cc: Dave Crocker Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 18:50:38 -0000 Dave Crocker wrote: > > > On 12/10/2012 9:10 AM, Paul Smith wrote: >> Surely this would be a browser feature (or 'Internet Security Software' >> feature) rather than an email client feature. >> >> The email client will not necessarily have any access to web browser >> history. > > Sorry. I was too cryptic. My suggestion was a whitelist that is shared > with the browser and the MUA, vetted by the user. It's not about one We thought of this 5-6 years ago and even filed ipr on it as I recall. But that was in a time when people mostly had one desktop/laptop. I would think that the advent of phones, tablets, etc would significantly increase the complexity and most likely false-positive rate. Mike From johnl@iecc.com Mon Dec 10 11:24:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F2B921F85D5 for ; Mon, 10 Dec 2012 11:24:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.384 X-Spam-Level: X-Spam-Status: No, score=-106.384 tagged_above=-999 required=5 tests=[AWL=0.515, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y8FRmHRmLRM7 for ; Mon, 10 Dec 2012 11:24:28 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id E381321F8608 for ; Mon, 10 Dec 2012 11:24:27 -0800 (PST) Received: (qmail 33529 invoked from network); 10 Dec 2012 19:24:26 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 10 Dec 2012 19:24:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c636ea.xn--hew.k1212; i=johnl@user.iecc.com; bh=FfwV1/+0Cx9vOfRBPq4rdO/e4l74nEIO+4A+Y2tP5FQ=; b=ITOll3eMJqe9GNvUzvgAGbohgk5OCydmOC+fRwSOGlegrf7A1uKiEygqwnTNHtG/2tdmMczhBF6PQN026QUHvabnLZyXafmsRJ4GDHom/nTj1OowFDx5dkl1Pa7LvieD6M81b3rtkdr1sXsIahI83oERI5aHDeNkHYsB3htDEyE= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c636ea.xn--hew.k1212; olt=johnl@user.iecc.com; bh=FfwV1/+0Cx9vOfRBPq4rdO/e4l74nEIO+4A+Y2tP5FQ=; b=Jg+ncPFrqQbS2CXS/BHt9dFjUyrd70KjLxlj1fErFuFe6MG0uN/CUoKBtXixI7JvjmcmgaWB4Yl5dZsnFKJSxBz4JWjvpm+AphBjAoJctKMr30pqbQvWAb0cU6diZVSuS/AqtnDl3MyZ0CfNXLeUcgNqbki6MNaGaqDCEdyDKDQ= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 10 Dec 2012 19:24:04 -0000 Message-ID: <20121210192404.64983.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 19:24:29 -0000 >gmail.com is a virtual domain with no subdomains (afaik) www.gmail.com at least, probably others. Really, you know, there's a lot of expertise on this list, and if we unanimously say that something is a bad idea, you might want to at least momentarily contemplate the possibility that it really is a bad idea. From clewis+ietf@mustelids.ca Mon Dec 10 12:09:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DC7221F867A for ; Mon, 10 Dec 2012 12:09:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.548 X-Spam-Level: X-Spam-Status: No, score=-0.548 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, GB_ABOUTYOU=0.5, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YeXF97F+E6Pt for ; Mon, 10 Dec 2012 12:09:05 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 75F9D21F866D for ; Mon, 10 Dec 2012 12:09:04 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBAK903w003724 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 10 Dec 2012 15:09:00 -0500 Message-ID: <50C6415C.1020004@mustelids.ca> Date: Mon, 10 Dec 2012 15:09:00 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 20:09:05 -0000 On 12-12-10 12:00 PM, Christian Grunfeld wrote: > you get no answer because there is not SPF record for www.google.com, > so you can forge emails as if they come from www.google.com even if > there exists an SPF record for google.com ! The point was about your #2. Those using ?all. Eg: you. People don't use !all, for the same reason gmail (you) uses ?all. With that huge problem in the way, trying to solve . doesn't seem very useful. The "solution" of publishing SPF records for all A'd hosts works sometimes, but sometimes it just doesn't scale. Just imagine how many hostnames that Google and Gmail have between them. From prvs=0691FCDE2A=paul@pscs.co.uk Mon Dec 10 12:30:22 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A658621F864D for ; Mon, 10 Dec 2012 12:30:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FY+bbC1VP0jP for ; Mon, 10 Dec 2012 12:30:22 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id B263F21F8646 for ; Mon, 10 Dec 2012 12:30:20 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP for ; Mon, 10 Dec 2012 20:42:56 -0000 Received: from [192.168.57.155] ([217.155.61.157]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP for ; Mon, 10 Dec 2012 20:24:29 -0000 Message-ID: <50C644F6.3090901@pscs.co.uk> Date: Mon, 10 Dec 2012 20:24:22 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>,<50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 20:30:22 -0000 On 10/12/2012 18:23, Martijn Grooten wrote: >> I'd say yes because it would probably >> catch 99% of the bad links that I see in phishing/spam > No it would not, not even close to that. A lot of spam links to legitimate but compromised domains. Maybe - but most of those compromised domains are not domains which the user would normally go to. So, even if the link is to a 'legitimate' domain, the vast majority would be to domains which the user does not recognise. So, it would catch those. Remember, the idea wasn't to have a 'global' list of 'good domains', but ones which the *user* has whitelisted, so the user recognises them. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From steve@blighty.com Mon Dec 10 12:41:50 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44F1721F851E for ; Mon, 10 Dec 2012 12:41:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdSiqX-f2L+i for ; Mon, 10 Dec 2012 12:41:49 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id AD52621F8512 for ; Mon, 10 Dec 2012 12:41:49 -0800 (PST) Received: from [192.168.80.21] (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id B65E22E192 for ; Mon, 10 Dec 2012 12:41:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1355172107; bh=Dg2kQxtivaSZpF5JjUxaWP7Sg28SoYrVg2JokLOM7bw=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=nF0oDiDW/debrEzmqZQdc9BL+DfD2xCkaMjMtSTxdvKW3nLfQEV+IcfnER+7zyw9u Z66iaPy7ASCxF1ZHAlyJC8x685WRxz0/tLgDhini8vbBw+G7sre1BV50yG1bcB4EjV 2n/gYfppUQ6zwjys4zNXbOEqt/Ff9rf//PI7c/aw= Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Steve Atkins In-Reply-To: <50C644F6.3090901@pscs.co.uk> Date: Mon, 10 Dec 2012 12:41:44 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <69AD22AF-9494-44EB-AC86-75ED04E7AE3A@blighty.com> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>, <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1499) Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 20:41:50 -0000 On Dec 10, 2012, at 12:24 PM, Paul Smith wrote: > On 10/12/2012 18:23, Martijn Grooten wrote: >>> I'd say yes because it would probably >>> catch 99% of the bad links that I see in phishing/spam >> No it would not, not even close to that. A lot of spam links to = legitimate but compromised domains. > Maybe - but most of those compromised domains are not domains which = the user would normally go to. >=20 > So, even if the link is to a 'legitimate' domain, the vast majority = would be to domains which the user does not recognise. So, it would = catch those. >=20 > Remember, the idea wasn't to have a 'global' list of 'good domains', = but ones which the *user* has whitelisted, so the user recognises them. If it's user managed - rather than managed by a third party that = actually keeps track of who is a bank and who isn't - I'd guess it'd = just lead to meta-phishing, where the goal is to get the user to add a = link to their whitelist, rather than having them click on a link. Cheers, Steve From martijn.grooten@virusbtn.com Mon Dec 10 12:48:18 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9957B21F868E for ; Mon, 10 Dec 2012 12:48:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.413 X-Spam-Level: X-Spam-Status: No, score=-10.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O5vFFJ8RUqXb for ; Mon, 10 Dec 2012 12:48:18 -0800 (PST) Received: from mx6.sophos.com (mx6.sophos.com [195.171.192.176]) by ietfa.amsl.com (Postfix) with ESMTP id 40A1521F8646 for ; Mon, 10 Dec 2012 12:48:14 -0800 (PST) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 661C775189B for ; Mon, 10 Dec 2012 20:48:12 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx6.sophos.com (Postfix) with ESMTPS id 39262751794 for ; Mon, 10 Dec 2012 20:48:12 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 20:48:12 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] whitelisting links (was Re: misconception in SPF) Thread-Index: AQHN1vYbjsWeST+ksEyDfvs1anZEDJgSRLgAgAARP0mAACTKAIAAAl5z Date: Mon, 10 Dec 2012 20:48:11 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>,<50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos>, <50C644F6.3090901@pscs.co.uk> In-Reply-To: <50C644F6.3090901@pscs.co.uk> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 20:48:18 -0000 > Remember, the idea wasn't to have a 'global' list of 'good domains', but > ones which the *user* has whitelisted, so the user recognises them. OK - I see what is meant now. Still, how often does the average user visit a domain they've not visited b= efore? For if they constantly have to approve 'new' websites, they're eithe= r going to turn the warnings off or they're going to ignore them, which def= eats the point. Note that it is not uncommon for example.com to use iframes that load stuff= from the apparently unrelated example.org. This is also commonly used by m= alicious sites. If a user visits a 'new' site using iframes, should such a = system warn against all the domains used by the iframes? Again, there are a lot of web filters already out there. Can someone explai= n either why the problem we're trying to solve here is different than the o= ne they attempt to solve or, if it isn't, why our solution will be better? Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From dhc@dcrocker.net Mon Dec 10 13:36:17 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A77421F8654 for ; Mon, 10 Dec 2012 13:36:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.556 X-Spam-Level: X-Spam-Status: No, score=-6.556 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0S--MpwgGdvi for ; Mon, 10 Dec 2012 13:36:11 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 1854721F84FC for ; Mon, 10 Dec 2012 13:36:11 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBALa78c017666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 13:36:07 -0800 Message-ID: <50C655C7.20105@dcrocker.net> Date: Mon, 10 Dec 2012 13:36:07 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>, <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <69AD22AF-9494-44EB-AC86-75ED04E7AE3A@blighty.com> In-Reply-To: <69AD22AF-9494-44EB-AC86-75ED04E7AE3A@blighty.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 13:36:08 -0800 (PST) Cc: Steve Atkins Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 21:36:17 -0000 On 12/10/2012 12:41 PM, Steve Atkins wrote: > > On Dec 10, 2012, at 12:24 PM, Paul Smith wrote: >> Remember, the idea wasn't to have a 'global' list of 'good >> domains', but ones which the *user* has whitelisted, so the user >> recognises them. > > If it's user managed - rather than managed by a third party that > actually keeps track of who is a bank and who isn't - I'd guess it'd > just lead to meta-phishing, where the goal is to get the user to add > a link to their whitelist, rather than having them click on a link. Fair point. that's probably why an independent list, such as Bitdefender seems to use, is probably the right approach. I could imagine, however, some possible benefit in keeping track of which entries in the list a particular user tends to go to. Such as one or a few banks versus others. On 12/10/2012 12:48 PM, Martijn Grooten wrote: > Again, there are a lot of web filters already out there. Can someone > explain either why the problem we're trying to solve here is > different than the one they attempt to solve or, if it isn't, why our > solution will be better? I'm not sure it is 'different' but possibly 'in addition'. I'm suggesting integration with the MUA. And to be clear, I'm not clear about the details. I'm merely offering a very basic idea. The precise details, nevermind determining actual efficacy, would be TBD. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From martijn.grooten@virusbtn.com Mon Dec 10 14:50:14 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F40FB21F86C0 for ; Mon, 10 Dec 2012 14:50:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.444 X-Spam-Level: X-Spam-Status: No, score=-10.444 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xLIh35HqvtEO for ; Mon, 10 Dec 2012 14:50:11 -0800 (PST) Received: from mx6.sophos.com (mx6.sophos.com [195.171.192.176]) by ietfa.amsl.com (Postfix) with ESMTP id E2B3321F86AA for ; Mon, 10 Dec 2012 14:50:10 -0800 (PST) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id CBD08751910 for ; Mon, 10 Dec 2012 22:50:09 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx6.sophos.com (Postfix) with ESMTPS id 9155A751742 for ; Mon, 10 Dec 2012 22:50:09 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 22:50:09 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] whitelisting links (was Re: misconception in SPF) Thread-Index: AQHN1vYbjsWeST+ksEyDfvs1anZEDJgSRLgAgAARP0mAACTKAIAABNoAgAAPMoCAAAkTsA== Date: Mon, 10 Dec 2012 22:50:08 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD7425@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>, <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <69AD22AF-9494-44EB-AC86-75ED04E7AE3A@blighty.com>, <50C655C7.20105@dcrocker.net> In-Reply-To: <50C655C7.20105@dcrocker.net> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Dec 2012 22:50:14 -0000 > I could > imagine, however, some possible benefit in keeping track of which > entries in the list a particular user tends to go to. Such as one or a > few banks versus others. Ah yes, I can see that being useful in a scoring filter. I'm not sure many = web-filters work that way; I think most are pretty black and white (or, rat= her, black and non-black). > I'm not sure it is 'different' but possibly 'in addition'. I'm > suggesting integration with the MUA. And to be clear, I'm not clear > about the details. I'm merely offering a very basic idea. The precise > details, nevermind determining actual efficacy, would be TBD. Thanks for the clarification. I'm still sceptical about integration of MUA and browser/web-filter being o= f actual use, but I'll leave it for others to pursue and to prove me wrong. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From christian.grunfeld@gmail.com Mon Dec 10 19:36:13 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9042A21F8746 for ; Mon, 10 Dec 2012 19:36:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.105 X-Spam-Level: X-Spam-Status: No, score=-3.105 tagged_above=-999 required=5 tests=[AWL=-0.106, BAYES_00=-2.599, J_CHICKENPOX_32=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKrQ4EUhxu8y for ; Mon, 10 Dec 2012 19:36:12 -0800 (PST) Received: from mail-ia0-f182.google.com (mail-ia0-f182.google.com [209.85.210.182]) by ietfa.amsl.com (Postfix) with ESMTP id A834021F873F for ; Mon, 10 Dec 2012 19:36:12 -0800 (PST) Received: by mail-ia0-f182.google.com with SMTP id x2so6868755iad.13 for ; Mon, 10 Dec 2012 19:36:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=5ws5yJIgHgieaL5TALDKTFTeqOWHCJiVgS4H17w8jaQ=; b=y/wkFY318gJuwT3gWUwWoQpf+Ap50XNgG+1oG35ZPZshf/Wj0N4czdRhd3jcDKPUfB +LbyLXuUC7mSfOjSchSxdi9m0OrxeZhj29wI4Cyj3NaVFFpkQW2QVfXrJVC4IA7LN+nu F+qbOLy0aRALs+/hIEg1zxTueLakWR1JnanaGNj3Nco3ZgLSB+13bSnLtDITxlR1zE6l N60yD5eKFPHbCDoxs+fDwdOfxHuyum+ZeZLKWOXoK+SybrCBTbCIf4QkJVXEnCU5XxJv Q3upJApmrMSj8JaNontv2abh2KmT7ctcA4vYhodWIIQaR/0+xfciQzhVSGbdgFeyE3pB tB1A== MIME-Version: 1.0 Received: by 10.42.57.11 with SMTP id b11mr12917635ich.15.1355196972101; Mon, 10 Dec 2012 19:36:12 -0800 (PST) Received: by 10.231.65.79 with HTTP; Mon, 10 Dec 2012 19:36:11 -0800 (PST) In-Reply-To: <50C617A2.8090602@pscs.co.uk> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> Date: Tue, 11 Dec 2012 00:36:11 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 03:36:13 -0000 a few hours ago a dozen people kill me on the list because I told my users to check hostnames on email headers. You said that end users don't have the skill level or the time to do it. Now, a "great idea" of making a whitelist of what users click on their email and also asking them why they click what they click comes! How do you treat shortened/obfuscated/tracking urls? You are underestimating phishers as if they write links like http://www.google.com. A link to the same location can be http://bit.ly/someobfuscatedstring. And you are also overestimating the end users as if they were "matrix operators". The user can simply answer you: "I trust it because the link takes me to google" What domain/hostname do you use in reputation? bit.ly ? This "whitelist" can be poisoned by sending a first email pointing to the good location. Then you add bit.ly to your list ....then I send a second email pointing to an evil location ! C. P.S for those with linear reasoning, stop before writing "people should use www.google.com when they want to go to www.google.com". It was an example ! 2012/12/10 Paul Smith : > On 10/12/2012 16:47, Dave Crocker wrote: >> >> >> On 12/10/2012 6:56 AM, Rich Kulawiec wrote: >>> >>> We see examples all day, every day, of sites >>> that have been hijacked by attackers and now host malicious content where >>> formerly there was something innocuous. >> >> ... >>> >>> To wit: users should never follow "important" links in email. They >>> should (for example) bookmark their bank's web site, and *always* >>> use the bookmark. >> >> >> >> There is the kernel of an implementable idea here: >> >> 1. Create a whitelist of links the user employes regularly through its >> browser. For an extra measure of safety, query the user about how much they >> 'trust' the site associated with each link. (The question needs to be put >> to them with better language than asking about trust.) >> >> 2. Have the email client distinguish between links that are >> whitelisted and those that aren't. >> >> I don't have any idea how much incremental safety this actually would >> provide, but I think it's worthy of testing. > > Surely this would be a browser feature (or 'Internet Security Software' > feature) rather than an email client feature. > > The email client will not necessarily have any access to web browser > history. > > The web browser should know that being called from an email client is > 'different' from the user clicking on a bookmark or typing in a URL in the > browser. Then, the browser could say to the user 'You've never accessed this > site before, are you sure you want to do it?', or whatever > > The problem is that to have any idea of reputation you'd have to go on the > hostname, not the full URL, as many email URLs will be 'unique' to have some > tracking information in them (yes, I know it's bad, but you won't get banks > to get rid of that, unfortunately), so each email will have different URLs > in, even if the final destination is the same. > > So, the question is, is having a hostname reputation for the user better > than having no reputation, or not? I'd say yes because it would probably > catch 99% of the bad links that I see in phishing/spam, others would say no > because it won't catch 100%. > > > > - > > Paul Smith Computer Services > Tel: 01484 855800 > Vat No: GB 685 6987 53 > > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg From dhc@dcrocker.net Mon Dec 10 20:33:51 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8B5221F8632 for ; Mon, 10 Dec 2012 20:33:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.557 X-Spam-Level: X-Spam-Status: No, score=-6.557 tagged_above=-999 required=5 tests=[AWL=0.042, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L1G-tVmem7Ig for ; Mon, 10 Dec 2012 20:33:51 -0800 (PST) Received: from sbh17.songbird.com (sbh17.songbird.com [72.52.113.17]) by ietfa.amsl.com (Postfix) with ESMTP id 2F04021F84FE for ; Mon, 10 Dec 2012 20:33:51 -0800 (PST) Received: from [192.168.1.9] (adsl-67-127-190-125.dsl.pltn13.pacbell.net [67.127.190.125]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id qBB4Xm28023328 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 10 Dec 2012 20:33:48 -0800 Message-ID: <50C6B7AC.4040006@dcrocker.net> Date: Mon, 10 Dec 2012 20:33:48 -0800 From: Dave Crocker Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Mon, 10 Dec 2012 20:33:49 -0800 (PST) Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: dcrocker@bbiw.net, Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 04:33:51 -0000 On 12/10/2012 7:36 PM, Christian Grunfeld wrote: > a few hours ago a dozen people kill me on the list because I told my > users to check hostnames on email headers. You said that end users > don't have the skill level or the time to do it. > > Now, a "great idea" of making a whitelist of what users click on their > email and also asking them why they click what they click comes! Please re-read the thread more carefully. You apparently misunderstood both lines of discussion. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net From clewis+ietf@mustelids.ca Mon Dec 10 20:59:35 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16DC021F8706 for ; Mon, 10 Dec 2012 20:59:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.798 X-Spam-Level: X-Spam-Status: No, score=-0.798 tagged_above=-999 required=5 tests=[AWL=0.250, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CWHBT3Puo6O4 for ; Mon, 10 Dec 2012 20:59:34 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 6B0F621F86FE for ; Mon, 10 Dec 2012 20:59:34 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBB4xUno029783 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 10 Dec 2012 23:59:31 -0500 Message-ID: <50C6BDB2.1010407@mustelids.ca> Date: Mon, 10 Dec 2012 23:59:30 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>, <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos>, <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 04:59:35 -0000 On 12-12-10 03:48 PM, Martijn Grooten wrote: >> Remember, the idea wasn't to have a 'global' list of 'good domains', but >> ones which the *user* has whitelisted, so the user recognises them. > > OK - I see what is meant now. > > Still, how often does the average user visit a domain they've not visited before? For if they constantly have to approve 'new' websites, they're either going to turn the warnings off or they're going to ignore them, which defeats the point. > Note that it is not uncommon for example.com to use iframes that load stuff from the apparently unrelated example.org. This is also commonly used by malicious sites. If a user visits a 'new' site using iframes, should such a system warn against all the domains used by the iframes? Sounds somewhat like the "noscript" firefox plugin. I think it works in more than just firefox. It won't execute javascript or iframes _unless_ you whitelist the site they come from, either temporarily (for the current session) or permanently. There's a fairly well-developed mechanism for selecting which sites you wish to whitelist. It works pretty well. It has the added advantage that you can, say, visit websites and "choose" not to participate in things like doubleclick tracking or advertisements from other sites by not approving them. It's truly remarkable how one URL can trigger javascript bits from dozens of different places. It does mean that some first-time visits to a web site can sometimes be very noisy. But it's less awkward than it sounds. And you may get yourself somewhat habituated into recognizing "hey, it threw alerts on a site that didn't before. Oh gee, different spelling". I use it. From vesely@tana.it Mon Dec 10 23:52:55 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FF3521F84D8 for ; Mon, 10 Dec 2012 23:52:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.719 X-Spam-Level: X-Spam-Status: No, score=-4.719 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g5OG-KWdY3EX for ; Mon, 10 Dec 2012 23:52:53 -0800 (PST) Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id B1EDD21F84D5 for ; Mon, 10 Dec 2012 23:52:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1355212371; bh=OA+8mqZwiDqTeW1iuOF96JJsOWVHSGWosDT62gJao2A=; l=472; h=Date:From:To:References:In-Reply-To; b=eq07xmmrzOgo87JNsIGJVjqGNz0hNyQRxjzKqvMeFAURqwIcUioWwO21Y2itVPoR+ KGKkcz53uciecwDTROMQIOkmgRqdx1ERfiHGszdX+1DwrxuLL9JaiuSSYCjCYTuxOn +YonRdwHq0TgrJacbPWFocwdWfZy8DBvTlB6dYsI= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Tue, 11 Dec 2012 08:52:50 +0100 id 00000000005DC035.0000000050C6E652.000044F3 Message-ID: <50C6E652.7010401@tana.it> Date: Tue, 11 Dec 2012 08:52:50 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca>, <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos> In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 07:52:55 -0000 On Mon 10/Dec/2012 18:32:48 +0100 Martijn Grooten wrote: > > Heck, you can even use google.com, the SPF record of which only > tells the receiving MTA that it probably wasn't Google who sent the > email, for it uses ~all rather than -all. And even if it did use > -all, it doesn't necessarily mean that the email wouldn't get > delivered as not all spam filters/MTAs block SPF fails. ^^^^^^^ Does that imply that most, or even a relevant percentage of them, do? From martijn.grooten@virusbtn.com Tue Dec 11 00:36:16 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A345421F85CC for ; Tue, 11 Dec 2012 00:36:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.466 X-Spam-Level: X-Spam-Status: No, score=-10.466 tagged_above=-999 required=5 tests=[AWL=0.133, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IbkRYzEvzVgO for ; Tue, 11 Dec 2012 00:36:14 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id A315321F851C for ; Tue, 11 Dec 2012 00:36:13 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 29344540BA1 for ; Tue, 11 Dec 2012 08:36:12 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id 078D35406E5 for ; Tue, 11 Dec 2012 08:36:12 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Tue, 11 Dec 2012 08:36:12 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] whitelisting links (was Re: misconception in SPF) Thread-Index: AQHN1vYbjsWeST+ksEyDfvs1anZEDJgSRLgAgAARP0mAACTKAIAAAl5zgACNjwCAADqGTQ== Date: Tue, 11 Dec 2012 08:36:10 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD78F2@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net>, <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos>, <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos>, <50C6BDB2.1010407@mustelids.ca> In-Reply-To: <50C6BDB2.1010407@mustelids.ca> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 08:36:16 -0000 > Sounds somewhat like the "noscript" firefox plugin. I think it works in > more than just firefox. [...] > I use it. I stopped using it after I found myself blindly allowing any JavaScript any= website was running. But still, it's a good point and I can see why it would work for some, like= a whitelisting approach would work for some (possibly the same) users. I think neither are suitable for use by the majority of web users though. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From martijn.grooten@virusbtn.com Tue Dec 11 00:45:41 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F041C21F87C1 for ; Tue, 11 Dec 2012 00:45:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BWX6LyLFUrcs for ; Tue, 11 Dec 2012 00:45:40 -0800 (PST) Received: from mx3.sophos.com (mx3.sophos.com [216.47.234.212]) by ietfa.amsl.com (Postfix) with ESMTP id 30AA121F87B2 for ; Tue, 11 Dec 2012 00:45:39 -0800 (PST) Received: from mx3.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 0A614188452 for ; Tue, 11 Dec 2012 08:45:39 +0000 (GMT) Received: from abn-exch1b.green.sophos (abn-exch1b.green.sophos [10.100.70.62]) by mx3.sophos.com (Postfix) with ESMTPS id A826018842B for ; Tue, 11 Dec 2012 08:45:38 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Tue, 11 Dec 2012 08:45:37 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtKgAAmAwCAAClNo4AANEKAgAARtQCAAApSAIAABrkAgAAC+7OAAPY+AIAADEjd Date: Tue, 11 Dec 2012 08:45:37 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos> References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca>, <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos>, <50C6E652.7010401@tana.it> In-Reply-To: <50C6E652.7010401@tana.it> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 08:45:41 -0000 > Does that imply that most, or even a relevant percentage of them [block S= PF fails]? No. I know some do, but I think it's a minority. (Among commercial spam-fil= ters used mainly by corporations, that is. It could be that some of the lar= ger ISPs block SPF fails outright, which would skew the picture.) What I know for sure is that failing SPF doesn't mean an email is blocked b= y all spam-filters, because I found several counter-examples. Inspired by this thread, I'm going to do a little more research into this a= nd will try to see if there is any correlation between the SPF status of a = spam message and the likelihood of it being blocked. I'll share the results= on this list. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From rsk@gsp.org Tue Dec 11 05:37:35 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58FE621F84C4 for ; Tue, 11 Dec 2012 05:37:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.413 X-Spam-Level: X-Spam-Status: No, score=-6.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B69RxGCDEAFg for ; Tue, 11 Dec 2012 05:37:34 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id BE45721F8456 for ; Tue, 11 Dec 2012 05:37:34 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qBBDbWlo016433 for ; Tue, 11 Dec 2012 08:37:33 -0500 (EST) Date: Tue, 11 Dec 2012 08:37:27 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121211133727.GA8759@gsp.org> References: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> <50C6BDB2.1010407@mustelids.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50C6BDB2.1010407@mustelids.ca> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 13:37:35 -0000 I think we're getting into a number of overlapping problems here, most of which are caused by the use of worst practices (e.g., HTML in email, outsourced email, use of URL shorteners, web sites that load Javascript from a dozen different sources[1], financial institutions that are training their customers to be phish victims, etc.) I don't think we can solve or even capably attack any of these issues at the MTA or MUA, so I'll suggest they may be out-of-scope here. My suggestion that users bookmark their most-used/most-critical web sites (in their web browser) is actually unrelated to email: that is, I don't think anyone should ever read their email with a web browser or with a mail client that has web browser features. I regard doing so as a catastrophic security failure, one that can't be mitigated no matter how many layers of code are placed around or on top of it. So to clarify: this is an entirely manual process, but since it need only be done once per site and since it need only be done for "important" sites (in the view of the user) I regard the effort as minimal. Unfortunately, few users have the self-discipline required to always use those bookmarks, doubly so given that they're going to receive email containing links from the very institutions that they would be most likely to bookmark. (See "training customers to be phish victims".) ---rsk [1] Using NoScript makes this problem highly visible. From mike@mtcc.com Tue Dec 11 06:21:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B617821F8776 for ; Tue, 11 Dec 2012 06:21:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 02-oaLKh4dJ6 for ; Tue, 11 Dec 2012 06:21:29 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id E56F821F84CD for ; Tue, 11 Dec 2012 06:21:27 -0800 (PST) Received: from takifugu.mtcc.com (takifugu.mtcc.com [50.0.18.224]) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id qBBEL0T1021752 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Tue, 11 Dec 2012 06:21:00 -0800 Message-ID: <50C7414C.3030203@mtcc.com> Date: Tue, 11 Dec 2012 06:21:00 -0800 From: Michael Thomas User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.22) Gecko/20090605 Thunderbird/2.0.0.22 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> <50C6BDB2.1010407@mustelids.ca> <20121211133727.GA8759@gsp.org> In-Reply-To: <20121211133727.GA8759@gsp.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=530; t=1355235661; x=1356099661; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20Re=3A=20[Asrg]=20whitelisting=20links=20(was=20 Re=3A=20=20misconception=20in=20SPF) |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=nC3j0VThAsIawAGp5IqT1SK2RF5Gv1Wg7+beIzXEyFo=; b=V2oJyYS88ygS7lDvW2ijpn/XOhqlhCCOPr/Fhc8SQfqdjb7rUqpBupIl/m +/VJ7dh0SFH1iug2qIwbCajTRtyRS9MrvskiZ3q96vORChzBK7KL/Sho/1yC S4lkA5lLljKLJpmb5SgvPkZ/x8KifWncLUad3HcTgzM2Z+ApKZ4N0=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 14:21:29 -0000 On 12/11/2012 05:37 AM, Rich Kulawiec wrote: > I think we're getting into a number of overlapping problems here, most > of which are caused by the use of worst practices (e.g., HTML in email, > outsourced email, use of URL shorteners, web sites that load Javascript > from a dozen different sources[1], financial institutions that are > training their customers to be phish victims, etc.) > Anybody who thinks that using HTML or outsourcers are "worst practices" is part of the problem, not part of the solution. Mike From johnl@iecc.com Tue Dec 11 06:47:22 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A16621F8779 for ; Tue, 11 Dec 2012 06:47:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.405 X-Spam-Level: X-Spam-Status: No, score=-106.405 tagged_above=-999 required=5 tests=[AWL=0.494, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8llkdRyyK9+o for ; Tue, 11 Dec 2012 06:47:21 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 2562C21F877B for ; Tue, 11 Dec 2012 06:47:20 -0800 (PST) Received: (qmail 88826 invoked from network); 11 Dec 2012 14:47:18 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 11 Dec 2012 14:47:18 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c74776.xn--hew.k1212; i=johnl@user.iecc.com; bh=R45cbLV2Rp4OA/b0UkcrXWFzZ/e5mhlCMdbUQiHB2jA=; b=e/RbtqsbN/TeoCHc2F7J6Amomco6BvHzV1nLzvHN69wubX4WbAxUtc1dg8RH5gysC3347IxaxtV4SbgHgb6YlJ75kl590izFv8LderV5A150+4vM2I+nOzFfIk+QXo7WziqkUocqYR1zj4r6NlPnLfb/mB7U4hGdqfSHlr6SkaY= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c74776.xn--hew.k1212; olt=johnl@user.iecc.com; bh=R45cbLV2Rp4OA/b0UkcrXWFzZ/e5mhlCMdbUQiHB2jA=; b=iqT0oNJpSpWbjqiBjU2NxDWmxT2UwTDRWIpxgjoaVx+RRQ4rPmY8laWqrWwUOHbfUR1//REty/1uo62mZ1F6jEikHKET6ZH9akqrLloez4TqWkN4AjaBhwGci9gCi6cqq5bgTw4XNs9LpZiK8fWW8khXX5JqUx9VUS/CghZrvFo= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 11 Dec 2012 14:46:55 -0000 Message-ID: <20121211144655.19987.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 14:47:22 -0000 >No. I know some do, but I think it's a minority. (Among commercial spam-filters used mainly >by corporations, that is. It could be that some of the larger ISPs block SPF fails outright, >which would skew the picture.) No ISP I know does that. The false positive rate is much too high, since publication of a -all record is highly correlated with assertions that all forwarding is evil, which is of course just wrong. From jjohnson@jdmc.org Tue Dec 11 06:53:00 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60A0B21F8797 for ; Tue, 11 Dec 2012 06:53:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, GB_I_LETTER=-2] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eRvh-VJD93Or for ; Tue, 11 Dec 2012 06:52:59 -0800 (PST) Received: from secure.jdmc.org (secure.jdmc.org [164.58.70.160]) by ietfa.amsl.com (Postfix) with ESMTP id D111521F877B for ; Tue, 11 Dec 2012 06:52:59 -0800 (PST) Received: from [164.58.70.150] (mail.jdmc.org [164.58.70.150]) by secure.jdmc.org with ESMTP id qBBEqwWE017401 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 11 Dec 2012 08:52:58 -0600 X-Client-IP: 192.168.3.226 X-EnvRcpt: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=jdmc.org; s=mail; t=1355237578; bh=c6PO8OyEshcVkMCLZMR+bmMekwAVNkTNLiGS2AwHzbw=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=mOvqHS+O2EH7rGuOi8xAPx0XS6+KeFh+GXfCPIXB7cbft7j85VKpC353KGKnUrFpG kgxx+pWm0A1GdXLb5lQX0llslEC3iS1/FiZYpx3V3PsdyQyLLG5eXrsa0tPzQ9ChrE h//WIo0jCK1tuzmgJJQXfmMARiUiMuyZkT8on2yI= X-EnvFrom: jjohnson@jdmc.org X-LDomain: mail.jdmc.org X-LCount: 0 X-Vsender: dhcp3-226.jdmc.org [192.168.3.226] Received: from [192.168.3.226] (dhcp3-226.jdmc.org [192.168.3.226]) (authenticated bits=0) by mail.jdmc.org (8.14.4/8.14.4) with ESMTP id qBBEqt8B015113 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 11 Dec 2012 08:52:58 -0600 Message-ID: <50C748C7.3080104@jdmc.org> Date: Tue, 11 Dec 2012 08:52:55 -0600 From: John Johnson User-Agent: Thunderbird 2.0.0.24 (X11/20100228) MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> <50C6BDB2.1010407@mustelids.ca> <20121211133727.GA8759@gsp.org> <50C7414C.3030203@mtcc.com> In-Reply-To: <50C7414C.3030203@mtcc.com> X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Apparently-To: X-Scanned-By: MIMEDefang 2.72 on 164.58.70.150 X-GlobalCerts-Milter: secure.jdmc.org 11Dec2012-08:52:58.955 Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 14:53:00 -0000 Michael Thomas wrote: > Anybody who thinks that using HTML or outsourcers are "worst > practices" is part of the problem, not part of the solution. I highly disagree. A local bank just hired an outside firm to spam a "newsletter" to their customers in my area. It was quite difficult to tell if it was legitimate, as the bank had published SPF records, yet failed to provide the ip's of the outsourcers servers. And then used the banks domain name as the source. This should not be acceptable behavior, especially for a financial institution. It trains their customers to just accept anything and everything, they should be setting the bar, not lowering it. -john From jjohnson@jdmc.org Tue Dec 11 06:57:15 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8117321F86D4 for ; Tue, 11 Dec 2012 06:57:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.299 X-Spam-Level: X-Spam-Status: No, score=-3.299 tagged_above=-999 required=5 tests=[AWL=-1.300, BAYES_00=-2.599, J_CHICKENPOX_16=0.6] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GbwGEfHPaC2q for ; Tue, 11 Dec 2012 06:57:15 -0800 (PST) Received: from secure.jdmc.org (secure.jdmc.org [164.58.70.160]) by ietfa.amsl.com (Postfix) with ESMTP id DCDE121F8444 for ; Tue, 11 Dec 2012 06:57:14 -0800 (PST) Received: from [164.58.70.150] (mail.jdmc.org [164.58.70.150]) by secure.jdmc.org with ESMTP id qBBEv6DF028329 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 11 Dec 2012 08:57:06 -0600 X-Client-IP: 192.168.3.226 X-EnvRcpt: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=jdmc.org; s=mail; t=1355237826; bh=OP7p1kc/pLwj4Imp4o2CC/Xlfet3KBdY6VgzS9YEg50=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=SRZtxZV9/ey0x0yUnVX2eYiDBwgmQbtz1vyDzYCGXuUCQMXe6kS35aK+OfC7VczF6 kJxdRMQVb81ONNS8G/2HvP8Y4f67oYBLraYXeH4YKvVTt5b+wg20xi4eWl3wReYq2H XPQhYqWMgR2TL8VQSj1gbOY0ScRYUvCAwxhADAiI= X-EnvFrom: jjohnson@jdmc.org X-LDomain: mail.jdmc.org X-LCount: 0 X-Vsender: dhcp3-226.jdmc.org [192.168.3.226] Received: from [192.168.3.226] (dhcp3-226.jdmc.org [192.168.3.226]) (authenticated bits=0) by mail.jdmc.org (8.14.4/8.14.4) with ESMTP id qBBEv5Dh015452 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 11 Dec 2012 08:57:06 -0600 Message-ID: <50C749C1.3090100@jdmc.org> Date: Tue, 11 Dec 2012 08:57:05 -0600 From: John Johnson User-Agent: Thunderbird 2.0.0.24 (X11/20100228) MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <1915198247.6651.1355114075018.JavaMail.root@peachymango.org> In-Reply-To: <1915198247.6651.1355114075018.JavaMail.root@peachymango.org> X-Enigmail-Version: 0.96.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Apparently-To: X-Scanned-By: MIMEDefang 2.72 on 164.58.70.150 X-GlobalCerts-Milter: secure.jdmc.org 11Dec2012-08:57:06.653 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 14:57:15 -0000 Franck Martin wrote: > This issue is handled by DMARC, as it can work on all subdomains with only one TXT record. > > If you try to do the same with SPF only, this may be complicated. > > But then DMARC p=reject is not for all. +1, maybe +2 I now get reports of hosts attempting to send using a subdomain that isn't in use. Franck, thanks for your article on DMARC, it truly is a good tool. -john From mike@mtcc.com Tue Dec 11 07:08:00 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 288EC21F8701 for ; Tue, 11 Dec 2012 07:08:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_LETTER=-2] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iqF2SMy6WFcv for ; Tue, 11 Dec 2012 07:07:59 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id 6096021F84F3 for ; Tue, 11 Dec 2012 07:07:59 -0800 (PST) Received: from takifugu.mtcc.com (takifugu.mtcc.com [50.0.18.224]) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id qBBF7w7R006349 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Tue, 11 Dec 2012 07:07:58 -0800 Message-ID: <50C74C4E.9040507@mtcc.com> Date: Tue, 11 Dec 2012 07:07:58 -0800 From: Michael Thomas User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.22) Gecko/20090605 Thunderbird/2.0.0.22 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> <50C6BDB2.1010407@mustelids.ca> <20121211133727.GA8759@gsp.org> <50C7414C.3030203@mtcc.com> <50C748C7.3080104@jdmc.org> In-Reply-To: <50C748C7.3080104@jdmc.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1156; t=1355238478; x=1356102478; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20Re=3A=20[Asrg]=20whitelisting=20links=20(was=20 Re=3A=20=20misconception=20in=20SPF) |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=weY+2SLG6c/5jYZ5tnjw6vzGlebDv9grkHYe5BmN+Aw=; b=iJ1U8d5mfoWl9Y8iBpDESNLFwFW7Xgoh0Al4PJc2l+zP3tAmtJ8X6za+X9 p7G+mdAL37KDb/PfnEjKvfhwFYItLfV8ekyAihx7VD9vycZH04dX56EVO7hl YGFLh6goTyMM4IWybSkYJhZhoRE+x23brioZV3PTkM059Pp9Zg1k8=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 15:08:00 -0000 On 12/11/2012 06:52 AM, John Johnson wrote: > Michael Thomas wrote: > >> Anybody who thinks that using HTML or outsourcers are "worst >> practices" is part of the problem, not part of the solution. > I highly disagree. A local bank just hired an outside firm to > spam a "newsletter" to their customers in my area. It was quite > difficult to tell if it was legitimate, as the bank had published > SPF records, yet failed to provide the ip's of the outsourcers > servers. And then used the banks domain name as the source. Simply being an outsourcer doesn't preclude having first party dkim signatures. > > This should not be acceptable behavior, especially for a financial > institution. It trains their customers to just accept anything > and everything, they should be setting the bar, not lowering it. > Customers aren't trained in anything to do with email headers of any kind. What should and should not be acceptable behavior is strictly between the sender's practices and the receiver's filtering. If you want to complain, complain to the receiving MTA's. Legitimate senders will adapt. Mike From johnl@iecc.com Tue Dec 11 07:29:18 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41C8321F8778 for ; Tue, 11 Dec 2012 07:29:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -107.425 X-Spam-Level: X-Spam-Status: No, score=-107.425 tagged_above=-999 required=5 tests=[AWL=1.474, BAYES_00=-2.599, GB_I_LETTER=-2, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bjejm7aFr03p for ; Tue, 11 Dec 2012 07:29:17 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 9219A21F8762 for ; Tue, 11 Dec 2012 07:29:16 -0800 (PST) Received: (qmail 98501 invoked from network); 11 Dec 2012 15:29:16 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 11 Dec 2012 15:29:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c7514b.xn--btvx9d.k1212; i=johnl@user.iecc.com; bh=5FqZ7vDaZlc/69aj3YZ91fHQ2sNIP1CiflDMhUgKBJI=; b=Dny+LSV8SlYirE0e1eCx6eN3mI6rq7epshBpnlb2JqmfFtJIW26Y7KwPRLQNAcJdizs1kN/JV58UYglsmzjfDYFwkdxyjNWYn7QO1HqgTtJUUIjSOUsZNOpV6kLXe7WcGAPoYpNXI+UAeRstVMxdWIEoHTiXbJjSlQqU/tO08+o= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c7514b.xn--btvx9d.k1212; olt=johnl@user.iecc.com; bh=5FqZ7vDaZlc/69aj3YZ91fHQ2sNIP1CiflDMhUgKBJI=; b=FCqP744Yx+AsYT4RB944s8W+aZW+9b4OHflafQPW050Z+Uphr/Uezh4mevms2H3E57YqHW6mKqVOLz9pvMTqtI6Dygk+83MusVe4UemDEB7/kYlNPOpzvrj/BHNpngIWlB+HkPFCHYCb5+CPz1it+YjiqJQ5p9zze+sknwFKKGs= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 11 Dec 2012 15:28:53 -0000 Message-ID: <20121211152853.21461.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <50C748C7.3080104@jdmc.org> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 15:29:18 -0000 > I highly disagree. A local bank just hired an outside firm to > spam a "newsletter" to their customers in my area. It was quite > difficult to tell if it was legitimate, as the bank had published > SPF records, yet failed to provide the ip's of the outsourcers > servers. And then used the banks domain name as the source. I think we can all agree that being incompetent is a worst practice. There are plenty of companies that oursource their advertising and even a fair number who outsource transactional mail, but get the domains and SPF and DKIM correct. Running mail properly is hard, hiring people who know what they're doing rather than trying to fake it yourself is often a good idea. From dotzero@gmail.com Tue Dec 11 07:29:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0A7A21F881C for ; Tue, 11 Dec 2012 07:29:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.534 X-Spam-Level: X-Spam-Status: No, score=-3.534 tagged_above=-999 required=5 tests=[AWL=-0.065, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_RMML_Stock10=0.13] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mYuqXajoSURQ for ; Tue, 11 Dec 2012 07:29:47 -0800 (PST) Received: from mail-qa0-f47.google.com (mail-qa0-f47.google.com [209.85.216.47]) by ietfa.amsl.com (Postfix) with ESMTP id 33A4A21F8818 for ; Tue, 11 Dec 2012 07:29:47 -0800 (PST) Received: by mail-qa0-f47.google.com with SMTP id a19so3415036qad.13 for ; Tue, 11 Dec 2012 07:29:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=GrXf2YOtRNBh2W7y0FxqHTkRq5+Q3VChpmxuy1tTkkM=; b=F83X57eRh8SvyjhYjSQGFjqUGuScUmJ55AzfTAeYHnrnpV70QpjZoHArmn7a3yY6FE 4+NPfyiySRqGYPr2YvVjKHgm400QbY6+h1FC8fqLXHbXfyWVHBOmfqs5civJbmqTqBIj J/BHum5R376uYFicI7XbOVGuW9TVmQM1pnN3f0IHyOmbHbGv972TBQMTddB5ILp4truh LDVRVRjzHz7oeVEyia5RdrvM3KgpAfAEyzN5o5Ch6fgIS9o9xLgddDaP6PT017u/ADVD 3xnm6gM+ZkQwKTFzCWNqnu0Kzo1lRFA35LFZ7+Icw4+X2Ry2a07XGmiUSLREQL+GwAX6 hKeQ== MIME-Version: 1.0 Received: by 10.229.78.200 with SMTP id m8mr8101033qck.96.1355239786556; Tue, 11 Dec 2012 07:29:46 -0800 (PST) Received: by 10.49.39.41 with HTTP; Tue, 11 Dec 2012 07:29:46 -0800 (PST) In-Reply-To: <20121211144655.19987.qmail@joyce.lan> References: <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos> <20121211144655.19987.qmail@joyce.lan> Date: Tue, 11 Dec 2012 10:29:46 -0500 Message-ID: From: Dotzero To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 15:29:48 -0000 On Tue, Dec 11, 2012 at 9:46 AM, John Levine wrote: >>No. I know some do, but I think it's a minority. (Among commercial spam-filters used mainly >>by corporations, that is. It could be that some of the larger ISPs block SPF fails outright, >>which would skew the picture.) > > No ISP I know does that. The false positive rate is much too high, > since publication of a -all record is highly correlated with > assertions that all forwarding is evil, which is of course just wrong. > I concur with John - The false positive rates, misconfigurations in records, etc. are one of the reasons for the development of DMARC and the buy-in by major mailbox providers (See announcement by MS yesterday for outlook.com implementing DMARC and switching from SID to SPF - http://blogs.office.com/b/microsoft-outlook/archive/2012/12/10/outlook-com-increases-security-with-support-for-dmarc-and-ev-certificates.aspx) I'm not sure I agree with John that a -all record is somehow an assertion that all forwarding is evil. I'll save that discussion for drinks the next time I see him. Mike From martijn.grooten@virusbtn.com Tue Dec 11 07:46:59 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E40EB21F884E for ; Tue, 11 Dec 2012 07:46:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.483 X-Spam-Level: X-Spam-Status: No, score=-10.483 tagged_above=-999 required=5 tests=[AWL=0.116, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id azKWg7BB4JjY for ; Tue, 11 Dec 2012 07:46:59 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id E73CF21F885B for ; Tue, 11 Dec 2012 07:46:57 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id D58E8540C80 for ; Tue, 11 Dec 2012 15:46:56 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id A6534540B59 for ; Tue, 11 Dec 2012 15:46:56 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Tue, 11 Dec 2012 15:46:56 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] misconception in SPF Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtKgAAmAwCAAClNo4AANEKAgAARtQCAAApSAIAABrkAgAAC+7OAAPY+AIAADEjdgABnaYCAAA27qg== Date: Tue, 11 Dec 2012 15:46:55 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20ADAC54@ABN-EXCH1A.green.sophos> References: <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos>, <20121211144655.19987.qmail@joyce.lan> In-Reply-To: <20121211144655.19987.qmail@joyce.lan> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 15:47:00 -0000 > No ISP I know does that. The false positive rate is much too high, Thanks. I am aware of the latter, but didn't want to conclude the former ba= sed on that. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From prvs=0692BCD7DA=paul@pscs.co.uk Tue Dec 11 08:00:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8B5621F877B for ; Tue, 11 Dec 2012 08:00:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_LETTER=-2, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U+LZJmbO4gQE for ; Tue, 11 Dec 2012 08:00:38 -0800 (PST) Received: from mail.pscs.co.uk (mail.pscs.co.uk [188.65.177.237]) by ietfa.amsl.com (Postfix) with ESMTP id DD30121F86BB for ; Tue, 11 Dec 2012 08:00:36 -0800 (PST) Received: from lmail.pscs.co.uk ([82.68.5.206]) by mail.pscs.co.uk ([188.65.177.237] running VPOP3) with ESMTP for ; Tue, 11 Dec 2012 16:13:01 -0000 Received: from [192.168.57.155] ([217.155.61.157]) by lmail.pscs.co.uk ([192.168.66.70] running VPOP3) with ESMTP for ; Tue, 11 Dec 2012 15:53:54 -0000 Message-ID: <50C75711.20805@pscs.co.uk> Date: Tue, 11 Dec 2012 15:53:53 +0000 From: Paul Smith User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C6121D.9040607@dcrocker.net> <50C617A2.8090602@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD5E36@ABN-EXCH1A.green.sophos> <50C644F6.3090901@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD737F@ABN-EXCH1A.green.sophos> <50C6BDB2.1010407@mustelids.ca> <20121211133727.GA8759@gsp.org> <50C7414C.3030203@mtcc.com> <50C748C7.3080104@jdmc.org> In-Reply-To: <50C748C7.3080104@jdmc.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: paul X-Server: VPOP3 Enterprise V6.0 - Registered X-Organisation: Paul Smith Computer Services Subject: Re: [Asrg] whitelisting links (was Re: misconception in SPF) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 16:00:38 -0000 On 11/12/2012 14:52, John Johnson wrote: > Michael Thomas wrote: > >> Anybody who thinks that using HTML or outsourcers are "worst >> practices" is part of the problem, not part of the solution. > I highly disagree. A local bank just hired an outside firm to > spam a "newsletter" to their customers in my area. It was quite > difficult to tell if it was legitimate, as the bank had published > SPF records, yet failed to provide the ip's of the outsourcers > servers. And then used the banks domain name as the source. > > This should not be acceptable behavior, especially for a financial > institution. It trains their customers to just accept anything > and everything, they should be setting the bar, not lowering it. > +1 Banks can use outsourcing for their mail, that's fine, but they should seriously consider the implications. It's fairly obvious that most banks don't. There are things that an email outsource & bank can do together to keep things secure - and OBVIOUSLY secure, but it's clear that neither most banks nor email newsletter companies actually understand email enough to be using it in this way. - Paul Smith Computer Services Tel: 01484 855800 Vat No: GB 685 6987 53 From christian.grunfeld@gmail.com Tue Dec 11 08:07:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1AD421F87C9 for ; Tue, 11 Dec 2012 08:07:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.094 X-Spam-Level: X-Spam-Status: No, score=-3.094 tagged_above=-999 required=5 tests=[AWL=-0.095, BAYES_00=-2.599, J_CHICKENPOX_16=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YX67r2rHvnr for ; Tue, 11 Dec 2012 08:07:04 -0800 (PST) Received: from mail-ia0-f172.google.com (mail-ia0-f172.google.com [209.85.210.172]) by ietfa.amsl.com (Postfix) with ESMTP id BD6C121F8780 for ; Tue, 11 Dec 2012 08:07:04 -0800 (PST) Received: by mail-ia0-f172.google.com with SMTP id z13so8155732iaz.31 for ; Tue, 11 Dec 2012 08:07:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=PqMOwu5dhd5mwHPhf6EmSTEnwHdU0d9hGq77U7Iopl4=; b=RVimKtp9zbDKiWg2SKNEyMnuHe1qiJfiHjtjBc+aAbWXqaWTZI1rbdUD5NGtvjBSjs w4vqCVj6MmVPC6DmHduDarcPFtl2OJuWecNIykTzeRvA/T0aYOKW7wzdCv4nm4a/VXv2 rZcUv8KsbiVJ0QruuWcSSQT78L9RZDsHvqgea0+GbLCnQzjBRsy6YZ8CmKT4QTFlqVXL 0MgmMY5w3mXwlyeJnuYIe5Eu7lV4S456Qg4BH2EYSAW/dfxQzc8MJyyTKRmpTGPAOr0H jbxYwXyoyegJ9+gQ49DajWr6M5mJqV5ftJdpf1p3B8SoP0raufIwwAhvFZZVjnHr1zp7 ys0g== MIME-Version: 1.0 Received: by 10.50.160.228 with SMTP id xn4mr10474874igb.7.1355242024304; Tue, 11 Dec 2012 08:07:04 -0800 (PST) Received: by 10.231.65.79 with HTTP; Tue, 11 Dec 2012 08:07:04 -0800 (PST) In-Reply-To: <50C749C1.3090100@jdmc.org> References: <1915198247.6651.1355114075018.JavaMail.root@peachymango.org> <50C749C1.3090100@jdmc.org> Date: Tue, 11 Dec 2012 13:07:04 -0300 Message-ID: From: Christian Grunfeld To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 16:07:05 -0000 yes, nice article ! If, for example, gmail/google is supporting DMARC why do they allow multi-identities in From: header? this can really break DMARC tests. Another point about SPF and forwardings... do ones allowing forwarding and publishing -all must implement SRS to tackle the problem? 2012/12/11 John Johnson : > Franck Martin wrote: >> This issue is handled by DMARC, as it can work on all subdomains with only one TXT record. >> >> If you try to do the same with SPF only, this may be complicated. >> >> But then DMARC p=reject is not for all. > > +1, maybe +2 > > I now get reports of hosts attempting to send using a subdomain that isn't in use. > Franck, thanks for your article on DMARC, it truly is a good tool. > > -john > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg From johnl@iecc.com Tue Dec 11 09:38:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A55E121F8701 for ; Tue, 11 Dec 2012 09:38:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.482 X-Spam-Level: X-Spam-Status: No, score=-106.482 tagged_above=-999 required=5 tests=[AWL=0.417, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id amrYszgVcJiq for ; Tue, 11 Dec 2012 09:38:46 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id DE36021F850B for ; Tue, 11 Dec 2012 09:38:45 -0800 (PST) Received: (qmail 33040 invoked from network); 11 Dec 2012 17:38:43 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 11 Dec 2012 17:38:43 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c76fa3.xn--30v786c.k1212; i=johnl@user.iecc.com; bh=9vhPJlhXZNQxQTYAGVTWEefcnTBywf4xfRFvfw/u4XE=; b=e4kV/Ielb6/BhEFRPYKOz7mjAbmcBfyvj26D0JsGHWzkRig7N8vEzBxe3LAFDU9QdWdnHNPn2DtOCdSvCXeKgkGoLHQKV4tVbx6QH8f9uBIq136SR35NsPJTiY0OWG4j7wlo3iAoe71ILlvVNi3sjCXLfHMYGTkK1v++pF2vqUE= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c76fa3.xn--30v786c.k1212; olt=johnl@user.iecc.com; bh=9vhPJlhXZNQxQTYAGVTWEefcnTBywf4xfRFvfw/u4XE=; b=UFrpMERptCbrvC+ajO77dYXV2CUz7+wIbxHPjtdrXRcSUHmGrFwZmefHHqY1Hvc/IKf92D1RDUDu0mTzh7sFJlerqOeLg7O6dmKGiZBkSiEFzbgrEXnAnDO48UDzRRuN9tn8wsxFX1Gn0HgQwvhIq4tB+4UKzRxKXuOW+BzKph4= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 11 Dec 2012 17:38:21 -0000 Message-ID: <20121211173821.25803.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 17:38:46 -0000 >If, for example, gmail/google is supporting DMARC why do they allow >multi-identities in From: header? this can really break DMARC tests. > >Another point about SPF and forwardings... do ones allowing forwarding >and publishing -all must implement SRS to tackle the problem? Gee, it seems to be dead horse time. Forwarding isn't a problem, even though some people who think that SPF is the FUSSP incorrectly imagine that it is. SRS is basically saying that I have to change the way my mail system works in order to work around the bugs in your anti-spam magic bullet. Sorry, that's not how it works. SPF certainly has its uses, but after a decade, I hope we all understand that the world's mail systems are not going to rewrite themselves to deal with SPF's well known limitations. Ditto DMARC. From laura@carrotcafe.com Tue Dec 11 09:51:25 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86D0221F8625 for ; Tue, 11 Dec 2012 09:51:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RpYnAUbNNv2D for ; Tue, 11 Dec 2012 09:51:06 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 4E3DF21F860F for ; Tue, 11 Dec 2012 09:51:05 -0800 (PST) Received: from grover.wordtothewise.com (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: wttwlaura) by m.wordtothewise.com (Postfix) with ESMTPSA id A70702DECF for ; Tue, 11 Dec 2012 09:51:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1355248264; bh=bcyv57I1rMUh5iP979o/ozfdHn2TB/M99DsF8zY9Olk=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=Ynx0KK7l1Lg+PhnLF50uvbKbu8j8Fk+fF2blJdaEUdNolqFj0ume5ChuIHdcaTrs/ 3U81tTaefSa1wZyI+GUyC5YdeX0JMBiHxR8ubuek8+M1ROHVIjR5POxMvFZWXhceo1 HAgWCvO74QO+HDSS6FVmuvl9Cylotmm7vf7Y9dck= Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1283) From: Laura Atkins In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos> Date: Tue, 11 Dec 2012 09:51:01 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <50C60F9E.1060202@mustelids.ca>, <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos>, <50C6E652.7010401@tana.it> <0D79787962F6AE4B84B2CC41FC957D0B20AD790A@ABN-EXCH1A.green.sophos> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1283) Subject: Re: [Asrg] misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 17:51:26 -0000 On Dec 11, 2012, at 12:45 AM, Martijn Grooten wrote: >> Does that imply that most, or even a relevant percentage of them = [block SPF fails]? >=20 > No. I know some do, but I think it's a minority. (Among commercial = spam-filters used mainly by corporations, that is. It could be that some = of the larger ISPs block SPF fails outright, which would skew the = picture.) I know no major ISP that reject a mail for a SPF fail.=20 In fact, I'm getting multiple reports from clients and random senders = this week that Hotmail is now sending out SPF failure emails to domains = publishing DMARC records. laura=20 --=20 Laura Atkins laura@carrotcafe.com "If you do not choose to lead, you will forever be led by others. Find what scares you and do it. And you *can* make a difference, if you choose to do so." JMS From johnl@iecc.com Tue Dec 11 11:35:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B79BF21F8530 for ; Tue, 11 Dec 2012 11:35:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.497 X-Spam-Level: X-Spam-Status: No, score=-106.497 tagged_above=-999 required=5 tests=[AWL=0.402, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id waf1S9KEs9mm for ; Tue, 11 Dec 2012 11:35:32 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id ADAD821F852D for ; Tue, 11 Dec 2012 11:35:31 -0800 (PST) Received: (qmail 59843 invoked from network); 11 Dec 2012 19:35:30 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 11 Dec 2012 19:35:30 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c78b01.xn--hew.k1212; i=johnl@user.iecc.com; bh=8SpIPnLcMj+GKRqf6SvpkwM9zm2peQY1W1cKDKqMQcg=; b=Wt2W0QvJGyGR22hcFjPsKXE40cXB9fiackCB3z16usiJMfeMhGJ1ijDYWTOknfrReigH7my0RBUwMT1nhz3L9g6oxd5ZAUoKkQWhn3J3L74NVUJngC48B1r71sMht/rDHvI15RYTEB3+Ey1zn7EPoLBHVx+PHD5fdaKgZkuL0z0= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c78b01.xn--hew.k1212; olt=johnl@user.iecc.com; bh=8SpIPnLcMj+GKRqf6SvpkwM9zm2peQY1W1cKDKqMQcg=; b=F1h3ERghxOcIhMYzjUqw10Pe90n76y309FvlD77711elGrUt+DaHDoN4Gp7wTMmJ0jo3u26luUGr13IgkrN/vtEf68tpD8+BJHNMM/IEH14JinDbqajZ5gEHwnZTYZGXB/aXjTPWSVp67h0nGIitWldn/zN/2TBst9XZyeRiQ0M= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 11 Dec 2012 19:35:07 -0000 Message-ID: <20121211193507.29759.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] DMARC, was misconception in SPF X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2012 19:35:32 -0000 >In fact, I'm getting multiple reports from clients and random senders this week that Hotmail >is now sending out SPF failure emails to domains publishing DMARC records. Yes, I'm getting them, too. Unlike a lot of other DMARC reports, these all seem to include the full unredacted message. So far, all the ones they've sent have been unsurprising, e.g., list mail, but I can't wait for some typo stuff to arrive. From adamsobieski@hotmail.com Wed Dec 12 17:43:34 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 458BA21F87F2 for ; Wed, 12 Dec 2012 17:43:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.21 X-Spam-Level: X-Spam-Status: No, score=-1.21 tagged_above=-999 required=5 tests=[AWL=0.788, BAYES_50=0.001, GB_I_LETTER=-2, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id muHpIfqRpOPK for ; Wed, 12 Dec 2012 17:43:33 -0800 (PST) Received: from snt0-omc4-s32.snt0.hotmail.com (snt0-omc4-s32.snt0.hotmail.com [65.55.90.235]) by ietfa.amsl.com (Postfix) with ESMTP id 97F5F21F879F for ; Wed, 12 Dec 2012 17:43:33 -0800 (PST) Received: from SNT002-W143 ([65.55.90.199]) by snt0-omc4-s32.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 12 Dec 2012 17:43:27 -0800 X-Originating-IP: [174.100.43.136] X-EIP: [HAqOS1F+1g0LHX36/goKfIbFgIEdyDvA] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_c91bab3d-8a92-4903-8ef5-2da05efb0b47_" From: Adam Sobieski To: "asrg@irtf.org" Date: Thu, 13 Dec 2012 01:43:27 +0000 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 13 Dec 2012 01:43:27.0707 (UTC) FILETIME=[3F67AAB0:01CDD8D3] Subject: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 01:43:34 -0000 --_c91bab3d-8a92-4903-8ef5-2da05efb0b47_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C Greetings. I have some ideas to prevent spam. A number of heuristics incl= ude increasing the computation required to send and receive an email=2C for= example one to a few minutes of computation per email on desktop computers= . One example of a heuristic=2C from that category=2C includes the use of a r= andom number generator=2C seeded or salted with a combination of the sender= 's email address=2C the recipient's email address=2C and the date and time = of the sending of the email. Then=2C in the described example=2C some amou= nt of computation=2C measurable in minutes on a desktop computer=2C churns = a stream of bits from the random number generator=2C in a buffer the size o= f which can be obtained from the size of the email=2C and with those bits i= n that buffer then utilizable by other heuristics. The recipient of an ema= il can=2C with the sender's address=2C their own email address=2C the date = and time of the sending of the email=2C and possibly other data=2C seed or = salt an identical random number generator=2C churning a stream of bits=2C w= ith an indicated amount of computation=2C measurable in minutes=2C to obtai= n the same bits in an identically sized buffer. By increasing the computation required to send and receive email messages= =2C for example measurable in minutes of desktop computation=2C desktop gra= phics card computation=2C spam can be reduced as spammers would have to com= pute=2C per letter=2C per recipient=2C per email sending event=2C as descri= bed. In addition to=2C possibly in combination to=2C that category of heur= istic=2C increasing the computation required to send and receive emails=2C = the digital signing of email messages can be of use to preventing spam. In addition to countering spam=2C I have observed some interest=2C in the s= cientific community=2C with regard to discussing the versioning of and adva= ncement of email protocols=2C modernizing email-related computer networking= protocols. Kind regards=2C Adam Sobieski = --_c91bab3d-8a92-4903-8ef5-2da05efb0b47_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C

Greetings. I have some ideas to prevent spam. A number of heuristics incl= ude increasing the computation required to send and receive an email=2C for= example one to a few minutes of computation per email on desktop computers= .

One example of a heuristic=2C from that category=2C includes the use of a r= andom number generator=2C seeded or salted with a combination of the sender= 's email address=2C the recipient's email address=2C and the date and time = of the sending of the email. Then=2C in the described example=2C some amou= nt of computation=2C measurable in minutes on a desktop computer=2C churns = a stream of bits from the random number generator=2C in a buffer the size o= f which can be obtained from the size of the email=2C and with those bits i= n that buffer then utilizable by other heuristics. The recipient of an ema= il can=2C with the sender's address=2C their own email address=2C the date = and time of the sending of the email=2C and possibly other data=2C seed or = salt an identical random number generator=2C churning a stream of bits=2C w= ith an indicated amount of computation=2C measurable in minutes=2C to obtai= n the same bits in an identically sized buffer.

By increasing the computation required to send and receive email messages= =2C for example measurable in minutes of desktop computation=2C desktop gra= phics card computation=2C spam can be reduced as spammers would have to com= pute=2C per letter=2C per recipient=2C per email sending event=2C as descri= bed. In addition to=2C possibly in combination to=2C that category of heur= istic=2C increasing the computation required to send and receive emails=2C = the digital signing of email messages can be of use to preventing spam.

In addition to countering spam=2C I have observed some interest=2C in the s= cientific community=2C with regard to discussing the versioning of and adva= ncement of email protocols=2C modernizing email-related computer networking= protocols.



Kind regards=2C

Adam Sobieski
= --_c91bab3d-8a92-4903-8ef5-2da05efb0b47_-- From steve@blighty.com Wed Dec 12 18:12:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 229B921F845E for ; Wed, 12 Dec 2012 18:12:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_LETTER=-2] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bXnPqqqWpD-z for ; Wed, 12 Dec 2012 18:12:46 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 7C21921F85A0 for ; Wed, 12 Dec 2012 18:12:46 -0800 (PST) Received: from [192.168.80.21] (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id 77FA02E185 for ; Wed, 12 Dec 2012 18:12:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1355364765; bh=yQUM771ddp2iy43sQc2PlHXQiMeZH1cjvF7DO02v3xE=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=ZM74gUwOBPUdfMH1G7ka6FhW5xfKXRM1LZY5JXZhI+Lsk8vGQsW5M745l/UeOFWJU 5aWZ+tPOMEkOQNulaPbLBemWzjPkVsrepHC/e2Nybwdx/2nDPgOTc6qv1L29YhnIYm VjXwD2+rLtrCt9z8yLjF3mkimFd5OQDk1zqboAOM= Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Steve Atkins In-Reply-To: Date: Wed, 12 Dec 2012 18:12:43 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1499) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 02:12:48 -0000 On Dec 12, 2012, at 5:43 PM, Adam Sobieski = wrote: > Greetings. I have some ideas to prevent spam. A number of heuristics = include increasing the computation required to send and receive an = email, for example one to a few minutes of computation per email on = desktop computers. >=20 > One example of a heuristic, from that category, includes the use of a = random number generator, seeded or salted with a combination of the = sender's email address, the recipient's email address, and the date and = time of the sending of the email. Then, in the described example, some = amount of computation, measurable in minutes on a desktop computer, = churns a stream of bits from the random number generator, in a buffer = the size of which can be obtained from the size of the email, and with = those bits in that buffer then utilizable by other heuristics. The = recipient of an email can, with the sender's address, their own email = address, the date and time of the sending of the email, and possibly = other data, seed or salt an identical random number generator, churning = a stream of bits, with an indicated amount of computation, measurable in = minutes, to obtain the same bits in an identically sized buffer. >=20 > By increasing the computation required to send and receive email = messages, for example measurable in minutes of desktop computation, = desktop graphics card computation, spam can be reduced as spammers would = have to compute, per letter, per recipient, per email sending event, as = described. In addition to, possibly in combination to, that category of = heuristic, increasing the computation required to send and receive = emails, the digital signing of email messages can be of use to = preventing spam. You might want to look at hashcash. = http://en.wikipedia.org/wiki/Hashcash Brief summary of the conclusion: cannot work, as spammers have much = easier access to free CPU cycles than do legitimate senders of mail. Cheers, Steve= From bzs@world.std.com Wed Dec 12 19:44:03 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 703F421F869F for ; Wed, 12 Dec 2012 19:44:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D0B5U9fyxgj6 for ; Wed, 12 Dec 2012 19:44:02 -0800 (PST) Received: from TheWorld.com (pcls6.std.com [192.74.137.146]) by ietfa.amsl.com (Postfix) with ESMTP id A793721F8759 for ; Wed, 12 Dec 2012 19:44:02 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBD3hjtT001405 for ; Wed, 12 Dec 2012 22:43:47 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBD3hiXT025461; Wed, 12 Dec 2012 22:43:44 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20681.20208.381354.455789@world.std.com> Date: Wed, 12 Dec 2012 22:43:44 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 03:44:03 -0000 See: http://en.wikipedia.org/wiki/Penny_Black_%28research_project%29 -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From johnl@iecc.com Wed Dec 12 19:54:49 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0A5A21F88EA for ; Wed, 12 Dec 2012 19:54:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.525 X-Spam-Level: X-Spam-Status: No, score=-106.525 tagged_above=-999 required=5 tests=[AWL=0.374, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Eb-V41ZlTjQ for ; Wed, 12 Dec 2012 19:54:48 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 9928621F889C for ; Wed, 12 Dec 2012 19:54:48 -0800 (PST) Received: (qmail 69406 invoked from network); 13 Dec 2012 03:54:46 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 13 Dec 2012 03:54:46 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c95186.xn--9vv.k1212; i=johnl@user.iecc.com; bh=+5lCK6J5J/zIJrTxO0FXcAElKEpmGr9rRXF21l2Ul8g=; b=UxAv9E5rvXMrrWDUIOK9KgBgRcZxqOvrEBfLfjyav8wdFEHGNzoC/DyLcot3jb5eJeQDYJ02RtJEj78zfAfemzAYz/XWFTLZSUf6dGUOh+jtdUKi31J9ntmgYxF5tnSxd8kwhwl0XStaJlLWjtMMlngrkpGNbz+ilk0gJ1nAeuY= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c95186.xn--9vv.k1212; olt=johnl@user.iecc.com; bh=+5lCK6J5J/zIJrTxO0FXcAElKEpmGr9rRXF21l2Ul8g=; b=RITE4sLmwBdmWDxdlvlf53BV4OJ3rHekYkMCdw07ygf6JCNrTmMA5uKCnXjPqRwvm+PM3zOn+d6X3ZqPTXb4TPf2q9E5kWpOn5x03ssQplBlvcBZvuhMq0ViDVe+8R3n8GQoj5twznngqYgTyTC4Ym4UEOEFd64DIiFK4WXjwME= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 13 Dec 2012 03:54:23 -0000 Message-ID: <20121213035423.13881.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 03:54:50 -0000 >You might want to look at hashcash. http://en.wikipedia.org/wiki/Hashcash > >Brief summary of the conclusion: cannot work, as spammers have much easier >access to free CPU cycles than do legitimate senders of mail. I wrote a white paper about e-postage eight years ago, which has stood up pretty well. There are other fatal issues, related to the need to whitelist mail from people whose mail you want to get. http://www.taugh.com/epostage.pdf From adamsobieski@hotmail.com Wed Dec 12 19:58:22 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1E1821F87EC for ; Wed, 12 Dec 2012 19:58:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.773 X-Spam-Level: X-Spam-Status: No, score=-1.773 tagged_above=-999 required=5 tests=[AWL=0.825, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sbC6OcA3SQKl for ; Wed, 12 Dec 2012 19:58:21 -0800 (PST) Received: from snt0-omc4-s20.snt0.hotmail.com (snt0-omc4-s20.snt0.hotmail.com [65.55.90.223]) by ietfa.amsl.com (Postfix) with ESMTP id BB19921F87E6 for ; Wed, 12 Dec 2012 19:58:21 -0800 (PST) Received: from SNT002-W13 ([65.55.90.201]) by snt0-omc4-s20.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 12 Dec 2012 19:58:21 -0800 X-Originating-IP: [174.100.43.136] X-EIP: [1/2rf9pxzrFQAu1JSJkfKBP25fGpyb9I] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_38e7470b-c469-40ee-8218-6d0b41896027_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Thu, 13 Dec 2012 03:58:20 +0000 Importance: Normal In-Reply-To: References: , MIME-Version: 1.0 X-OriginalArrivalTime: 13 Dec 2012 03:58:21.0052 (UTC) FILETIME=[176A1BC0:01CDD8E6] Cc: "steve@blighty.com" Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 03:58:22 -0000 --_38e7470b-c469-40ee-8218-6d0b41896027_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Steve Atkins=2C =20 Thank you=2C that article=2C summarizing decades of research=2C does both p= ertain to and discuss the concepts that I broached. A technical topic not m= entioned in that article specifically is the use of the sender's email addr= ess=2C recipient's email address=2C and the date and time of the message ev= ent to seed or salt a random number generator. =20 I think that a quote from that article expresses a premise of the idea well= : "the theory is that spammers=2C whose business model relies on their abil= ity to send large numbers of emails with very little cost per message=2C ca= nnot afford this investment into each individual piece of spam they send. R= eceivers can verify whether a sender made such an investment and use the re= sults to help filter email." =20 It appears that your counterpoint is also indicated in that article which d= escribes "botnets or cluster farms with which spammers can increase their p= rocessing power enormously." As you might be aware=2C earlier this year=2C in the Journal of Economic Pe= rspectives=2C in an article titled The Economics of Spam=2C Justin Rao of M= icrosoft and David Reiley of Google estimated the cost of spam to society r= elative to its worldwide revenues. The societal price tag was indicated as = $20 billion while the total revenue of all spammers was indicated as $200 m= illion. Various policy proposals designed to solve the spam problem were di= scussed in that publication (http://www.aeaweb.org/articles.php?doi=3D10.12= 57/jep.26.3.87=2C http://pubs.aeaweb.org/doi/pdfplus/10.1257/jep.26.3.87). There may be more than one criterion for success=2C simultaneously=2C with = regard to anti-spam discussions: (1) the total elimination of spam=2C (2) a= reduction of spam=2C and (3) solutions which affect the economics of spam = in attempts to reduce spam (2). It could be that your conclusion addresses = one criterion (1)=2C while other criteria (2) and (3) could be achieved by = increasing the computational costs of sending and receiving emails. Also=2C what might you think about discussions about versioning and advanci= ng email protocols=2C modernizing email-related computer networking protoco= ls? Kind regards=2C =20 Adam = --_38e7470b-c469-40ee-8218-6d0b41896027_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Steve Atkins=2C

=20 Thank you=2C that article=2C summarizing decades of research=2C does both p= ertain to and discuss the concepts that I broached. A technical topic not m= entioned in that article specifically is the use of the sender's email addr= ess=2C recipient's email address=2C and the date and time of the message ev= ent to seed or salt a random number generator.

=20 I think that a quote from that article expresses a premise of the idea well= : "the theory is that spammers=2C whose business model relies on their abil= ity to send large numbers of emails with very little cost per message=2C ca= nnot afford this investment into each individual piece of spam they send. R= eceivers can verify whether a sender made such an investment and use the re= sults to help filter email."

=20 It appears that your counterpoint is also indicated in that article which d= escribes "botnets or cluster farms with which spammers can increase their p= rocessing power enormously."

As you might be aware=2C earlier this year=2C in the Journal of Economic Pe= rspectives=2C in an article titled The Economics of Spam=2C Justin R= ao of Microsoft and David Reiley of Google estimated the cost of spam to so= ciety relative to its worldwide revenues. The societal price tag was indica= ted as $20 billion while the total revenue of all spammers was indicated as= $200 million. Various policy proposals designed to solve the spam problem = were discussed in that publication (http://www.aeaweb.org/articles.php?doi=3D= 10.1257/jep.26.3.87=2C http://pubs.aeaweb.org/doi/pdfplus/10.1257/jep.26.3.87).

There may be more than one criterion for success=2C simultaneously=2C with = regard to anti-spam discussions: (1) the total elimination of spam=2C (2) a= reduction of spam=2C and (3) solutions which affect the economics of spam = in attempts to reduce spam (2). It could be that your conclusion addresses = one criterion (1)=2C while other criteria (2) and (3) could be achieved by = increasing the computational costs of sending and receiving emails.

Also=2C what might you think about discussions about versioning and advanci= ng email protocols=2C modernizing email-related computer networking protoco= ls?



Kind regards=2C

=20 Adam
= --_38e7470b-c469-40ee-8218-6d0b41896027_-- From johnl@iecc.com Wed Dec 12 21:44:24 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F02D1F0CB9 for ; Wed, 12 Dec 2012 21:44:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.537 X-Spam-Level: X-Spam-Status: No, score=-106.537 tagged_above=-999 required=5 tests=[AWL=0.362, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RXTGGRt0WCRU for ; Wed, 12 Dec 2012 21:44:23 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id BCC3821F84FF for ; Wed, 12 Dec 2012 21:44:22 -0800 (PST) Received: (qmail 89287 invoked from network); 13 Dec 2012 05:44:20 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 13 Dec 2012 05:44:20 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c96b34.xn--hew.k1212; i=johnl@user.iecc.com; bh=hWLul/D25gWHDhpkVRsOsQKTFnN+37i4UHS4r2M8mc4=; b=BiDVpUYcOMoetdrshNoNVlx68KYQlMvRDu0rkkmnaHVQPxI7nPIBFMrkiJjYPbDjkRPYqLDdbKyvHyAc4vZbbDm49rQPgsrqS3f8UAE6Yc2S8q+wuEH1ko5/+KTWdqsCCztNNRYRi4dnQQa5DWapezy8Wr26os9xsZ7LjxbEx0E= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50c96b34.xn--hew.k1212; olt=johnl@user.iecc.com; bh=hWLul/D25gWHDhpkVRsOsQKTFnN+37i4UHS4r2M8mc4=; b=GlJT0i03Ef3Gm9f6B3I/hvORA+h3Baw8lc3CVwUNTPiQu++M4j7iWpFv2/XN5WNPPNrfP2E9P2WklcBCcIMxEbGyz3ihYRYOdt2WWN4Pf6t95jmOLr7jv72+NRKVzRaBFI8XL8v3BWK7kjq2kXgpHGqix8W0CCrjqQwMqiFIL0k= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 13 Dec 2012 05:43:58 -0000 Message-ID: <20121213054358.17733.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 05:44:24 -0000 >Steve Atkins, I'm not Steve, but what the heck. >and discuss the concepts that I broached. A technical topic not mentioned in >that article specifically is the use of the sender's email address, recipient's >email address, and the date and time of the message event to seed or salt a >random number generator. It's clever, but since the fundamental problem with proof-of-work is that the bad guys can do more work than the good guys, the details of the work aren't particularly interesting. >reduce spam (2). It could be that your conclusion addresses one criterion (1), >while other criteria (2) and (3) could be achieved by increasing the >computational costs of sending and receiving emails. No, because the bad guys still have more computational power than the good guys. You could get rid of spam, but only at the cost of getting rid of all of the rest of e-mail, too. Effective anti-spam techniques have to be things that it's easier for good guys to do than for bad guys to do. This turns out to be hard. It also turns out to be subtle. For example, both good and bad senders can apply DKIM signatures to their mail, so signing per se is not an anti-spam technique. What makes them useful is that the signing identifiers can be keys into reputation systems that are designed to favor good signers. >Also, what might you think about discussions about versioning and advancing >email protocols, modernizing email-related computer networking protocols? SMTP has had an extension mechanism since RFC 1869 in 1995. There have been quite a lot of extensions proposed, some of which, such as pipelining and 8bitmime, are now universally adopted. Early definitions of SMTP had commands such as SOML and TURN that were found either not to be useful, or to have serious security problems, so they've been deprecated and eventually deleted. It's not exactly versioning, but the protocol has evolved somewhat. There have been a lot of proposals to "replace SMTP", but none have come anywhere near close to demonstrating sufficient utility to motivate people to bear the enormous switching costs from the existing deployed system. R's, John From ajs@anvilwalrusden.com Thu Dec 13 01:18:29 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EF3D21F8A89 for ; Thu, 13 Dec 2012 01:18:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.84 X-Spam-Level: X-Spam-Status: No, score=-0.84 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_INFO=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eT2vUnLOLV+d for ; Thu, 13 Dec 2012 01:18:27 -0800 (PST) Received: from mx1.yitter.info (ow5p.x.rootbsd.net [208.79.81.114]) by ietfa.amsl.com (Postfix) with ESMTP id 5BC8F21F8472 for ; Thu, 13 Dec 2012 01:18:22 -0800 (PST) Received: from mx1.yitter.info (69-196-144-227.dsl.teksavvy.com [69.196.144.227]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.yitter.info (Postfix) with ESMTPSA id 3E2428A031 for ; Thu, 13 Dec 2012 09:18:19 +0000 (UTC) Date: Thu, 13 Dec 2012 04:18:14 -0500 From: Andrew Sullivan To: asrg@irtf.org Message-ID: <20121213091813.GA13311@mx1.yitter.info> References: <20121213054358.17733.qmail@joyce.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20121213054358.17733.qmail@joyce.lan> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: [Asrg] The Real Problem (was: An Anti-Spam Heuristic) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 09:18:29 -0000 On Thu, Dec 13, 2012 at 05:43:58AM -0000, John Levine wrote: > There have been a lot of proposals to "replace SMTP", but none have > come anywhere near close to demonstrating sufficient utility to > motivate people to bear the enormous switching costs from the existing > deployed system. Just because this hasn't be stated explictly enough this week outside of Dubai, let me say the problem is that the underlying lookup mechanism isn't robust enough. If we only knew who it was doing the lookups, we could use the existing legal systems to solve these issues. Therefore, all we need to is replace DNS; SMTP can stay where it is in the stack. HTH, A -- Andrew Sullivan ajs@anvilwalrusden.com From rsk@gsp.org Thu Dec 13 06:04:23 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F74E21F8AD6 for ; Thu, 13 Dec 2012 06:04:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.293 X-Spam-Level: X-Spam-Status: No, score=-6.293 tagged_above=-999 required=5 tests=[AWL=-0.009, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id htBp4C-57Ppq for ; Thu, 13 Dec 2012 06:04:23 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id D3C3B21F8AD5 for ; Thu, 13 Dec 2012 06:04:22 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qBDE44QI019391 for ; Thu, 13 Dec 2012 09:04:05 -0500 (EST) Date: Thu, 13 Dec 2012 09:03:59 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121213140359.GA2187@gsp.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 14:04:23 -0000 > A number of heuristics include increasing the computation required to > send and receive an email, for example one to a few minutes of computation > per email on desktop computers. Presume an adversary with computing resources that routinely range in the area of "tens of millions of systems", with all the processing, memory, disk, and bandwidth resources that implies. Presume that those systems are capable of coordinated or independent tasks as designated by the adversary. Show how this approach will have a meaningful effect on the adversary's ability to generate/transmit [SMTP] spam. Simultaneously, presume the existence of hundreds of thousands of highly useful mailing lists (e.g., "ietf", "nanog") with varying numbers of members and show how this approach will not adversely affect their ability to function in the way they've been functioning for decades. I don't think you can do this. I think you're trying to drown someone who owns the ocean, and that the attempt is futile. But perhaps you have an approach that's eluded others, that overcomes the obvious problems, and I just don't see it yet due to insufficient caffeine intake. ---rsk From asrg3@billmail.scconsult.com Thu Dec 13 06:23:45 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5698121F8B28 for ; Thu, 13 Dec 2012 06:23:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.855 X-Spam-Level: X-Spam-Status: No, score=-1.855 tagged_above=-999 required=5 tests=[AWL=-0.745, BAYES_05=-1.11] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mk9dwne-pcN9 for ; Thu, 13 Dec 2012 06:23:44 -0800 (PST) Received: from toaster.scconsult.com (sc1.scconsult.com [66.73.230.190]) by ietfa.amsl.com (Postfix) with ESMTP id 8423621F8B26 for ; Thu, 13 Dec 2012 06:23:44 -0800 (PST) Received: from [192.168.254.24] (silverclam.scconsult.com [192.168.254.24]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by toaster.scconsult.com (Postfix) with ESMTPSA id 3YMcZR4zX5zrgv6 for ; Thu, 13 Dec 2012 09:23:43 -0500 (EST) From: "Bill Cole" To: "Anti-Spam Research Group - IRTF" Date: Thu, 13 Dec 2012 09:23:42 -0500 Message-ID: <0BDF8EB4-DA93-4ED9-8E94-63C448EB2454@billmail.scconsult.com> In-Reply-To: <20121213140359.GA2187@gsp.org> References: <20121213140359.GA2187@gsp.org> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Mailer: MailMate (1.5.1r3139) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 14:23:45 -0000 On 13 Dec 2012, at 9:03, Rich Kulawiec wrote: > I just don't see it yet due to insufficient caffeine intake. As the ASRG approaches the end of its first decade, we should stipulate that caffeine is too tame a drug to enable one to comprehend the FUSSP. From schaefer@closedmail.com Thu Dec 13 07:24:57 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BAF021F8AD5 for ; Thu, 13 Dec 2012 07:24:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eShX7dsk+hxg for ; Thu, 13 Dec 2012 07:24:56 -0800 (PST) Received: from vms173009pub.verizon.net (vms173009pub.verizon.net [206.46.173.9]) by ietfa.amsl.com (Postfix) with ESMTP id 7593F21F8A88 for ; Thu, 13 Dec 2012 07:24:55 -0800 (PST) Received: from torch.brasslantern.com ([unknown] [98.234.255.59]) by vms173009.mailsrvcs.net (Sun Java(tm) System Messaging Server 7u2-7.02 32bit (built Apr 16 2009)) with ESMTPA id <0MEZ008Z76S11120@vms173009.mailsrvcs.net> for asrg@irtf.org; Thu, 13 Dec 2012 09:24:16 -0600 (CST) Received: from torch.brasslantern.com (localhost.localdomain [127.0.0.1]) by torch.brasslantern.com (8.13.1/8.13.1) with ESMTP id qBDFO1Gw029347 for ; Thu, 13 Dec 2012 07:24:01 -0800 Received: (from schaefer@localhost) by torch.brasslantern.com (8.13.1/8.13.1/Submit) id qBDFO1j0029346 for asrg@irtf.org; Thu, 13 Dec 2012 07:24:01 -0800 From: Bart Schaefer Message-id: <121213072401.ZM29345@torch.brasslantern.com> Date: Thu, 13 Dec 2012 07:24:01 -0800 In-reply-to: <20121213140359.GA2187@gsp.org> Comments: In reply to Rich Kulawiec "Re: [Asrg] An Anti-Spam Heuristic" (Dec 13, 9:03am) References: <20121213140359.GA2187@gsp.org> X-Mailer: OpenZMail Classic (0.9.2 24April2005) To: Anti-Spam Research Group - IRTF MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 15:24:57 -0000 On Dec 13, 9:03am, Rich Kulawiec wrote: } } > A number of heuristics include increasing the computation required to } > send and receive an email, for example one to a few minutes of computation } > per email on desktop computers. } } I don't think you can do this. I think you're trying to drown someone } who owns the ocean, and that the attempt is futile. But perhaps you have } an approach that's eluded others, that overcomes the obvious problems, } and I just don't see it yet due to insufficient caffeine intake. Generating "cash" with computing resources means they can print all the money they want. For a pay-to-play scheme to have any hope of working, it needs to be based on a resource that can be controlled from outside. Which leads to the same discussion we had four years ago. Today is the anniversary of http://tools.ietf.org/html/draft-irtf-asrg-postage-00 which never went went anywhere beyond that. It is acknowledged that the bad guys can steal postage from a zombied system almost as easily as they can steal compute resources, but it's easier to discover and react to the theft of something that doesn't invisibly regenerate. From clewis+ietf@mustelids.ca Thu Dec 13 07:29:48 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 922CC21F8B59 for ; Thu, 13 Dec 2012 07:29:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.179 X-Spam-Level: X-Spam-Status: No, score=-0.179 tagged_above=-999 required=5 tests=[AWL=-0.620, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EurH51Re2DIX for ; Thu, 13 Dec 2012 07:29:48 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id E9FA221F8B5A for ; Thu, 13 Dec 2012 07:29:47 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBDFTfj8024691 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 13 Dec 2012 10:29:41 -0500 Message-ID: <50C9F465.7000408@mustelids.ca> Date: Thu, 13 Dec 2012 10:29:41 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20121213054358.17733.qmail@joyce.lan> <20121213091813.GA13311@mx1.yitter.info> In-Reply-To: <20121213091813.GA13311@mx1.yitter.info> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] The Real Problem X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 15:29:48 -0000 On 12-12-13 04:18 AM, Andrew Sullivan wrote: > On Thu, Dec 13, 2012 at 05:43:58AM -0000, John Levine wrote: >> There have been a lot of proposals to "replace SMTP", but none have >> come anywhere near close to demonstrating sufficient utility to >> motivate people to bear the enormous switching costs from the existing >> deployed system. > > Just because this hasn't be stated explictly enough this week outside > of Dubai, let me say the problem is that the underlying lookup > mechanism isn't robust enough. If we only knew who it was doing the > lookups, we could use the existing legal systems to solve these > issues. Therefore, all we need to is replace DNS; SMTP can stay where > it is in the stack. Knowing who looked at a phone book doesn't tell you who is making the phone ring in the middle of the night. Especially if its possible to copy the phone book. And even if you did know, what makes you think the existing legal system will always be able to help? _Most_ western legal systems already have laws that pertain to just about the full gamut of what spammers do. The difficulty is in enforcing it - either getting LE interested, or having a sufficient ROI to do it in civil law. Eg: spoofing my email address is something actionable. But it'd be at _least_ $25K upfront to get a lawyer doing something. And if it was outside of Canada, start multiplying that ... From vesely@tana.it Thu Dec 13 08:12:44 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AEAA21F8617 for ; Thu, 13 Dec 2012 08:12:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.719 X-Spam-Level: X-Spam-Status: No, score=-4.719 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8EL6d4NUtr3O for ; Thu, 13 Dec 2012 08:12:44 -0800 (PST) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id C6DF821F883C for ; Thu, 13 Dec 2012 08:12:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1355415161; bh=ZzJ/CQo7nSZdYcTVEyYkN4THviFqo9TYzFpOlASctEA=; l=775; h=Date:From:To:References:In-Reply-To; b=i9by70HZmb9fGAOXKsVOSux8A6YaeOplxKXbQ9AjX+mVNgfSIBaL4N0RagYBhMQoP 6BHhlZNj5LJhBss4n2YgtBB75JcEqUzFKiqptwI1WD64534ni94N21o7z34rcvbCGr qSFpe3GbUA9xNcVb2Z4m9rs7Gchq38op6+736TiM= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Thu, 13 Dec 2012 17:12:41 +0100 id 00000000005DC039.0000000050C9FE79.0000120F Message-ID: <50C9FE79.7010005@tana.it> Date: Thu, 13 Dec 2012 17:12:41 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20121213054358.17733.qmail@joyce.lan> <20121213091813.GA13311@mx1.yitter.info> <50C9F465.7000408@mustelids.ca> In-Reply-To: <50C9F465.7000408@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] The Real Problem X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 16:12:44 -0000 On Thu 13/Dec/2012 16:29:41 +0100 Chris Lewis wrote: > On 12-12-13 04:18 AM, Andrew Sullivan wrote: >> >> If we only knew who it was doing the lookups, we could use the >> existing legal systems to solve these issues. > > And even if you did know, what makes you think the existing legal > system will always be able to help? That's something we should make pretty clear, for the sake of the Internet revolution, digital era, and all that sort: If we need to call the cops to deal with plain spam, we can give up that quest altogether. We MUST be able to achieve the total elimination of spam (1) using only our puters and remote cooperation. For the time being, we have some difficulties just defining the term, but there's plenty of time to improve :-) From bzs@world.std.com Thu Dec 13 09:18:21 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F87E21F864D for ; Thu, 13 Dec 2012 09:18:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DIyDOGkuc0es for ; Thu, 13 Dec 2012 09:18:21 -0800 (PST) Received: from TheWorld.com (pcls6.std.com [192.74.137.146]) by ietfa.amsl.com (Postfix) with ESMTP id C8BD821F862C for ; Thu, 13 Dec 2012 09:18:20 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDHG8dJ028052 for ; Thu, 13 Dec 2012 12:16:11 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDHG596003961; Thu, 13 Dec 2012 12:16:05 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.3413.665708.640636@world.std.com> Date: Thu, 13 Dec 2012 12:16:05 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 17:18:21 -0000 There's also Jef Poskanzer's greymilter which basically requires one re-send from each never before seen mail server not in a white list. And sendmail (and others') HELO delay (delay sending HELO a short period of time) and don't speak until you're spoken to whatever they call it (I use it, the sender must wait for the SMTP responses, can't just dump an SMTP conversation at you.) They're basically isomorphic to hashcash type solutions, increase the sender's cost, but very transparent and quite clever because of that. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From mike@mtcc.com Thu Dec 13 09:21:26 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51B8521F8BC0 for ; Thu, 13 Dec 2012 09:21:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.479 X-Spam-Level: X-Spam-Status: No, score=-2.479 tagged_above=-999 required=5 tests=[AWL=-1.120, BAYES_00=-2.599, SARE_LWSHORTT=1.24] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cBVFtN3u500P for ; Thu, 13 Dec 2012 09:21:25 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id 434B021F8BBF for ; Thu, 13 Dec 2012 09:21:24 -0800 (PST) Received: from takifugu.mtcc.com (takifugu.mtcc.com [50.0.18.224]) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id qBDHLLA8011478 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Thu, 13 Dec 2012 09:21:21 -0800 Message-ID: <50CA0E91.2080304@mtcc.com> Date: Thu, 13 Dec 2012 09:21:21 -0800 From: Michael Thomas User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.22) Gecko/20090605 Thunderbird/2.0.0.22 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20682.3413.665708.640636@world.std.com> In-Reply-To: <20682.3413.665708.640636@world.std.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=828; t=1355419281; x=1356283281; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20Re=3A=20[Asrg]=20An=20Anti-Spam=20Heuristic |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=MgYZMy+BJHmrVCZ+bXodGEgr7WlLrwBs5E8fkhy0INg=; b=FOLZB7VLTJqzh6q25LqugW/pdN9EZ9vhPRoI6MUpGp4sc7bS9LrhvZ3oJ5 9N6ytprfBKQRLh72rH/IAI6O5eUoOJSTT8cP5EhgVCzWpicPVw1AGcGbt1p7 +e0yaNYMCChyQA892jXqThROGII7YlbC3WxiLFWpGF7kv4y2UFH7E=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Cc: Barry Shein Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 17:21:26 -0000 On 12/13/2012 09:16 AM, Barry Shein wrote: > There's also Jef Poskanzer's greymilter which basically requires one > re-send from each never before seen mail server not in a white list. > > And sendmail (and others') HELO delay (delay sending HELO a short > period of time) and don't speak until you're spoken to whatever they > call it (I use it, the sender must wait for the SMTP responses, can't > just dump an SMTP conversation at you.) > > They're basically isomorphic to hashcash type solutions, increase the > sender's cost, but very transparent and quite clever because of that. > Given botnets, anything that tries to shift burden back onto the sender is not very likely to be effective in the long run. Yes, you might get some short term relief, but the firehose is just a software update away. Mike From bzs@world.std.com Thu Dec 13 09:30:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 324C421F8B0C for ; Thu, 13 Dec 2012 09:30:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SzxerHI6znQc for ; Thu, 13 Dec 2012 09:30:03 -0800 (PST) Received: from TheWorld.com (pcls6.std.com [192.74.137.146]) by ietfa.amsl.com (Postfix) with ESMTP id AB7D821F8B08 for ; Thu, 13 Dec 2012 09:30:02 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDHTQD6001101 for ; Thu, 13 Dec 2012 12:29:28 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDHTQsM004802; Thu, 13 Dec 2012 12:29:26 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.4214.409466.74930@world.std.com> Date: Thu, 13 Dec 2012 12:29:26 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <20121213091813.GA13311@mx1.yitter.info> References: <20121213054358.17733.qmail@joyce.lan> <20121213091813.GA13311@mx1.yitter.info> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] The Real Problem (was: An Anti-Spam Heuristic) X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 17:30:04 -0000 My retort to "replace SMTP" is always why not just add some new code like NOTS (switch to not smtp) to SMTP and proceed from there with your new-fangled protocol. Add support to the handful of major mailers, in some cases you can do that with an external program (e.g., milter), you don't even have to hack the code base, and off you go. So, that's not the obstacle. -b From bzs@world.std.com Thu Dec 13 09:32:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0122321F8B1A for ; Thu, 13 Dec 2012 09:32:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VsqtHchaJLBb for ; Thu, 13 Dec 2012 09:32:04 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id 4434E21F8B0D for ; Thu, 13 Dec 2012 09:32:04 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDHUnMY030863 for ; Thu, 13 Dec 2012 12:30:52 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDHUniE005181; Thu, 13 Dec 2012 12:30:49 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.4297.46866.427700@world.std.com> Date: Thu, 13 Dec 2012 12:30:49 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <0BDF8EB4-DA93-4ED9-8E94-63C448EB2454@billmail.scconsult.com> References: <20121213140359.GA2187@gsp.org> <0BDF8EB4-DA93-4ED9-8E94-63C448EB2454@billmail.scconsult.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 17:32:05 -0000 On December 13, 2012 at 09:23 asrg3@billmail.scconsult.com (Bill Cole) wrote: > On 13 Dec 2012, at 9:03, Rich Kulawiec wrote: > > > I just don't see it yet due to insufficient caffeine intake. > > As the ASRG approaches the end of its first decade, we should stipulate > that caffeine is too tame a drug to enable one to comprehend the FUSSP. We should also reflect on every time someone ever said "won't work because that solution would take a DECADE to be adopted!" -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From john@jlc.net Thu Dec 13 11:02:52 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B3E521F861B for ; Thu, 13 Dec 2012 11:02:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.164 X-Spam-Level: X-Spam-Status: No, score=-106.164 tagged_above=-999 required=5 tests=[AWL=0.435, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZKBl7CoU7JHe for ; Thu, 13 Dec 2012 11:02:52 -0800 (PST) Received: from mailhost.jlc.net (mailhost.jlc.net [199.201.159.4]) by ietfa.amsl.com (Postfix) with ESMTP id CDB1621F8619 for ; Thu, 13 Dec 2012 11:02:51 -0800 (PST) Received: by mailhost.jlc.net (Postfix, from userid 104) id 9562833D10; Thu, 13 Dec 2012 14:02:51 -0500 (EST) Date: Thu, 13 Dec 2012 14:02:51 -0500 From: John Leslie To: Anti-Spam Research Group - IRTF Message-ID: <20121213190251.GE37893@verdi> References: <20121213140359.GA2187@gsp.org> <121213072401.ZM29345@torch.brasslantern.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <121213072401.ZM29345@torch.brasslantern.com> User-Agent: Mutt/1.4.1i Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 19:02:52 -0000 Bart Schaefer wrote: > On Dec 13, 9:03am, Rich Kulawiec wrote: >} [Adam Sobieski wrote:] >} >}> A number of heuristics include increasing the computation required to >}> send and receive an email, for example one to a few minutes of computation >}> per email on desktop computers. >} >} I don't think you can do this. I think you're trying to drown someone >} who owns the ocean, and that the attempt is futile. But perhaps you have >} an approach that's eluded others, that overcomes the obvious problems, >} and I just don't see it yet due to insufficient caffeine intake. It's not sufficient to prove some value was expended: something of value must be transferred to the receiving SMTP server (if not all the way to the reader). > Generating "cash" with computing resources means they can print all the > money they want. For a pay-to-play scheme to have any hope of working, > it needs to be based on a resource that can be controlled from outside. I'm not sure "controlled from outside" can work... > Which leads to the same discussion we had four years ago. Today is the > anniversary of http://tools.ietf.org/html/draft-irtf-asrg-postage-00 > which never went went anywhere beyond that. Indeed it is, Bart! I'll treat you and Ben to a virtual beverage and four virtual candles. ;^) > It is acknowledged that the bad guys can steal postage from a zombied > system almost as easily as they can steal compute resources, but it's > easier to discover and react to the theft of something that doesn't > invisibly regenerate. It's better yet to react to actual value received. ;^) The snail-mail systems _are_ sender-pays systems, but it's only the perceived value-received that causes snail-mail recipients to open an envelope. (I'm not holding my breath on anything happening with ePostage, but I remain willing to work with anybody else with the energy to pursue it.) -- John Leslie From sethb@panix.com Thu Dec 13 12:59:42 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EBDC21F8529 for ; Thu, 13 Dec 2012 12:59:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pkaj+1aq-reG for ; Thu, 13 Dec 2012 12:59:41 -0800 (PST) Received: from mailbackend.panix.com (mailbackend.panix.com [166.84.1.89]) by ietfa.amsl.com (Postfix) with ESMTP id 82E4021F8206 for ; Thu, 13 Dec 2012 12:59:41 -0800 (PST) Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mailbackend.panix.com (Postfix) with ESMTP id 8A9532E085 for ; Thu, 13 Dec 2012 15:59:40 -0500 (EST) Received: by panix5.panix.com (Postfix, from userid 756) id 735FE24248; Thu, 13 Dec 2012 15:59:40 -0500 (EST) From: Seth To: Anti-Spam Research Group - IRTF In-reply-to: <20682.3413.665708.640636@world.std.com> (message from Barry Shein on Thu, 13 Dec 2012 12:16:05 -0500) References: <20682.3413.665708.640636@world.std.com> Message-Id: <20121213205940.735FE24248@panix5.panix.com> Date: Thu, 13 Dec 2012 15:59:40 -0500 (EST) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 20:59:42 -0000 Barry Shein wrote: > There's also Jef Poskanzer's greymilter which basically requires one > re-send from each never before seen mail server not in a white list. > > And sendmail (and others') HELO delay (delay sending HELO a short > period of time) and don't speak until you're spoken to whatever they > call it (I use it, the sender must wait for the SMTP responses, can't > just dump an SMTP conversation at you.) > > They're basically isomorphic to hashcash type solutions, increase the > sender's cost, but very transparent and quite clever because of that. They have nothing to do with increasing the sender's cost. Rather, they take advantage of the fact that legitimate mailers implement the RFCs in ways that spamware typically doesn't, so they test for that and spamware flunks. Seth From steve@blighty.com Thu Dec 13 13:08:06 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97A3E21F8444 for ; Thu, 13 Dec 2012 13:08:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.099 X-Spam-Level: X-Spam-Status: No, score=-3.099 tagged_above=-999 required=5 tests=[AWL=-0.500, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gokMH1PESFuz for ; Thu, 13 Dec 2012 13:08:05 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id E6D6421F8441 for ; Thu, 13 Dec 2012 13:08:05 -0800 (PST) Received: from [192.168.80.56] (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id 902962DECF for ; Thu, 13 Dec 2012 13:08:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1355432884; bh=OvCZkxZZP4yD/uJ2jzhyYdvUH8lm+mO/9GuYf3k7fMg=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=imGfuXblIlTFHNKVl+9gV+J1X+TE7QoEFYZv3+z2lDkBzIRXERXEVl1ZFrGNwK2nX 6urEYH5bEeddceGRXfq988iA7352AlIU7IyVDpgMOf4RoxuNVqZB+RL6LTkpMEuSXz yIpe7mqKolM/RT10i91grVQTBbia/X1GodOQMZJ4= Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Steve Atkins In-Reply-To: <20121213205940.735FE24248@panix5.panix.com> Date: Thu, 13 Dec 2012 13:08:03 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20682.3413.665708.640636@world.std.com> <20121213205940.735FE24248@panix5.panix.com> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1499) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 21:08:06 -0000 On Dec 13, 2012, at 12:59 PM, Seth wrote: > Barry Shein wrote: >=20 >> There's also Jef Poskanzer's greymilter which basically requires one >> re-send from each never before seen mail server not in a white list. >>=20 >> And sendmail (and others') HELO delay (delay sending HELO a short >> period of time) and don't speak until you're spoken to whatever they >> call it (I use it, the sender must wait for the SMTP responses, can't >> just dump an SMTP conversation at you.) >>=20 >> They're basically isomorphic to hashcash type solutions, increase the >> sender's cost, but very transparent and quite clever because of that. >=20 > They have nothing to do with increasing the sender's cost. Rather, > they take advantage of the fact that legitimate mailers implement the > RFCs in ways that spamware typically doesn't, so they test for that > and spamware flunks. And a lot of spamware doesn't flunk. Yet it can damage legitimate use of = email, both when the senders aren't following RFCs strictly (lots of senders = will give up if a recipients MX is so overloaded/broken that it's not = responding after tens of seconds) or when they are (greylisting in particular = really breaks active mailing lists, by reordering discussions into a fairly = random order). It's the sort of thing that people tend to do because it makes them feel like they're sticking one to spammers - which isn't a bad reason, by any means, but doesn't lead towards optimal solutions. Cheers, Steve From bzs@world.std.com Thu Dec 13 14:53:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B64C21F8866 for ; Thu, 13 Dec 2012 14:53:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.979 X-Spam-Level: X-Spam-Status: No, score=-2.979 tagged_above=-999 required=5 tests=[AWL=-0.620, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_LWSHORTT=1.24] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tCyoamCQyIqe for ; Thu, 13 Dec 2012 14:53:42 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id 2439D21F8855 for ; Thu, 13 Dec 2012 14:53:39 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDMr855014322; Thu, 13 Dec 2012 17:53:19 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDMqiad002535; Thu, 13 Dec 2012 17:52:44 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.23612.451287.246798@world.std.com> Date: Thu, 13 Dec 2012 17:52:44 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <50CA0E91.2080304@mtcc.com> References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Cc: Barry Shein Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 22:53:59 -0000 On December 13, 2012 at 09:21 mike@mtcc.com (Michael Thomas) wrote: > On 12/13/2012 09:16 AM, Barry Shein wrote: > > There's also Jef Poskanzer's greymilter which basically requires one > > re-send from each never before seen mail server not in a white list. > > > > And sendmail (and others') HELO delay (delay sending HELO a short > > period of time) and don't speak until you're spoken to whatever they > > call it (I use it, the sender must wait for the SMTP responses, can't > > just dump an SMTP conversation at you.) > > > > They're basically isomorphic to hashcash type solutions, increase the > > sender's cost, but very transparent and quite clever because of that. > > > Given botnets, anything that tries to shift burden back onto the > sender is not very likely to be effective in the long run. Yes, you > might get some short term relief, but the firehose is just a software > update away. Has this been measured (reference)? Or is this just one of those "truisms" that kick around here? I'm thinking that a spammer has to put out on the order of a billion messages (attempts) per day to be interesting. If you slowed those down that would be a blow to them, a billion times even a little is a lot. Sure, we can postulate infinite botted systems I suppose. But that's still just a wild guess. I'm not arguing for hashcash per se, I think it has other problems, but I also wonder if this counter-claim is really true. Or, put better, can we quantify it? -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From steve@blighty.com Thu Dec 13 15:10:19 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A541121F8B7D for ; Thu, 13 Dec 2012 15:10:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.312 X-Spam-Level: X-Spam-Status: No, score=-2.312 tagged_above=-999 required=5 tests=[AWL=-0.953, BAYES_00=-2.599, SARE_LWSHORTT=1.24] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eCk3FK4vOkFS for ; Thu, 13 Dec 2012 15:10:14 -0800 (PST) Received: from m.wordtothewise.com (misc.wordtothewise.com [184.105.179.154]) by ietfa.amsl.com (Postfix) with ESMTP id 52C4121F8A97 for ; Thu, 13 Dec 2012 15:10:14 -0800 (PST) Received: from [192.168.80.56] (204.11.227.194.static.etheric.net [204.11.227.194]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id 10AE12EADE for ; Thu, 13 Dec 2012 15:10:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1355440212; bh=3tuSraM1l5LZNqkrgKW2/4WtNX0O9mIrhsSip0ovdN8=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=jsKuCkEE03xohqx4oVjD1bWYsAApC2DFwRfsBOvn+I8VH3CWnYlV2JOvGfBbCrwQE AKL/qfQkNJ4yzmr+GqK2/QiUBzwLnpfUBhkPFGjScE5wivdBc0Zv2/4WcA7umKC03D qHjbtfCYzgwmSnbpUD+naWaW4HkFo9KbvN06gDWE= Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Steve Atkins In-Reply-To: <20682.23612.451287.246798@world.std.com> Date: Thu, 13 Dec 2012 15:10:10 -0800 Content-Transfer-Encoding: 7bit Message-Id: References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> To: Anti-Spam Research Group - IRTF X-Mailer: Apple Mail (2.1499) Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 23:10:19 -0000 On Dec 13, 2012, at 2:52 PM, Barry Shein wrote: > > On December 13, 2012 at 09:21 mike@mtcc.com (Michael Thomas) wrote: >> On 12/13/2012 09:16 AM, Barry Shein wrote: >>> There's also Jef Poskanzer's greymilter which basically requires one >>> re-send from each never before seen mail server not in a white list. >>> >>> And sendmail (and others') HELO delay (delay sending HELO a short >>> period of time) and don't speak until you're spoken to whatever they >>> call it (I use it, the sender must wait for the SMTP responses, can't >>> just dump an SMTP conversation at you.) >>> >>> They're basically isomorphic to hashcash type solutions, increase the >>> sender's cost, but very transparent and quite clever because of that. >>> >> Given botnets, anything that tries to shift burden back onto the >> sender is not very likely to be effective in the long run. Yes, you >> might get some short term relief, but the firehose is just a software >> update away. > > Has this been measured (reference)? Or is this just one of those > "truisms" that kick around here? > > I'm thinking that a spammer has to put out on the order of a billion > messages (attempts) per day to be interesting. > > If you slowed those down that would be a blow to them, a billion times > even a little is a lot. The cost to spammers using almost free, botted systems is always going to be a lot lower than the cost to legitimate senders using expensive, well managed systems. Anything you do to make sending mail more expensive that isn't pretty good at differentiating between legitimate and illegitimate senders is going to harm legitimate senders disproportionately. You can buy a rooted asian box for <$5. ESP-grade MTAs and management systems can be up in the tens of K per box - so if you double the average delivery latency then you've cost the spammer $5 and the legitimate sender $5000. That doesn't work. Cheers, Steve From bzs@world.std.com Thu Dec 13 15:10:43 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DA0C21F8BE8 for ; Thu, 13 Dec 2012 15:10:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.475 X-Spam-Level: X-Spam-Status: No, score=-3.475 tagged_above=-999 required=5 tests=[AWL=0.124, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SQL+7rkmO8WS for ; Thu, 13 Dec 2012 15:10:39 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id EC42521F8BE2 for ; Thu, 13 Dec 2012 15:10:38 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDNABGX019807 for ; Thu, 13 Dec 2012 18:10:13 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDN8COi004111; Thu, 13 Dec 2012 18:08:12 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.24540.349183.905192@world.std.com> Date: Thu, 13 Dec 2012 18:08:12 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <20121213190251.GE37893@verdi> References: <20121213140359.GA2187@gsp.org> <121213072401.ZM29345@torch.brasslantern.com> <20121213190251.GE37893@verdi> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 23:10:43 -0000 I still think real postage of a form (I mean $$$) could do it but I'm sick of wearing out keyboards explaining why and seeing others wearing out their keyboards trying to rationalize why it won't. But, in a sentence, creating an economy around spam-fighting, an economic incentive to fight fraud, would help because money focuses the mind. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From bzs@world.std.com Thu Dec 13 15:16:07 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16E8621F8B7D for ; Thu, 13 Dec 2012 15:16:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.496 X-Spam-Level: X-Spam-Status: No, score=-3.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1yyDC2H34YR2 for ; Thu, 13 Dec 2012 15:16:02 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id 6C6FF21F8BD0 for ; Thu, 13 Dec 2012 15:16:02 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBDNFaff032023 for ; Thu, 13 Dec 2012 18:15:38 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBDNFajM004808; Thu, 13 Dec 2012 18:15:36 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.24984.463533.515455@world.std.com> Date: Thu, 13 Dec 2012 18:15:36 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <20121213205940.735FE24248@panix5.panix.com> References: <20682.3413.665708.640636@world.std.com> <20121213205940.735FE24248@panix5.panix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2012 23:16:07 -0000 On December 13, 2012 at 15:59 sethb@panix.com (Seth) wrote: > Barry Shein wrote: > > > There's also Jef Poskanzer's greymilter which basically requires one > > re-send from each never before seen mail server not in a white list. > > > > And sendmail (and others') HELO delay (delay sending HELO a short > > period of time) and don't speak until you're spoken to whatever they > > call it (I use it, the sender must wait for the SMTP responses, can't > > just dump an SMTP conversation at you.) > > > > They're basically isomorphic to hashcash type solutions, increase the > > sender's cost, but very transparent and quite clever because of that. > > They have nothing to do with increasing the sender's cost. Rather, > they take advantage of the fact that legitimate mailers implement the > RFCs in ways that spamware typically doesn't, so they test for that > and spamware flunks. Not true. They don't implement RFCs accurately because they're trying to send faster/cheaper. Even e-bay for example had a problem when this "demand they wait for a response" feature started to become popular because they too figured out they could just dump one side of the SMTP conversation w/o waiting for responses and it previously worked well enough and was much "cheaper" on their servers. Spamware did it because it was computationally and networktationally cheaper. Which is what hashcash et al is all about. And the same is true of making them re-try the first time (graylisting.) Again, not an argument for hashcash, just clarifying that it's all the same thing. It wasn't that they were poor at following RFCs, it was cheaper to carbitrage the protocol. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From clewis+ietf@mustelids.ca Thu Dec 13 17:05:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9626921F8AE2 for ; Thu, 13 Dec 2012 17:05:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.717 X-Spam-Level: X-Spam-Status: No, score=-0.717 tagged_above=-999 required=5 tests=[AWL=0.332, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yCttGw+9W-gu for ; Thu, 13 Dec 2012 17:05:08 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 864D521F8B1A for ; Thu, 13 Dec 2012 17:05:07 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBE150xn023361 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 13 Dec 2012 20:05:00 -0500 Message-ID: <50CA7B3C.70104@mustelids.ca> Date: Thu, 13 Dec 2012 20:05:00 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <20121213205940.735FE24248@panix5.panix.com> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 01:05:08 -0000 On 12-12-13 04:08 PM, Steve Atkins wrote: > And a lot of spamware doesn't flunk. The vast majority of spamware _still_ flunks. > It's the sort of thing that people tend to do because it makes them feel > like they're sticking one to spammers - which isn't a bad reason, by any > means, but doesn't lead towards optimal solutions. Tarpitting/teergrubing et. al. are normally what people try in a mistaken attempt to punish spammers. Supposedly you don't do that if it isn't spam, the problem being is that if you pick wrong, some legitimate email gets broken and some bad mail gets through. And there's no way you can punish a botnet enough to make any difference. Banner delay, MX tricks (ie: "no listing") aren't "punishment" methods, they're highly effective filtering techniques in their own right. They don't require that you guess right as to whether the email is spam or not. While dumb banner delay mechanisms can push damage and slow-downs back on the sender, intelligently designed ones don't have to. After all, if it passes a banner delay, you _know_ that the next time it connects it probably won't flunk either. So only the first connection (over however long you decide to "remember" it) suffers the delay. Secondly, in this day and age, increasing the average delivery time, say, by a factor of two, does NOT imply that the thruput per unit time goes down by a factor of two. Hint: multi-thread mail servers[+]. Bandwidth requirements don't change. [+] Relatively modest SMTP receivers _might_ have hundreds or even thousands of simultaneous live connections at any given moment (my traps do). So can senders. From bzs@world.std.com Thu Dec 13 17:11:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2F0821F8B01 for ; Thu, 13 Dec 2012 17:11:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.89 X-Spam-Level: X-Spam-Status: No, score=-2.89 tagged_above=-999 required=5 tests=[AWL=-0.531, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_LWSHORTT=1.24] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rwE4YkZD5AKX for ; Thu, 13 Dec 2012 17:11:05 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id E6DF721F8ADA for ; Thu, 13 Dec 2012 17:11:04 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBE1AfZO018562 for ; Thu, 13 Dec 2012 20:10:43 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBE1AfFb014211; Thu, 13 Dec 2012 20:10:41 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20682.31889.485606.165715@world.std.com> Date: Thu, 13 Dec 2012 20:10:41 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 01:11:05 -0000 Just "no" would have been sufficient. There's nothing wrong with liking the idea, but quantified is something else entirely. -b On December 13, 2012 at 15:10 steve@blighty.com (Steve Atkins) wrote: > > On Dec 13, 2012, at 2:52 PM, Barry Shein wrote: > > > > > On December 13, 2012 at 09:21 mike@mtcc.com (Michael Thomas) wrote: > >> On 12/13/2012 09:16 AM, Barry Shein wrote: > >>> There's also Jef Poskanzer's greymilter which basically requires one > >>> re-send from each never before seen mail server not in a white list. > >>> > >>> And sendmail (and others') HELO delay (delay sending HELO a short > >>> period of time) and don't speak until you're spoken to whatever they > >>> call it (I use it, the sender must wait for the SMTP responses, can't > >>> just dump an SMTP conversation at you.) > >>> > >>> They're basically isomorphic to hashcash type solutions, increase the > >>> sender's cost, but very transparent and quite clever because of that. > >>> > >> Given botnets, anything that tries to shift burden back onto the > >> sender is not very likely to be effective in the long run. Yes, you > >> might get some short term relief, but the firehose is just a software > >> update away. > > > > Has this been measured (reference)? Or is this just one of those > > "truisms" that kick around here? > > > > I'm thinking that a spammer has to put out on the order of a billion > > messages (attempts) per day to be interesting. > > > > If you slowed those down that would be a blow to them, a billion times > > even a little is a lot. > > The cost to spammers using almost free, botted systems is always going > to be a lot lower than the cost to legitimate senders using expensive, > well managed systems. > > Anything you do to make sending mail more expensive that isn't > pretty good at differentiating between legitimate and illegitimate > senders is going to harm legitimate senders disproportionately. > > You can buy a rooted asian box for <$5. ESP-grade MTAs and > management systems can be up in the tens of K per box - so > if you double the average delivery latency then you've cost the > spammer $5 and the legitimate sender $5000. That doesn't work. > > Cheers, > Steve > > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg From mike@mtcc.com Thu Dec 13 17:27:04 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 976BF21F8C02 for ; Thu, 13 Dec 2012 17:27:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[AWL=-0.620, BAYES_00=-2.599, SARE_LWSHORTT=1.24] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KWt0zNH16ZNh for ; Thu, 13 Dec 2012 17:27:04 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id D701421F8C01 for ; Thu, 13 Dec 2012 17:27:03 -0800 (PST) Received: from piolinux.mtcc.com (63-171-70-53.dsl.volcano.net [63.171.70.53] (may be forged)) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id qBE1QxVB016743 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 13 Dec 2012 17:27:00 -0800 Message-ID: <50CA805E.3010100@mtcc.com> Date: Thu, 13 Dec 2012 17:26:54 -0800 From: Michael Thomas User-Agent: Thunderbird 2.0.0.14 (X11/20080501) MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> In-Reply-To: <20682.23612.451287.246798@world.std.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1979; t=1355448421; x=1356312421; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20Re=3A=20[Asrg]=20An=20Anti-Spam=20Heuristic |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=XBjorcbUdnMqv+3O2LDYgf2MeHtmfgdOP00B3fFEg8s=; b=VN5ABD0j2/y3dBmfcehVvv272pTn8NJkgnpdIizPSc3rnBNk0qkj2jhKAm vmHTInAYoHHdJ/Yi/hIyrgbE+nkc/9rsRL4M7ovTheUsUgxH/+0YDDaHwWbV xA2RoHcIBMJNU1wueYEj3N5MXdFjd6G+8xGSaV6qtiN3hKPDtYaxg=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Cc: Barry Shein Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 01:27:04 -0000 Barry Shein wrote: > On December 13, 2012 at 09:21 mike@mtcc.com (Michael Thomas) wrote: > > On 12/13/2012 09:16 AM, Barry Shein wrote: > > > There's also Jef Poskanzer's greymilter which basically requires one > > > re-send from each never before seen mail server not in a white list. > > > > > > And sendmail (and others') HELO delay (delay sending HELO a short > > > period of time) and don't speak until you're spoken to whatever they > > > call it (I use it, the sender must wait for the SMTP responses, can't > > > just dump an SMTP conversation at you.) > > > > > > They're basically isomorphic to hashcash type solutions, increase the > > > sender's cost, but very transparent and quite clever because of that. > > > > > Given botnets, anything that tries to shift burden back onto the > > sender is not very likely to be effective in the long run. Yes, you > > might get some short term relief, but the firehose is just a software > > update away. > > Has this been measured (reference)? Or is this just one of those > "truisms" that kick around here? > > I'm thinking that a spammer has to put out on the order of a billion > messages (attempts) per day to be interesting. > > If you slowed those down that would be a blow to them, a billion times > even a little is a lot. > > Sure, we can postulate infinite botted systems I suppose. > > But that's still just a wild guess. > > I'm not arguing for hashcash per se, I think it has other problems, > but I also wonder if this counter-claim is really true. > > Or, put better, can we quantify it? If tarpitting and other such things were the FUSSP, then everybody would use them, and the unicorns would come out of hiding. If spammers haven't adjusted their botnet software, then it really says that there's no evolutionary pressure for them to do so. If there is, they will do so. What else would they do? Go out of business? They aren't stupid. Mike From clewis+ietf@mustelids.ca Thu Dec 13 20:07:53 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A301121F8BBA for ; Thu, 13 Dec 2012 20:07:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.055 X-Spam-Level: X-Spam-Status: No, score=-0.055 tagged_above=-999 required=5 tests=[AWL=-0.496, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id libAmmmBINwk for ; Thu, 13 Dec 2012 20:07:53 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF8D21F8B95 for ; Thu, 13 Dec 2012 20:07:52 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBE47kVU012362 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 13 Dec 2012 23:07:47 -0500 Message-ID: <50CAA612.3070000@mustelids.ca> Date: Thu, 13 Dec 2012 23:07:46 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> In-Reply-To: <50CA805E.3010100@mtcc.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 04:07:53 -0000 On 12-12-13 08:26 PM, Michael Thomas wrote: > If tarpitting and other such things were the FUSSP, then everybody would > use them, > and the unicorns would come out of hiding. If spammers haven't adjusted > their botnet > software, then it really says that there's no evolutionary pressure for > them to do so. > If there is, they will do so. What else would they do? Go out of > business? They aren't stupid. Enough of them have changed to indicate that there is _some_ pressure. Indeed, pure botnet was, until recently, generally responsible for 85-95% of all spam. Right now, tho, it's about 40% compromised Linux _servers_. Yes. Really. From clewis+ietf@mustelids.ca Thu Dec 13 20:39:25 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EBB021F8C0B for ; Thu, 13 Dec 2012 20:39:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.229 X-Spam-Level: X-Spam-Status: No, score=0.229 tagged_above=-999 required=5 tests=[AWL=-0.582, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dr2Ef5Tgpfsp for ; Thu, 13 Dec 2012 20:39:25 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 0FA2121F8C04 for ; Thu, 13 Dec 2012 20:39:24 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBE4dLsw015680 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 13 Dec 2012 23:39:22 -0500 Message-ID: <50CAAD79.8040008@mustelids.ca> Date: Thu, 13 Dec 2012 23:39:21 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <20682.31889.485606.165715@world.std.com> In-Reply-To: <20682.31889.485606.165715@world.std.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 04:39:25 -0000 Ooh, quantitative ;-) For grins, I took one of my smaller spamtraps and applied a 30 second banner delay. I wanted to quantify "And a lot of spamware doesn't flunk." In the timestamps below, the change happened at 04:52. Flow per minute: 156 2012/12/14-04:39 205 2012/12/14-04:40 189 2012/12/14-04:41 188 2012/12/14-04:42 167 2012/12/14-04:43 165 2012/12/14-04:44 181 2012/12/14-04:45 138 2012/12/14-04:46 185 2012/12/14-04:47 173 2012/12/14-04:48 152 2012/12/14-04:49 113 2012/12/14-04:50 156 2012/12/14-04:51 30 2012/12/14-04:52 46 2012/12/14-04:53 46 2012/12/14-04:54 63 2012/12/14-04:55 46 2012/12/14-04:56 55 2012/12/14-04:57 41 2012/12/14-04:58 51 2012/12/14-04:59 41 2012/12/14-05:00 30 2012/12/14-05:01 A 3:1 spam reduction is nothing to sneeze at. Not only that, but I can tell you that Lethic (Windows spambot) stopped dead in its tracks, and it looks like both Cutwail and Darkmailer2 (a combination of 2 or 3 Linux server infestation types) were affected severely too. This server flow is quite low, and isn't seeing flow from several other bots (eg: Kelihos and Festi) at the moment, so I don't know what other ones die. But it's a start. I'll have to try this on a few other bots, bigger traps and different delays. Oh, as a FYI, relatively few connections failed to wait for the banner. From adamsobieski@hotmail.com Thu Dec 13 20:50:00 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E091921F86A0 for ; Thu, 13 Dec 2012 20:50:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oXBlMwmZ458f for ; Thu, 13 Dec 2012 20:50:00 -0800 (PST) Received: from snt0-omc4-s28.snt0.hotmail.com (snt0-omc4-s28.snt0.hotmail.com [65.55.90.231]) by ietfa.amsl.com (Postfix) with ESMTP id 672B421F868E for ; Thu, 13 Dec 2012 20:50:00 -0800 (PST) Received: from SNT002-W117 ([65.55.90.201]) by snt0-omc4-s28.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 13 Dec 2012 20:50:00 -0800 X-EIP: [GJ2Fo1XHhTdIG7pKHPMvnYneXKZJgWgO] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_4ec9e0c6-e5d7-4253-a873-dd7517d6cb2d_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Fri, 14 Dec 2012 04:49:59 +0000 Importance: Normal In-Reply-To: <50CAA612.3070000@mustelids.ca> References: , , , <20682.3413.665708.640636@world.std.com>, <50CA0E91.2080304@mtcc.com>, <20682.23612.451287.246798@world.std.com>, <50CA805E.3010100@mtcc.com>, <50CAA612.3070000@mustelids.ca> MIME-Version: 1.0 X-OriginalArrivalTime: 14 Dec 2012 04:50:00.0063 (UTC) FILETIME=[78FB68F0:01CDD9B6] Subject: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 04:50:01 -0000 --_4ec9e0c6-e5d7-4253-a873-dd7517d6cb2d_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C =20 I have an idea to defend computers from botnets to reduce spam. On a compu= ter security topic=2C what do you think about the idea of utilizing one or = more P2P DHT's and the hashes of each file=2C or each important file=2C on = computers? Based upon the hardware specifications=2C platform=2C compiler= =2C and compiler version=2C the hashes of compiled item or downloaded binar= y items can be compared to the hashes of the files on other Linux servers. = That is an example of how P2P technologies can enhance Linux servers. Another security procedure=2C extending from that one=2C could be to remove= the disks=2C the hard drives=2C from computers=2C periodically=2C and to s= can the file systems and other disk sectors=2C using other computing device= s=2C to obtain the hashes of each file and to then utilize some resource=2C= e.g. a P2P DHT=2C to compare the hashes of those files to the hashes of th= e files on other computers. Kind regards=2C Adam Sobieski = --_4ec9e0c6-e5d7-4253-a873-dd7517d6cb2d_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C

=20 I have an idea to defend computers from botnets to reduce spam. On a compu= ter security topic=2C what do you think about the idea of utilizing one or = more P2P DHT's and the hashes of each file=2C or each important file=2C on = computers? Based upon the hardware specifications=2C platform=2C compiler= =2C and compiler version=2C the hashes of compiled item or downloaded binar= y items can be compared to the hashes of the files on other Linux servers. = That is an example of how P2P technologies can enhance Linux servers.

Another security procedure=2C extending from that one=2C could be to remove= the disks=2C the hard drives=2C from computers=2C periodically=2C and to s= can the file systems and other disk sectors=2C using other computing device= s=2C to obtain the hashes of each file and to then utilize some resource=2C= e.g. a P2P DHT=2C to compare the hashes of those files to the hashes of th= e files on other computers.



Kind regards=2C

Adam Sobieski
= --_4ec9e0c6-e5d7-4253-a873-dd7517d6cb2d_-- From clewis+ietf@mustelids.ca Thu Dec 13 21:44:27 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 310A121F89DF for ; Thu, 13 Dec 2012 21:44:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.603 X-Spam-Level: X-Spam-Status: No, score=-0.603 tagged_above=-999 required=5 tests=[AWL=0.445, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KskvVkFaqjOy for ; Thu, 13 Dec 2012 21:44:26 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id CB88121F89D0 for ; Thu, 13 Dec 2012 21:44:25 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBE5iKl6022876 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 14 Dec 2012 00:44:21 -0500 Message-ID: <50CABCB4.1030103@mustelids.ca> Date: Fri, 14 Dec 2012 00:44:20 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: , , , <20682.3413.665708.640636@world.std.com>, <50CA0E91.2080304@mtcc.com>, <20682.23612.451287.246798@world.std.com>, <50CA805E.3010100@mtcc.com>, <50CAA612.3070000@mustelids.ca> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 05:44:27 -0000 On 12-12-13 11:49 PM, Adam Sobieski wrote: > Internet Research Task Force, > Anti-Spam Research Group, > > I have an idea to defend computers from botnets to reduce spam. On a > computer security topic, what do you think about the idea of utilizing > one or more P2P DHT's and the hashes of each file, or each important > file, on computers? Based upon the hardware specifications, platform, > compiler, and compiler version, the hashes of compiled item or > downloaded binary items can be compared to the hashes of the files on > other Linux servers. That is an example of how P2P technologies can > enhance Linux servers. Obviously, it can't be all files. Otherwise, all computers would be identical ;-) Then you have to consider all the versions of the code. Then the highly idiosyncratic mix of other software versions that may be on the machine in unusual places. Etc. This is more-or-less a distributed version of tripwire (which dates back to the 1980's, IIRC, introduced in an early edition of Gene Spafford's UNIX Security O'Reilly book), or, for somewhat newer stuff, consider rkhunter & "rkhunter --propupd". I worked for a company in the mid 80's that did this in a semi-distributed fashion. While I'm not intimately familiar with all versions of Linux spamware, you have the following considerations: - As far as I am aware, Linux spam compromises relatively seldom involve replacing existing programs. They're entirely new files, often in unusual places. You're unlikely to have something to compare checksums against. Then what? - A lot of compromises involve changed config files. What does a checksum comparison of a config file to other machines mean? Nothing. You can tripwire them, but in busy multi-hosting environments, you'll get flooded with false positives. - A large class of compromises are based around programs you _can't_ find on disk. Each spamrun begins with: download program, start program, program removes its own files, start spamming. There's nothing to checksum for more than a few seconds. - Many hosting environments can have multiple versions of the same code (especially stuff like Wordpress or Joomla) operating simultaneously. How does the code know what to compare checksums with? Such techniques sound promising, but once you get into trying to run one of them in a large enough scale to do something useful, you find out it's a lot harder than it looks, and not nearly as effective as you'd like. I run rkhunter. I run Rkhunter to see if I can tell people to use it to find compromises. I keep throwing infections on the machine (but don't start them). It hasn't found any of them... Sigh. [rkhunter has an explicit "rootkit finder" module in addition to its tripwire capability. I don't know how the RK finder works (they don't say ;-) - I'm sure I could find out but...), but, it's not finding the darkmailer and r57shell and ... tidbits I'm laying around as bait... So...] > Another security procedure, extending from that one, could be to remove > the disks, the hard drives, from computers, periodically, and to scan > the file systems and other disk sectors, using other computing devices, > to obtain the hashes of each file and to then utilize some resource, > e.g. a P2P DHT, to compare the hashes of those files to the hashes of > the files on other computers. That'd go over really well in large-scale production multi-hosting environments.... ;-) You don't have to go that far. Boot from CD. Or see how tripwire gets around this. From martijn.grooten@virusbtn.com Fri Dec 14 02:26:14 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DB5621F86EE for ; Fri, 14 Dec 2012 02:26:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J9h19+9-QIOE for ; Fri, 14 Dec 2012 02:26:13 -0800 (PST) Received: from mx3.sophos.com (mx3.sophos.com [216.47.234.212]) by ietfa.amsl.com (Postfix) with ESMTP id 486A721F85DC for ; Fri, 14 Dec 2012 02:26:12 -0800 (PST) Received: from mx3.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id ABD9118853F for ; Fri, 14 Dec 2012 10:26:10 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos (abn-exch1a.green.sophos [10.100.70.61]) by mx3.sophos.com (Postfix) with ESMTPS id 41670188296 for ; Fri, 14 Dec 2012 10:26:10 +0000 (GMT) Received: from abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352]) by ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d%16]) with mapi id 14.02.0247.003; Fri, 14 Dec 2012 10:26:08 +0000 From: Martijn Grooten To: "Anti-Spam Research Group - IRTF (asrg@irtf.org)" Thread-Topic: [Asrg] An Anti-Spam Heuristic Thread-Index: AQHN2NNKMjkbYNoATEiNbgKMLcuwUJgWw76AgAAWXICAAD0lgIAARIwAgACywzA= Date: Fri, 14 Dec 2012 10:26:07 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AEFD3A@abn-exch1b.green.sophos> References: <20121213140359.GA2187@gsp.org> <121213072401.ZM29345@torch.brasslantern.com> <20121213190251.GE37893@verdi> <20682.24540.349183.905192@world.std.com> In-Reply-To: <20682.24540.349183.905192@world.std.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.103.139] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 10:26:14 -0000 > But, in a sentence, creating an economy around spam-fighting, an economic > incentive to fight fraud, would help because money focuses the mind. I think it's good to keep in mind that we (the anti-spam industry/community= ) are actually doing rather well at blocking spam. Catch rates are extremel= y high, false positive rates quite low. There's definitely still room for i= mprovement, particularly among the edges, but if you want to argue for a ne= w way to fight spam, especially one that radically changes the way email wo= rks, you will have to explain why it will work even better. What we're particularly good at, is fighting botnet spam. Global spam level= s have decreased in the past four years, largely due to a significant decre= ase in spam sent via botnets. What is still being sent is relatively easy t= o block. Botnet resources, vast as they may be, are ultimately limited and botnets c= ome with a price tag too (literally, on the underground market). And the pr= ofit margins on spam, especially botnet spam, are already extremely small. = So it may well be that someone will come up with a very clever way of incre= asing the cost of sending spam via botnets that will make it financially un= interesting for botherders to do so. I seriously wonder how much this would= improve things. Of all the things bad guys can do with botnets, sending sp= am does relatively little harm, and because it involves doing something tha= t home PCs generally aren't supposed to do (namely making outbound connecti= ons on TCP port 25), it helps ISPs detect infected customers. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From adamsobieski@hotmail.com Fri Dec 14 04:04:45 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40A6621F8512 for ; Fri, 14 Dec 2012 04:04:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fZpUDru+jJ7p for ; Fri, 14 Dec 2012 04:04:44 -0800 (PST) Received: from snt0-omc4-s28.snt0.hotmail.com (snt0-omc4-s28.snt0.hotmail.com [65.55.90.231]) by ietfa.amsl.com (Postfix) with ESMTP id BA01D21F8504 for ; Fri, 14 Dec 2012 04:04:44 -0800 (PST) Received: from SNT002-W136 ([65.55.90.199]) by snt0-omc4-s28.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Fri, 14 Dec 2012 04:04:43 -0800 X-EIP: [HlpZ9gcAvpD4dr6RM9cKFOPCbc+YrT6Q] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_aaa87e4f-9a2f-400b-b815-aac3d7750ae2_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Fri, 14 Dec 2012 12:04:42 +0000 Importance: Normal In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20AEFD3A@abn-exch1b.green.sophos> References: , <20121213140359.GA2187@gsp.org>, <121213072401.ZM29345@torch.brasslantern.com> <20121213190251.GE37893@verdi>, <20682.24540.349183.905192@world.std.com>, <0D79787962F6AE4B84B2CC41FC957D0B20AEFD3A@abn-exch1b.green.sophos> MIME-Version: 1.0 X-OriginalArrivalTime: 14 Dec 2012 12:04:43.0947 (UTC) FILETIME=[34303FB0:01CDD9F3] Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 12:04:45 -0000 --_aaa87e4f-9a2f-400b-b815-aac3d7750ae2_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C Martijn Grooten=2C Rich Kulawiec=2C Greetings. Earlier in our discussion=2C the ITU WCIT conference in Dubai wa= s mentioned=2C and I would like to express my opinion to you that=2C like m= any scientists=2C I oppose regulation of the Internet and of the Web=2C by = either the United States or the United Nations. Some participants at the I= TU WCIT conference did broach spam topics and there were concerns about reg= ulatory approaches. I agree with what Rich Kulawiec said about the value to society of the nume= rous mailing lists of scientists addressing the spam problems=2C including = the IRTF Anti-Spam Research Group=2C and I agree with Martijn Grooten's ind= ication that the anti-spam industry / community has been doing well at bloc= king spam and working to address and to solve any remaining spam problems. = Science=2C not regulation=2C is where solutions come from. Kind regards=2C =20 Adam Sobieski = --_aaa87e4f-9a2f-400b-b815-aac3d7750ae2_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C
Martijn Grooten=2C
Rich Kulawiec=2C

Greetings. Earlier in our discussion=2C the ITU WCIT conference in Dubai wa= s mentioned=2C and I would like to express my opinion to you that=2C like m= any scientists=2C I oppose regulation of the Internet and of the Web=2C by = either the United States or the United Nations. Some participants at the I= TU WCIT conference did broach spam topics and there were concerns about reg= ulatory approaches.

I agree with what Rich Kulawiec said about the value to society of the nume= rous mailing lists of scientists addressing the spam problems=2C including = the IRTF Anti-Spam Research Group=2C and I agree with Martijn Grooten's ind= ication that the anti-spam industry / community has been doing well at bloc= king spam and working to address and to solve any remaining spam problems. = Science=2C not regulation=2C is where solutions come from.



Kind regards=2C

=20 Adam Sobieski
= --_aaa87e4f-9a2f-400b-b815-aac3d7750ae2_-- From rsk@gsp.org Fri Dec 14 05:39:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D22821F86E9 for ; Fri, 14 Dec 2012 05:39:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.449 X-Spam-Level: X-Spam-Status: No, score=-6.449 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pV9GyUYXGfoZ for ; Fri, 14 Dec 2012 05:39:46 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id 797AC21F86D9 for ; Fri, 14 Dec 2012 05:39:46 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qBEDdhtt002319 for ; Fri, 14 Dec 2012 08:39:44 -0500 (EST) Date: Fri, 14 Dec 2012 08:39:37 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121214133937.GA23699@gsp.org> References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50CABCB4.1030103@mustelids.ca> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 13:39:47 -0000 In addition to Chris's excellent comments: - Connecting a [Linux or other] server to a P2P network may not be possible or desirable in many/most instances. - Use of a technique like this might leak information on which software is installed, which versions, etc. - It will trigger false positives whenever software is upgraded/patched. (I say "will" because very long experience with tripwire and similar taught me this a long time ago.) - If the server has been subverted, then this mechanism can also be subverted. - Linux systems are not a significant component of botnets. I've been doing passive OS fingerprinting for most of a decade, and they're in the noise floor. It's still true now, as it was years ago, that bot-originated spam comes from Windows systems to about six 9's. - Better techniques already exist, such a firewalling outbound port 25 by default and only punching holes for systems that actually need to send mail. Another example: monitoring the TCP connection rate to port 25 on remote systems -- spam-senders are likely to push it much higher than "normal". ---rsk From adamsobieski@hotmail.com Fri Dec 14 06:11:51 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1066F21F8741 for ; Fri, 14 Dec 2012 06:11:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yWHCmCnwm57r for ; Fri, 14 Dec 2012 06:11:50 -0800 (PST) Received: from snt0-omc4-s32.snt0.hotmail.com (snt0-omc4-s32.snt0.hotmail.com [65.55.90.235]) by ietfa.amsl.com (Postfix) with ESMTP id 2405221F8740 for ; Fri, 14 Dec 2012 06:11:50 -0800 (PST) Received: from SNT002-W208 ([65.55.90.201]) by snt0-omc4-s32.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Fri, 14 Dec 2012 06:11:49 -0800 X-EIP: [ULy8Dsv0t+PkaerbclgbnqRxSkTBk2AX] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_cd51fd00-2791-4fe3-b93b-efb0428f6655_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Fri, 14 Dec 2012 14:11:49 +0000 Importance: Normal In-Reply-To: <50CABCB4.1030103@mustelids.ca> References: , , , , , , <20682.3413.665708.640636@world.std.com>, , <50CA0E91.2080304@mtcc.com>, , <20682.23612.451287.246798@world.std.com>, , <50CA805E.3010100@mtcc.com>, , <50CAA612.3070000@mustelids.ca>, , <50CABCB4.1030103@mustelids.ca> MIME-Version: 1.0 X-OriginalArrivalTime: 14 Dec 2012 14:11:49.0662 (UTC) FILETIME=[F57803E0:01CDDA04] Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 14:11:51 -0000 --_cd51fd00-2791-4fe3-b93b-efb0428f6655_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C Thank you for the information Chris and Rich. A summary of that idea could = then be a distributed version of Tripwire=2C adding P2P=2C e.g. distributed= hash tables=2C or other distributed and decentralized algorithms=2C to sof= tware approaches like Tripwire. P2P networks can facilitate such software h= aving access to data from numerous other computers. With such P2P techniques=2C Windows systems could be easier to secure than = some Linux systems. In the data about various Linux systems and servers=2C = however=2C we might see identically configured systems=2C systems running t= he freshest versions of various Linux distributions and the freshest versio= ns of each of a set of applications. On the topic of countering botnets to reduce spam=2C and on the topic of th= e approach of seeking to keep well-informed any interested computer scienti= sts about developments=2C and on the topic of distributed and decentralized= applications=2C we can consider decentralized and distributed systems=2C w= ith all-to-all messaging capability=2C where any users can upload a message= and any users can download a message. In many system designs with user-gen= erated content=2C countering spam is topical=2C including systems for disse= minating instantaneous information to computer scientists about securing co= mputers and computer networks=2C countering botnets to reduce spam. Blogs could be an implementation of all-to-all messaging where folksonomic = tags could be utilized=2C from a vocabulary=2C to describe specific compute= r system configurations and situations. Usenet=2C or NNTP=2C could be utilized by computer scientists and would be = more convenient with a means of prefixing message subject strings to indica= te computer configurations. Email and mailing lists could be utilized in an implementation=2C as well= =2C with the same topic about subject string prefixes to indicate the compu= ter configurations discussed in the message. In each of those examples is the problem of spam. As an aside=2C we could version NNTP=2C as well as email-related protocols= =2C to include metadata-related enhancements=2C for purposes including sear= chability=2C potentially metadata models beyond those of blog articles. In addition to blogs=2C Usenet and mailing lists=2C there exist P2P system = designs for all-to-all messaging=3B for example=2C based upon file-sharing = networks. In such systems=2C any computer scientist could upload a computer= security related message=2C with metadata indicating topical specific comp= uter configurations=2C and any computer scientist=2C seeking to receive mes= sages about a set of specific computer configurations=2C could download suc= h messages from uploaders as they arrive. Metadata-based search of objects = on distributed systems=2C P2P systems=2C could then be topical. Metadata=2C again=2C beyond that of blog articles=2C can enhance blogs=2C U= senet=2C email and P2P systems. Systems can be designed to facilitate the w= ell-informedness of computer scientists by computer scientists towards secu= ring computer systems including to prevent botnets which can eliminate or r= educe spam. That is=2C an information distribution network for computer sec= urity messages can enhance computer and computer network security. In each described system with user-generated content=2C countering spam enh= ances usability=2C utility=2C and user experience. As a proponent of public= forums=2C preventing spam on Usenet is an interesting topic which pertains= to promoting free speech and civil discourse. Do any of you know of any d= etailed reports or analyses about Usenet spam data=2C archived Usenet data= =2C or statistics=2C possibly correlations at the granularity of specific f= orums=2C thread topics=2C or discussion events? Kind regards=2C Adam Sobieski = --_cd51fd00-2791-4fe3-b93b-efb0428f6655_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C

Thank you for the information Chris and Rich. A summary of that idea could = then be a distributed version of Tripwire=2C adding P2P=2C e.g. distributed= hash tables=2C or other distributed and decentralized algorithms=2C to sof= tware approaches like Tripwire. P2P networks can facilitate such software h= aving access to data from numerous other computers.

With such P2P techniques=2C Windows systems could be easier to secure than = some Linux systems. In the data about various Linux systems and servers=2C = however=2C we might see identically configured systems=2C systems running t= he freshest versions of various Linux distributions and the freshest versio= ns of each of a set of applications.

On the topic of countering botnets to reduce spam=2C and on the topic of th= e approach of seeking to keep well-informed any interested computer scienti= sts about developments=2C and on the topic of distributed and decentralized= applications=2C we can consider decentralized and distributed systems=2C w= ith all-to-all messaging capability=2C where any users can upload a message= and any users can download a message. In many system designs with user-gen= erated content=2C countering spam is topical=2C including systems for disse= minating instantaneous information to computer scientists about securing co= mputers and computer networks=2C countering botnets to reduce spam.

Blogs could be an implementation of all-to-all messaging where folksonomic = tags could be utilized=2C from a vocabulary=2C to describe specific compute= r system configurations and situations.

Usenet=2C or NNTP=2C could be utilized by computer scientists and would be = more convenient with a means of prefixing message subject strings to indica= te computer configurations.

Email and mailing lists could be utilized in an implementation=2C as well= =2C with the same topic about subject string prefixes to indicate the compu= ter configurations discussed in the message.

In each of those examples is the problem of spam.

As an aside=2C we could version NNTP=2C as well as email-related protocols= =2C to include metadata-related enhancements=2C for purposes including sear= chability=2C potentially metadata models beyond those of blog articles.

In addition to blogs=2C Usenet and mailing lists=2C there exist P2P system = designs for all-to-all messaging=3B for example=2C based upon file-sharing = networks. In such systems=2C any computer scientist could upload a computer= security related message=2C with metadata indicating topical specific comp= uter configurations=2C and any computer scientist=2C seeking to receive mes= sages about a set of specific computer configurations=2C could download suc= h messages from uploaders as they arrive. Metadata-based search of objects = on distributed systems=2C P2P systems=2C could then be topical.

Metadata=2C again=2C beyond that of blog articles=2C can enhance blogs=2C U= senet=2C email and P2P systems. Systems can be designed to facilitate the w= ell-informedness of computer scientists by computer scientists towards secu= ring computer systems including to prevent botnets which can eliminate or r= educe spam. That is=2C an information distribution network for computer sec= urity messages can enhance computer and computer network security.

In each described system with user-generated content=2C countering spam enh= ances usability=2C utility=2C and user experience. As a proponent of public= forums=2C preventing spam on Usenet is an interesting topic which pertains= to promoting free speech and civil discourse. Do any of you know of any d= etailed reports or analyses about Usenet spam data=2C archived Usenet data= =2C or statistics=2C possibly correlations at the granularity of specific f= orums=2C thread topics=2C or discussion events?



Kind regards=2C

Adam Sobieski
= --_cd51fd00-2791-4fe3-b93b-efb0428f6655_-- From clewis+ietf@mustelids.ca Fri Dec 14 07:08:53 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B750821F85C9 for ; Fri, 14 Dec 2012 07:08:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.667 X-Spam-Level: X-Spam-Status: No, score=-0.667 tagged_above=-999 required=5 tests=[AWL=0.381, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jdihbR2M8tdJ for ; Fri, 14 Dec 2012 07:08:53 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 2655121F85C3 for ; Fri, 14 Dec 2012 07:08:52 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBEF8mXd021580 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 14 Dec 2012 10:08:48 -0500 Message-ID: <50CB4100.2020408@mustelids.ca> Date: Fri, 14 Dec 2012 10:08:48 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> <20121214133937.GA23699@gsp.org> In-Reply-To: <20121214133937.GA23699@gsp.org> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 15:08:53 -0000 On 12-12-14 08:39 AM, Rich Kulawiec wrote: > - Linux systems are not a significant component of botnets. I've been > doing passive OS fingerprinting for most of a decade, and they're in > the noise floor. It's still true now, as it was years ago, that > bot-originated spam comes from Windows systems to about six 9's. If only that were still true. Sorry Rich. Compromised Linux machines (mostly servers) are now responsible for ~40% of all spam. The actual _count_ of compromised Linux machines is indeed quite low. Say 62K out of 8.6M observed compromised machines. About .72%. Two 9's ;-) But prolific? I have individual IPs out in the wild that have shoved >1M spams into a single trap in <48 hours. I have a copy of one of these bots. I periodically run it on a wimpy dual-Atom linux laptop to characterize what it's sending at the time. It shoves 65 spams per _second_. Imagine what a real server could do on industrial grade connections. And the machine owners don't notice! > - Better techniques already exist, such a firewalling outbound port 25 > by default and only punching holes for systems that actually need to > send mail. Another example: monitoring the TCP connection rate to > port 25 on remote systems -- spam-senders are likely to push it much > higher than "normal". Unfortunately,, getting people to deploy those is worse than pulling teeth. From rsk@gsp.org Fri Dec 14 09:45:07 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB74F21F8A80 for ; Fri, 14 Dec 2012 09:45:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.47 X-Spam-Level: X-Spam-Status: No, score=-6.47 tagged_above=-999 required=5 tests=[AWL=0.129, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CoRYZCw2nhTw for ; Fri, 14 Dec 2012 09:45:06 -0800 (PST) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id 3ED8621F8A7D for ; Fri, 14 Dec 2012 09:45:06 -0800 (PST) Received: from gsp.org (bltmd-207.114.17.210.dsl.charm.net [207.114.17.210]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id qBEHj2KF014430 for ; Fri, 14 Dec 2012 12:45:03 -0500 (EST) Date: Fri, 14 Dec 2012 12:44:57 -0500 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20121214174457.GA18374@gsp.org> References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> <20121214133937.GA23699@gsp.org> <50CB4100.2020408@mustelids.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50CB4100.2020408@mustelids.ca> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2012 17:45:07 -0000 On Fri, Dec 14, 2012 at 10:08:48AM -0500, Chris Lewis wrote: > Compromised Linux machines (mostly servers) are now responsible for ~40% > of all spam. > > The actual _count_ of compromised Linux machines is indeed quite low. > Say 62K out of 8.6M observed compromised machines. About .72%. Two 9's ;-) I believe you. This suggests two possibilities: 1. Somethings's broken somewhere in my experimental design between data acquisition and statistical analysis. or 2. We're talking apples and oranges and that's why our numbers are so different. To clarify: I'm not trying to measure spam volume, just the number of systems (and their OS types). And to clarify further: I classify a system as a bot if it meets a set of criteria that includes more than sending spam: I may also classify it as a bot if it's doing brute-force SSH/FTP/IMAP/etc. attacks, if it's doing port scans, etc. (The "may" is there because some systems engaged in these activities don't appear to be bots. Of course that's a judgment call and I'm sure I make FP and FN mistakes.) For example, if 190.147.78.102 (Static-IP-cr19014778102.cable.net.co, thus probably in Colombia) makes 133 different IMAP login attempts, I'm going to conclude that it's not a bored user in Bogota with nothing better to do, it's most likely a bot doing that. Do you think #2 explains the difference in our numbers, or do I have to make a LOT of coffee and dig into #1? ---rsk From johnl@iecc.com Fri Dec 14 17:08:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E01A121F88C1 for ; Fri, 14 Dec 2012 17:08:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.699 X-Spam-Level: X-Spam-Status: No, score=-108.699 tagged_above=-999 required=5 tests=[AWL=2.500, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iHCnlqYTg-ct for ; Fri, 14 Dec 2012 17:08:32 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 9940021F88BC for ; Fri, 14 Dec 2012 17:08:31 -0800 (PST) Received: (qmail 40588 invoked from network); 15 Dec 2012 01:08:29 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 15 Dec 2012 01:08:29 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbcd8d.xn--btvx9d.k1212; i=johnl@user.iecc.com; bh=EZcaHwIRj6Hhexvzf8L6d312qN6IMNpM+roZE8U4l+s=; b=nxGCJwm+Es6oqhfjQsIE78REiqgH/vqrV3YGL7NeYvt+cc4QfKNnK8y4/K9inWGjArkPoivgbVn1SqCQ5xl/xa+Avk/ZIh4HdRdcO6FASlxDjwm2vxNAeGjVt8VLqgLNKDCvMtJ5Cppl4r8r7XskBuj/cGF1WUGHK75nw2l2Pxc= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbcd8d.xn--btvx9d.k1212; olt=johnl@user.iecc.com; bh=EZcaHwIRj6Hhexvzf8L6d312qN6IMNpM+roZE8U4l+s=; b=f2RyINs0VdY+VRIRRVDJgYRU4KSWDgLjqoZgZf/+JU7E4u+RJFrTg2u/XCW7bFOP/CEMr89VRTPh45na2dI0Xy6S2iHkmDxqVaL/ePB1FY7Q9hvl4pNOBEEPz1xHQhG8v9NbJgnxIGLj+jwjP/UBozae1ky8g8OErkp7V9svcgk= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 15 Dec 2012 01:08:07 -0000 Message-ID: <20121215010807.54445.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 01:08:33 -0000 >after tens of seconds) or when they are (greylisting in particular really >breaks active mailing lists, by reordering discussions into a fairly random >order). Sounds like a badly broken greylister. Mine still deters a remarkable amount of spam, but since it whitelists every IP that's retried, its effect on normal mail is quite tiny. From johnl@iecc.com Fri Dec 14 17:12:18 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A8B221F8AC6 for ; Fri, 14 Dec 2012 17:12:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.777 X-Spam-Level: X-Spam-Status: No, score=-108.777 tagged_above=-999 required=5 tests=[AWL=2.422, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4+s21FDPXm4l for ; Fri, 14 Dec 2012 17:12:17 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 818E521F8AA4 for ; Fri, 14 Dec 2012 17:12:17 -0800 (PST) Received: (qmail 41351 invoked from network); 15 Dec 2012 01:12:16 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 15 Dec 2012 01:12:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbce70.xn--i8sz2z.k1212; i=johnl@user.iecc.com; bh=l4StrgjuGXBq9M9nsbgISqlV+viq9Ybboe3rnzi3upo=; b=Cn1jSIZrXVrwPLDVBfPTq3pFRjNxgCgqmAUgAzmQF6Fv/JtvRRkb5dNgMIvqZiRPv7yyHMzgCpuiJzihzfUHV+RDJ4Vnl9EQuF9A1RXdkvzht9tzdCeYRxwrvHbJ4TqzHls8sFWv55N5JSUoMkvn98qFjoXNt4nqf4cPpxAYxMc= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbce70.xn--i8sz2z.k1212; olt=johnl@user.iecc.com; bh=l4StrgjuGXBq9M9nsbgISqlV+viq9Ybboe3rnzi3upo=; b=aKYJUPXlrxa945EO+AVg/6dyMzZjV9CsUaqOhWgpfGu3kb1boBKz3vPicfuq6dwKqOv5vZDLQbUT2oxze1JZbTj0OlPxYUN6+S5DhgMtxbqON7Vs0gAFv5f2HD38nFTsaLteySE9DdDXX6Gm28EbN05Ik4lDw1+q4tzbX+sE+4g= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 15 Dec 2012 01:11:54 -0000 Message-ID: <20121215011154.54619.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <20682.24984.463533.515455@world.std.com> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 01:12:18 -0000 >They don't implement RFCs accurately because they're trying to send >faster/cheaper. Actually, a lot of it is still because they're sloppy and inept. Not all spammers are stupid, but a lot of them are. This one, for example (I know, I was there): http://www.justice.gov/usao/nj/Press/files/Rad,%20Christopher%20Verdict%20PR.html >Even e-bay for example had a problem when this "demand they wait for a >response" feature started to become popular because they too figured >out they could just dump one side of the SMTP conversation w/o waiting >for responses and it previously worked well enough and was much >"cheaper" on their servers. That was just broken. There's a perfectly well specified way to do SMTP pipelining, which lets clients skip most of the waits without losing the responses. R's, John From johnl@iecc.com Fri Dec 14 17:17:58 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 232DF21F8AD8 for ; Fri, 14 Dec 2012 17:17:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.7 X-Spam-Level: X-Spam-Status: No, score=-106.7 tagged_above=-999 required=5 tests=[AWL=0.199, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kUguxvjd7GM for ; Fri, 14 Dec 2012 17:17:57 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 5A84621F8AD0 for ; Fri, 14 Dec 2012 17:17:57 -0800 (PST) Received: (qmail 42693 invoked from network); 15 Dec 2012 01:17:56 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 15 Dec 2012 01:17:56 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbcfc4.xn--3zv.k1212; i=johnl@user.iecc.com; bh=GZhrJAsjwmBWpHGvxrs7FqvSYL7vQTq7lVTgjPqL5Cw=; b=jD+txq0Zt5gn4gRv+RTy4qrTSOiF2HsWMVSPGWrzS152ihfomVl1h750ly6zolvismZOQ+2MJf9YDtGFqSeiNO0Y3NMfMId8DpLE3d+RbtqSzAdgZ9k7sT4UB72RcuJvixgavwlhCeWGeoDKmm0iVRGh0lCJ5BlLE3gaXLSpWec= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cbcfc4.xn--3zv.k1212; olt=johnl@user.iecc.com; bh=GZhrJAsjwmBWpHGvxrs7FqvSYL7vQTq7lVTgjPqL5Cw=; b=pv7ZJ5wE0mtPH1MxOwBs47orbhCoxkgNknbKhEBSU+lavFPU1aLaCdoedgcJnB27aJ5hpyHJSv+G9i+wmHsidrso/DdoA8ynNCqFw1CqavXAOpAVFRjAKTecABigrZSfEj9gUNFC75fW2HQ1rSx1wa44E3bhJ8uIzRjI+mXQ1Zs= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 15 Dec 2012 01:17:34 -0000 Message-ID: <20121215011734.54813.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 01:17:58 -0000 >Thank you for the information Chris and Rich. A summary of that idea >could then be a distributed version of Tripwire, adding P2P, e.g. >distributed hash tables, or other distributed and decentralized >algorithms, to software approaches like Tripwire. ... Other than the magic term P2P, what does this provide above what packages like Tripwire do now? Any particular distribution of Linux is installed from a known set of masters, where the files have known checksums. The checksums are not large, and are not a big deal to retrieve. What does P2P add? Random other Linux boxes are certainly not more likely to have a set of good checksums than, say, an https server run by a well known distribution organization. From clewis+ietf@mustelids.ca Fri Dec 14 19:15:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B65C21F8AE2 for ; Fri, 14 Dec 2012 19:15:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.086 X-Spam-Level: * X-Spam-Status: No, score=1.086 tagged_above=-999 required=5 tests=[AWL=-1.466, BAYES_50=0.001, FH_RELAY_NODNS=1.451, GB_PHARMACY=1, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2m50SRnx-9zr for ; Fri, 14 Dec 2012 19:15:45 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 739D621F8ACA for ; Fri, 14 Dec 2012 19:15:44 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBF3Fb5W005214 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 14 Dec 2012 22:15:38 -0500 Message-ID: <50CBEB59.8080203@mustelids.ca> Date: Fri, 14 Dec 2012 22:15:37 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <20682.31889.485606.165715@world.std.com> <50CAAD79.8040008@mustelids.ca> In-Reply-To: <50CAAD79.8040008@mustelids.ca> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 03:15:46 -0000 On 12-12-13 11:39 PM, Chris Lewis wrote: > I'll have to try this on a few other bots, bigger traps and different > delays. As a FYI, I tried it again. It looks like Kelihos and Festi are also stopped dead in their tracks by a 30 second banner delay. That means that all of the currently high-volume spambots, except Cutwail and Darkmailer (usually Linux) are stopped by a 30 second delay. Kelihos is alternately spewing HUGE quantities of viral infectors and Toronto Pharmacy pillz spam. Festi is trying to spew huge quantities of Canadian Pharmacy Pillz spam. There are many versions of cutwail in the field, under the control of at least a dozen different operators. It's quite possible that a 30 second delay impairs some of them and longer delays will impair yet more. OTOH, cutwail has multiple operating modes (including AUTH cracking) which wouldn't be impacted by banner delays. It looks like the darkmailerish code I have has 60 second timeouts. From clewis+ietf@mustelids.ca Fri Dec 14 19:23:30 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF09F21F86A5 for ; Fri, 14 Dec 2012 19:23:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.378 X-Spam-Level: X-Spam-Status: No, score=0.378 tagged_above=-999 required=5 tests=[AWL=-0.433, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ibDXFbgOSDkZ for ; Fri, 14 Dec 2012 19:23:30 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 5A91721F866E for ; Fri, 14 Dec 2012 19:23:30 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBF3NT0R005789 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 14 Dec 2012 22:23:29 -0500 Message-ID: <50CBED31.2030308@mustelids.ca> Date: Fri, 14 Dec 2012 22:23:29 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20121215011734.54813.qmail@joyce.lan> In-Reply-To: <20121215011734.54813.qmail@joyce.lan> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 03:23:31 -0000 On 12-12-14 08:17 PM, John Levine wrote: > Other than the magic term P2P, what does this provide above what > packages like Tripwire do now? Any particular distribution of Linux > is installed from a known set of masters, where the files have known > checksums. The checksums are not large, and are not a big deal to > retrieve. What does P2P add? Random other Linux boxes are certainly > not more likely to have a set of good checksums than, say, an https > server run by a well known distribution organization. I _suppose_ it might make it a bit more feasible to obtain checksums of random code that isn't necessarily in sync with a Linux dist. In many hosting environments, there can be literally as many versions of, say, Wordpress, as there are customers. The admins steadily patch the basic O/S, but often they won't touch the customer's images for fear of breaking them. Or virtualized systems. Just imagine how many different O/S images there are on a cloud. Eg: Amazon expects the customer to do their _own_ patching. I really don't think the idea would work in the end of the industry (cloud, multi-host platforms) that need it most. From clewis+ietf@mustelids.ca Fri Dec 14 19:46:35 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78B1421F8AAE for ; Fri, 14 Dec 2012 19:46:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.508 X-Spam-Level: X-Spam-Status: No, score=-0.508 tagged_above=-999 required=5 tests=[AWL=0.540, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ehetlU25NqjV for ; Fri, 14 Dec 2012 19:46:35 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id B2CFB21F88CC for ; Fri, 14 Dec 2012 19:46:34 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBF3kTff008490 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Fri, 14 Dec 2012 22:46:29 -0500 Message-ID: <50CBF295.4090709@mustelids.ca> Date: Fri, 14 Dec 2012 22:46:29 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> <20121214133937.GA23699@gsp.org> <50CB4100.2020408@mustelids.ca> <20121214174457.GA18374@gsp.org> In-Reply-To: <20121214174457.GA18374@gsp.org> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 03:46:35 -0000 On 12-12-14 12:44 PM, Rich Kulawiec wrote: > On Fri, Dec 14, 2012 at 10:08:48AM -0500, Chris Lewis wrote: >> Compromised Linux machines (mostly servers) are now responsible for ~40% >> of all spam. >> >> The actual _count_ of compromised Linux machines is indeed quite low. >> Say 62K out of 8.6M observed compromised machines. About .72%. Two 9's ;-) > > I believe you. Would I lie to you Rich? ;-) Let me remind you of what you said: >> - Linux systems are not a significant component of botnets. I've been >> doing passive OS fingerprinting for most of a decade, and they're in >> the noise floor. It's still true now, as it was years ago, that >> bot-originated spam comes from Windows systems to about six 9's. You made two assertions there. I'm more or less agreeing with the former (linux botnet infections are rare compared to Windows), but disagreeing with the second - 40% of all spam right now is from that small number of Linux botnet infections. > And to clarify further: > I classify a system as a bot if it meets a set of criteria that includes > more than sending spam: I may also classify it as a bot if it's doing > brute-force SSH/FTP/IMAP/etc. attacks, if it's doing port scans, etc. The term "botnet" is somewhat nebulous. It's perhaps best that you consider it to be an infection of some sort that does things via "network initiated" command&control. And do remember I was specifically addressing an assertion about _spam_. Not other botish things. The "tame" linux spambot I have periodically fetches commands from somewhere in the Ukraine, and spams based on those commands. The traditional darkmailer infection is more of a cgi that's accessible via the infectee's web server, and is either manually or automatically controlled. > Do you think #2 explains the difference in our numbers, or do I have > to make a LOT of coffee and dig into #1? We're comparing apples to oranges and apples. Forget about the oranges bit ;-) From bzs@world.std.com Sat Dec 15 08:39:06 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78DDE21F85BC for ; Sat, 15 Dec 2012 08:39:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.444 X-Spam-Level: X-Spam-Status: No, score=-3.444 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lc-cWjlC34kY for ; Sat, 15 Dec 2012 08:39:05 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id 96E4321F85D4 for ; Sat, 15 Dec 2012 08:39:05 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id qBFGcNtr017907 for ; Sat, 15 Dec 2012 11:38:26 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id qBFGcN45017245; Sat, 15 Dec 2012 11:38:23 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20684.42879.498431.234986@world.std.com> Date: Sat, 15 Dec 2012 11:38:23 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <50CB4100.2020408@mustelids.ca> References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> <20121214133937.GA23699@gsp.org> <50CB4100.2020408@mustelids.ca> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 16:39:06 -0000 On December 14, 2012 at 10:08 clewis+ietf@mustelids.ca (Chris Lewis) wrote: > > Compromised Linux machines (mostly servers) are now responsible for ~40% > of all spam. Any information on how they are being compromised? -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From clewis+ietf@mustelids.ca Sat Dec 15 09:33:14 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6D1921F8588 for ; Sat, 15 Dec 2012 09:33:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.557 X-Spam-Level: X-Spam-Status: No, score=-0.557 tagged_above=-999 required=5 tests=[AWL=0.491, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N0iW1aR0rAJq for ; Sat, 15 Dec 2012 09:33:14 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 2894A21F8584 for ; Sat, 15 Dec 2012 09:33:14 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBFHX7GO032296 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sat, 15 Dec 2012 12:33:08 -0500 Message-ID: <50CCB453.3030606@mustelids.ca> Date: Sat, 15 Dec 2012 12:33:07 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <50CA805E.3010100@mtcc.com> <50CAA612.3070000@mustelids.ca> <50CABCB4.1030103@mustelids.ca> <20121214133937.GA23699@gsp.org> <50CB4100.2020408@mustelids.ca> <20684.42879.498431.234986@world.std.com> In-Reply-To: <20684.42879.498431.234986@world.std.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Countering Botnets to Reduce Spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Dec 2012 17:33:14 -0000 On 12-12-15 11:38 AM, Barry Shein wrote: > > On December 14, 2012 at 10:08 clewis+ietf@mustelids.ca (Chris Lewis) wrote: > > Compromised Linux machines (mostly servers) are now responsible for ~40% > > of all spam. > Any information on how they are being compromised? - Wordpress and Joomla seem to be subject to a never-ending blizzard of various file-upload compromises. While ensuring that the customers using them are using the very latest patches seems to help a _lot_, that's apparently something that not all hosters attempt to enforce, and tomorrow there'll be another compromise discovered. - Some multi-host platforms are inherently leaky. IIUC, Cpanel has anon ftp turned on by default. - Files uploaded via compromised customer userid/password are extremely common, and have been for quite a while. Small-medium environments are under surprisingly high phishing pressure. Even my teensy regional ISP is subject to a never ending wave of phishes. From vesely@tana.it Sun Dec 16 03:50:56 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B151721F84F0 for ; Sun, 16 Dec 2012 03:50:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.719 X-Spam-Level: X-Spam-Status: No, score=-4.719 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ugUid0l3WLqK for ; Sun, 16 Dec 2012 03:50:55 -0800 (PST) Received: from wmail.tana.it (mail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id AF6AA21F84DC for ; Sun, 16 Dec 2012 03:50:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1355658653; bh=cL52iwitghMaZfrvEGMLkBLUiS2q/99tQBFsAHaGh0g=; l=1127; h=Date:From:To:References:In-Reply-To; b=RIp7/y7tTKo38WhWbkZhQqgrxsZFmhhJufe0GTCoaMwFicPGE/CTclM/wsLDPsHzZ SBIn05wlmePxnvzIHqniwuy7/0ZZFCukLTaKkO41+ZcSQ3x4OCU2BBOBWjPjQl/0IU dXRumpgx5Al11BXCxmQjbbRzAGkHvWpwooGwoPfw= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Sun, 16 Dec 2012 12:50:53 +0100 id 00000000005DC02B.0000000050CDB59D.00007EC9 Message-ID: <50CDB59D.1040403@tana.it> Date: Sun, 16 Dec 2012 12:50:53 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <20682.31889.485606.165715@world.std.com> <50CAAD79.8040008@mustelids.ca> In-Reply-To: <50CAAD79.8040008@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2012 11:50:56 -0000 On Fri 14/Dec/2012 05:39:21 +0100 Chris Lewis wrote: > Ooh, quantitative ;-) > > For grins, I took one of my smaller spamtraps and applied a 30 second > banner delay. I wanted to quantify > > "And a lot of spamware doesn't flunk." > > In the timestamps below, the change happened at 04:52. > > Flow per minute: > [snip] > 156 2012/12/14-04:51 > 30 2012/12/14-04:52 > > A 3:1 spam reduction is nothing to sneeze at. You need at least 15 daemons accepting 2 msgs/minute each to get 30 messages, while at, say, 60 msgs/minute 3 daemons can take 180. > Oh, as a FYI, relatively few connections failed to wait for the banner. Can you confirm the max-daemons limit wasn't hit? A deadly slow TCP backlog could cause clients to timeout. In that case, banner delay would work similar to random connection dropping as done, e.g. by stockade (see http://en.wikipedia.org/wiki/Stockade_%28software%29.) On a real MX, rather than being fixed at 30 seconds, the banner delay should be made proportional to the spammitude reckoned for the sending IP. Sort of tarpitting, perhaps not the FUSSP itself, but... From adamsobieski@hotmail.com Sun Dec 16 07:22:38 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F19AB21F87C8 for ; Sun, 16 Dec 2012 07:22:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.298 X-Spam-Level: X-Spam-Status: No, score=-1.298 tagged_above=-999 required=5 tests=[AWL=-1.300, BAYES_50=0.001, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N7wWT6bueGbV for ; Sun, 16 Dec 2012 07:22:36 -0800 (PST) Received: from snt0-omc4-s24.snt0.hotmail.com (snt0-omc4-s24.snt0.hotmail.com [65.55.90.227]) by ietfa.amsl.com (Postfix) with ESMTP id A0BAC21F878B for ; Sun, 16 Dec 2012 07:22:36 -0800 (PST) Received: from SNT002-W116 ([65.55.90.199]) by snt0-omc4-s24.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sun, 16 Dec 2012 07:22:33 -0800 X-EIP: [9mUSxlcH8eZyKT6lz8m20MdyLE8iBc+2] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_5f864f3b-e89e-41a2-b97e-8227d319efa1_" From: Adam Sobieski To: "asrg@irtf.org" Date: Sun, 16 Dec 2012 15:22:33 +0000 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 16 Dec 2012 15:22:33.0737 (UTC) FILETIME=[2BF5F790:01CDDBA1] Subject: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2012 15:22:38 -0000 --_5f864f3b-e89e-41a2-b97e-8227d319efa1_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C =20 The aforementioned distributed=2C decentralized computer security communica= tion network=2C a computer system for the dissemination of instantaneous co= mputer security information between computer scientists is an interesting t= opic. Such a system can be interoperable with=2C synchronized with=2C some= concurrent versioning systems of open source projects. Such a system can= be interoperable with software development updates of certain varieties an= d the hashes of concurrent versioning system objects can be utilized. Such= a system can=2C in numerous ways=2C enhance the security of computers=2C c= omputer networks=2C and computer systems by enhancing the well-informedness= of each interested computer scientist across the nation. Such systems can reduce government waste and public expense with regard to = some cybersecurity topics across a number of organizations such as the CIA= =2C DHS=2C DOD=2C FBI=2C NSA and USNORTHCOM. Additionally=2C some existing= computer networks=2C such as military computer networks=2C are considered = to be more secure than some existing civilian computer networks and=2C amid= st that=2C the government claims that the public should pay taxes for gover= nment personnel or government systems to surveil the civilian networks and = to surveil the American people. Americans have expressed concerns about an American news climate over the p= ast decade or more. Americans have expressed concerns about a certain fear= mongering concurrent to the introduction of=2C popularity of=2C or ubiquity= of the Internet and the Web. Americans have expressed concerns about a ne= ws climate with regard to cybercrime=2C cyberwarfare=2C and cybersecurity t= opics. Americans have expressed concerns about a news climate with regard = to various amorphous domestic and foreign cyberdangers=2C for example Chine= se hackers. The matter=2C overall=2C calls into question whether any gover= nment organizations may have participated=2C either directly or indirectly= =2C in activities somehow contrary to ensuring the domestic tranquility. Additionally=2C the Shirky Principle states that some institutions might tr= y to preserve the problem to which they are the solution. There could be= =2C then=2C when faced with bold and new approaches to solving problems=2C = a certain apprehension or reluctance to change=2C a reluctance to budgetary= changes or to the repurposing of personnel. As a large percentage of Amer= icans work for the government=2C in the public sector=2C and as an unknown = portion of computer scientists have worked on or work on cybersecurity topi= cs=2C job creation topics can be discussed concurrently to bold and new app= roaches to solving problems and to addressing Americans policy concerns. W= ith too many remnant policy items from a previous administration=2C with a = fiscal cliff approaching=2C the United States of America needs new solution= s=2C new plans=2C to repurpose personnel=2C to create jobs=2C to stimulate = the economy=2C and to affirm the primacy of Constitutional philosophy and C= onstitutional law. Job creation topics include the construction of new scientific laboratories= across the United States. When Americans tend to think of science laborato= ries=2C they tend to think of physics laboratories. Beyond physics laborato= ries=2C however=2C beyond the productive overlap of the DOE and computer sc= ience=2C there are many other possible types of science laboratories and co= mputer science can advantage each (http://en.wikipedia.org/wiki/Branches_of= _science=2C http://en.wikipedia.org/wiki/Outline_of_science). Many branches= of science can be prefixed with the adjective computational=2C for example= =2C when considering research topics possible at new multidisciplinary FFRD= C's. FFRDC's are presently densely located in California and Virginia and i= t occurs that many more states across the nation could be enhanced by new F= FRDC's for multidisciplinary scientific research and development. =20 On the topic of cyberpolicy=2C two pertinent topics include: (1) there exis= t computer systems and technologies which are more secure than civilian sys= tems=2C military computer systems=3B (2) a new information network can be c= onstructed for the dissemination of computer security information between c= omputer scientists to enhance the instantaneous well-informedness of comput= er software developers and computer security personnel=2C personnel across = the nation responsible for securing each computer=2C computer system=2C and= computer network=2C resulting in a reduction of computer security problems= and incidents. Americans are dissatisfied with the United States' cyberpolicy. No America= n wants to be surveilled by law enforcement=2C military=2C or by whatever t= he DHS is. Would we have future Americans believe that Americans in the ea= rly 21st century wanted such cyberpolicies for themselves and for future Am= ericans? Would we have future Americans believe that we wanted to sacrific= e liberty for a sense of security? =20 The Bush administration put forward a false choice between the liberties we= cherish and the security we demand. The construction of a new computer se= curity communication network is both timely and appropriate. As the United States approaches a fiscal cliff=2C we can consider that our = tax dollars can be better spent than on previous cyberpolicy approaches and= other remnant policy items from the previous administration. As we move f= orward=2C for numerous reasons including: stimulating the economy=2C job cr= eation=2C and preparedness for excellence in STEM education with digital te= xtbooks=2C our plans for leaping across the fiscal chasm can and should inc= lude a megaproject=2C the construction of a large number of new scientific = laboratories across the United States=2C an investment in our American futu= re. Kind regards=2C Adam Sobieski = --_5f864f3b-e89e-41a2-b97e-8227d319efa1_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C

=20 The aforementioned distributed=2C decentralized computer security communica= tion network=2C a computer system for the dissemination of instantaneous co= mputer security information between computer scientists is an interesting t= opic. Such a system can be interoperable with=2C synchronized with=2C some= concurrent versioning systems of open source projects. Such a system can= be interoperable with software development updates of certain varieties an= d the hashes of concurrent versioning system objects can be utilized. Such= a system can=2C in numerous ways=2C enhance the security of computers=2C c= omputer networks=2C and computer systems by enhancing the well-informedness= of each interested computer scientist across the nation.

Such systems can reduce government waste and public expense with regard to = some cybersecurity topics across a number of organizations such as the CIA= =2C DHS=2C DOD=2C FBI=2C NSA and USNORTHCOM. Additionally=2C some existing= computer networks=2C such as military computer networks=2C are considered = to be more secure than some existing civilian computer networks and=2C amid= st that=2C the government claims that the public should pay taxes for gover= nment personnel or government systems to surveil the civilian networks and = to surveil the American people.

Americans have expressed concerns about an American news climate over the p= ast decade or more. Americans have expressed concerns about a certain fear= mongering concurrent to the introduction of=2C popularity of=2C or ubiquity= of the Internet and the Web. Americans have expressed concerns about a ne= ws climate with regard to cybercrime=2C cyberwarfare=2C and cybersecurity t= opics. Americans have expressed concerns about a news climate with regard = to various amorphous domestic and foreign cyberdangers=2C for example Chine= se hackers. The matter=2C overall=2C calls into question whether any gover= nment organizations may have participated=2C either directly or indirectly= =2C in activities somehow contrary to ensuring the domestic tranquility.
Additionally=2C the Shirky Principle states that some institutions might tr= y to preserve the problem to which they are the solution. There could be= =2C then=2C when faced with bold and new approaches to solving problems=2C = a certain apprehension or reluctance to change=2C a reluctance to budgetary= changes or to the repurposing of personnel. As a large percentage of Amer= icans work for the government=2C in the public sector=2C and as an unknown = portion of computer scientists have worked on or work on cybersecurity topi= cs=2C job creation topics can be discussed concurrently to bold and new app= roaches to solving problems and to addressing Americans policy concerns. W= ith too many remnant policy items from a previous administration=2C with a = fiscal cliff approaching=2C the United States of America needs new solution= s=2C new plans=2C to repurpose personnel=2C to create jobs=2C to stimulate = the economy=2C and to affirm the primacy of Constitutional philosophy and C= onstitutional law.

Job creation topics include the construction of new scientific laboratories= across the United States. When Americans tend to think of science laborato= ries=2C they tend to think of physics laboratories. Beyond physics laborato= ries=2C however=2C beyond the productive overlap of the DOE and computer sc= ience=2C there are many other possible types of science laboratories and co= mputer science can advantage each (http://en.wikipedia.org/wiki/Branches_of= _science=2C http://en.wikipedia.org/wiki/Outline_of_science). Many branches= of science can be prefixed with the adjective computational=2C for example= =2C when considering research topics possible at new multidisciplinary FFRD= C's. FFRDC's are presently densely located in California and Virginia and i= t occurs that many more states across the nation could be enhanced by new F= FRDC's for multidisciplinary scientific research and development.

=20 On the topic of cyberpolicy=2C two pertinent topics include: (1) there exis= t computer systems and technologies which are more secure than civilian sys= tems=2C military computer systems=3B (2) a new information network can be c= onstructed for the dissemination of computer security information between c= omputer scientists to enhance the instantaneous well-informedness of comput= er software developers and computer security personnel=2C personnel across = the nation responsible for securing each computer=2C computer system=2C and= computer network=2C resulting in a reduction of computer security problems= and incidents.

Americans are dissatisfied with the United States' cyberpolicy. No America= n wants to be surveilled by law enforcement=2C military=2C or by whatever t= he DHS is. Would we have future Americans believe that Americans in the ea= rly 21st century wanted such cyberpolicies for themselves and for future Am= ericans? Would we have future Americans believe that we wanted to sacrific= e liberty for a sense of security?

=20 The Bush administration put forward a false choice between the liberties we= cherish and the security we demand. The construction of a new computer se= curity communication network is both timely and appropriate.

As the United States approaches a fiscal cliff=2C we can consider that our = tax dollars can be better spent than on previous cyberpolicy approaches and= other remnant policy items from the previous administration. As we move f= orward=2C for numerous reasons including: stimulating the economy=2C job cr= eation=2C and preparedness for excellence in STEM education with digital te= xtbooks=2C our plans for leaping across the fiscal chasm can and should inc= lude a megaproject=2C the construction of a large number of new scientific = laboratories across the United States=2C an investment in our American futu= re.



Kind regards=2C

Adam Sobieski
= --_5f864f3b-e89e-41a2-b97e-8227d319efa1_-- From martijn.grooten@virusbtn.com Sun Dec 16 08:03:58 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30A2B21F8856 for ; Sun, 16 Dec 2012 08:03:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.195 X-Spam-Level: X-Spam-Status: No, score=-9.195 tagged_above=-999 required=5 tests=[AWL=-1.197, BAYES_50=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZfSHGKysKcW for ; Sun, 16 Dec 2012 08:03:57 -0800 (PST) Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id 60C6321F8822 for ; Sun, 16 Dec 2012 08:03:56 -0800 (PST) Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 5B42A540BCD for ; Sun, 16 Dec 2012 16:03:54 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos (unknown [10.100.70.61]) by mx5.sophos.com (Postfix) with ESMTPS id 29BF6540BC1 for ; Sun, 16 Dec 2012 16:03:54 +0000 (GMT) Received: from abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352]) by ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d%16]) with mapi id 14.02.0247.003; Sun, 16 Dec 2012 16:03:53 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] Computer Security Communication Network Thread-Index: AQHN26E1SoU3UA4oIEiye3MBc2WjdJgbkimn Date: Sun, 16 Dec 2012 16:03:53 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AF7693@abn-exch1b.green.sophos> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: multipart/alternative; boundary="_000_0D79787962F6AE4B84B2CC41FC957D0B20AF7693abnexch1bgreens_" MIME-Version: 1.0 Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2012 16:03:58 -0000 --_000_0D79787962F6AE4B84B2CC41FC957D0B20AF7693abnexch1bgreens_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Adam, I am a bit unsure about what the problem is you're trying to tackle in your= post, and how you intend to tackle it. But since this discussion started with the problem of bots sending spam, ca= n you explain how it would solve or mitigate the following two cases: 1. I run a small site using WordPress as the CMS. Because of laziness, not = being well-informed about the need for security, or because I run a plug-in= that isn't compatible with the most recent version of WordPress, I haven't= updated in a while. My site has been compromised and is used to spread spa= m. 2. I have an old computer running Windows XP that's still working well enou= gh to browse the Internet with. I haven't run any updates unless strictly n= ecessary for my browsing experience. Through a drive-by download on a compr= omised website, my computer has been turned into a spam-sending bot. In both cases, let's assume I don't live in the US. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. --_000_0D79787962F6AE4B84B2CC41FC957D0B20AF7693abnexch1bgreens_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Adam,

I am a bit unsure about what the problem is you're trying to tackle in your= post, and how you intend to tackle it.

But since this discussion started with the problem of bots sending spam, ca= n you explain how it would solve or mitigate the following two cases:

1. I run a small site using WordPress as the CMS. Because of laziness, not = being well-informed about the need for security, or because I run a plug-in= that isn't compatible with the most recent version of WordPress, I haven't= updated in a while. My site has been compromised and is used to spread spam.

2. I have an old computer running Windows XP that's still working well enou= gh to browse the Internet with. I haven't run any updates unless strictly n= ecessary for my browsing experience. Through a drive-by download on a compr= omised website, my computer has been turned into a spam-sending bot.

In both cases, let's assume I don't live in the US.

Martijn.



Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.
 --_000_0D79787962F6AE4B84B2CC41FC957D0B20AF7693abnexch1bgreens_-- From johnl@iecc.com Sun Dec 16 10:10:31 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 340A221F8715 for ; Sun, 16 Dec 2012 10:10:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -107.927 X-Spam-Level: X-Spam-Status: No, score=-107.927 tagged_above=-999 required=5 tests=[AWL=1.413, BAYES_20=-0.74, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxJ5gYjREgAU for ; Sun, 16 Dec 2012 10:10:30 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id CA86D21F855B for ; Sun, 16 Dec 2012 10:10:29 -0800 (PST) Received: (qmail 12286 invoked from network); 16 Dec 2012 18:10:26 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 16 Dec 2012 18:10:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50ce0e91.xn--hew.k1212; i=johnl@user.iecc.com; bh=XJpFinmSQl180Fc/bdu36Jy93QPDwlwzayWa34AeuC4=; b=ShYl/lqyWxSk0Mbjp7us9qlkJXtjfBYLSr16u1j2T//kEbCEXRJZpGmxNJSKeVqzZXCmqhelsEVnGaxMfUkNqBFh6GEDsU71CD1q1iynLqTgwBjJf2xkN3XQ/zT7EUyhCL9G4mO6ubHGqifZ2Se3/s2XbWYMHj3tsIwHOg7+DHM= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50ce0e91.xn--hew.k1212; olt=johnl@user.iecc.com; bh=XJpFinmSQl180Fc/bdu36Jy93QPDwlwzayWa34AeuC4=; b=ks79cFv8EpIMA9nmsRh0jvqiLuK3lWz0l3Fg+pTPf9Zon2tRr29X21I/1orQpJ/9Rg33fAHE8kyq9ZArPjIoqFuTT7QvVqLVM+DsWK94Cel/GemEzzZhtPmTsR3YsNgEwbLaLbBA4hLX3xlKCcuhWf8yHNZE+4Ij0ocI0mm2Qpk= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 16 Dec 2012 18:10:03 -0000 Message-ID: <20121216181003.46545.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2012 18:10:31 -0000 > The aforementioned distributed, decentralized computer security > communication network, a computer system for the dissemination of > instantaneous computer security information between computer > scientists is an interesting topic. Since this assertion is rather dubious, we can skip the rest of the message for now. We already have effective ways to distribute material from a central point, such as CDNs. We also already have usenet (yes, it still exists and some parts remain quite healthy.) The main thing that a distributed network provides is the ability for anyone to send out material, but as we've seen on usenet, that instantly falls afoul of Sturgeon's Law. In the meantime you might take a look at DCC: http://www.rhyolite.com/dcc/ It is not totally open like typical p2p networks, but anyone with resonably large mail volume and who doesn't smell like a sleazeball can run a server that exchanges DCC data, and anyone at all can contribute message hashes. It's relatively resistant to bad guys because the main thing you can do to poison it is to report hashes of single messages as spam, which doesn't help other than for a rather arcane DoS. From clewis+ietf@mustelids.ca Sun Dec 16 10:16:05 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC1DA21F881C for ; Sun, 16 Dec 2012 10:16:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[AWL=0.450, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e7OUBSAgPUun for ; Sun, 16 Dec 2012 10:16:05 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id F07B721F87EC for ; Sun, 16 Dec 2012 10:16:04 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id qBGIG0SB029909 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 16 Dec 2012 13:16:01 -0500 Message-ID: <50CE0FE0.90700@mustelids.ca> Date: Sun, 16 Dec 2012 13:16:00 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <20682.3413.665708.640636@world.std.com> <50CA0E91.2080304@mtcc.com> <20682.23612.451287.246798@world.std.com> <20682.31889.485606.165715@world.std.com> <50CAAD79.8040008@mustelids.ca> <50CDB59D.1040403@tana.it> In-Reply-To: <50CDB59D.1040403@tana.it> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] An Anti-Spam Heuristic X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Dec 2012 18:16:05 -0000 On 12-12-16 06:50 AM, Alessandro Vesely wrote: > On Fri 14/Dec/2012 05:39:21 +0100 Chris Lewis wrote: >> Ooh, quantitative ;-) >> >> For grins, I took one of my smaller spamtraps and applied a 30 second >> banner delay. I wanted to quantify >> >> "And a lot of spamware doesn't flunk." >> >> In the timestamps below, the change happened at 04:52. >> >> Flow per minute: >> [snip] >> 156 2012/12/14-04:51 >> 30 2012/12/14-04:52 >> >> A 3:1 spam reduction is nothing to sneeze at. Small update: Kelihos and Lethic are stopped dead with a 30 second delay. Unlike previous reports, Festi actually appears unaffected. These tests were very short duration and given the small size of the trap, it's sometimes difficult to tell the difference between natural flow variation and clear effect. With Lethic and Kelihos it's absolutely unmistakeable. Festi looked at first, but it wasn't doing much anyway and later showed it wasn't dead. > You need at least 15 daemons accepting 2 msgs/minute each to get 30 > messages, while at, say, 60 msgs/minute 3 daemons can take 180. The trap is 20 simultaneous daemons, _each_ multi-threaded (event driven). When pushed, the traps can have several thousand SMTP sessions simultaneously in progress. We weren't anywhere near hitting a limit. Obviously, this can be a consideration - I wouldn't want to set a several minute delay on one of the traps currently doing 700 emails/second. I've tried this on two of our smallest traps for this very reason - and this is why I was only able to relate the effects on the very highest volume bots. [One of our traps is capable of and has _seen_ sustained thruput of 6-7 _thousand_ per second.] > Can you confirm the max-daemons limit wasn't hit? Yup, see above. > On a real MX, rather than being fixed at 30 seconds, the banner delay > should be made proportional to the spammitude reckoned for the sending > IP. Sort of tarpitting, perhaps not the FUSSP itself, but... Right. I did this as simply as I could. In production, you'd want something much smarter. The idea isn't to "punish" (like tarpit), the idea is to distinguish as simply and cheaply as possible what is highly non-RFC-compliant, and ignore ignore them from then on. Something like; > if (this is the first time in t0 seconds you've seen a given IP) > then > banner delay it for t1 seconds. > elsif (this is the second time in t0 seconds you've seen a given IP) > then > if (it previously passed) > then > don't banner delay > else > banner delay for t1 seconds > else > if (it previously passed) > then > don't banner delay > else > drop at connect then twiddle the tn's. The second "kick at the delay" is to allow for a legitimate mail server or network hiccup - the banner delay will be treated as a retry and you want the retry to work. From adamsobieski@hotmail.com Sun Dec 16 20:07:20 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5389421F88D1 for ; Sun, 16 Dec 2012 20:07:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.381 X-Spam-Level: X-Spam-Status: No, score=-2.381 tagged_above=-999 required=5 tests=[AWL=0.217, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cSha1mVk6Rk8 for ; Sun, 16 Dec 2012 20:07:19 -0800 (PST) Received: from snt0-omc4-s23.snt0.hotmail.com (snt0-omc4-s23.snt0.hotmail.com [65.55.90.226]) by ietfa.amsl.com (Postfix) with ESMTP id 57AA621F88DD for ; Sun, 16 Dec 2012 20:07:14 -0800 (PST) Received: from SNT002-W37 ([65.55.90.200]) by snt0-omc4-s23.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Sun, 16 Dec 2012 20:07:13 -0800 X-EIP: [7z60U1r6pUuv7YFMkOdX9kT39Te/sd0P] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_f7aacd37-6691-4329-b42d-7c11081337b7_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Mon, 17 Dec 2012 04:07:13 +0000 Importance: Normal In-Reply-To: <20121216181003.46545.qmail@joyce.lan> References: , <20121216181003.46545.qmail@joyce.lan> MIME-Version: 1.0 X-OriginalArrivalTime: 17 Dec 2012 04:07:13.0698 (UTC) FILETIME=[FE8C7020:01CDDC0B] Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2012 04:07:20 -0000 --_f7aacd37-6691-4329-b42d-7c11081337b7_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C John Levine=2C Distributed checksum clearinghouse heuristics resemble some P2P concepts. = Improving on DCC in distributed systems can be achieved simply with Digg.co= m techniques=2C with more complex voting systems=2C and with logic-based te= chniques=2C such as evidence-based distributed computing and uses of machin= e-utilizable argumentation which include user and mechanical observations. = Logic programming and computer security=2C computer security policy=2C are= interrelated=2C as you can see at the Singularity RDK which includes a Pro= log implementation: http://singularity.codeplex.com/SourceControl/changeset= /view/69631#140370. Here are some publications: A Comparative Study of Pub/Sub Methods in Struc= tured P2P Networks by Matthias Bender=2C Sebastian Michel=2C Sebastian Park= itny=2C Gerhard Weikum =3B Publish/Subscribe for RDF-based P2P Networks by = Paul - Alexandru Chirita=2C Stratos Idreos=2C Manolis Koubarakis=2C and Wol= fgang Nejdl =3B Content-based Publish-Subscribe Over Structured P2P Network= s by Peter Triantafillou and Ioannis Aekaterinidis. In addition to the discussion topics of new computer security information r= esources=2C improving Usenet=2C improving NNTP is entirely possible. Kind regards=2C Adam Sobieski = --_f7aacd37-6691-4329-b42d-7c11081337b7_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C
John Levine=2C

Distributed checksum clearinghouse heuristics resemble some P2P concepts. = Improving on DCC in distributed systems can be achieved simply with Digg.co= m techniques=2C with more complex voting systems=2C and with logic-based te= chniques=2C such as evidence-based distributed computing and uses of machin= e-utilizable argumentation which include user and mechanical observations. = Logic programming and computer security=2C computer security policy=2C are= interrelated=2C as you can see at the Singularity RDK which includes a Pro= log implementation: http://singularity.codeplex.com/SourceContro= l/changeset/view/69631#140370.

Here are some publications: A Comparative Study of Pub/Sub Methods in St= ructured P2P Networks by Matthias Bender=2C Sebastian Michel=2C Sebasti= an Parkitny=2C Gerhard Weikum =3B Publish/Subscribe for RDF-based P2P Ne= tworks by Paul - Alexandru Chirita=2C Stratos Idreos=2C Manolis Koubara= kis=2C and Wolfgang Nejdl =3B Content-based Publish-Subscribe Over Struc= tured P2P Networks by Peter Triantafillou and Ioannis Aekaterinidis.
In addition to the discussion topics of new computer security information r= esources=2C improving Usenet=2C improving NNTP is entirely possible.



Kind regards=2C

Adam Sobieski
= --_f7aacd37-6691-4329-b42d-7c11081337b7_-- From johnl@iecc.com Sun Dec 16 21:03:59 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F4FD21F854D for ; Sun, 16 Dec 2012 21:03:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.897 X-Spam-Level: X-Spam-Status: No, score=-108.897 tagged_above=-999 required=5 tests=[AWL=2.302, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jmQOOu0pxyi4 for ; Sun, 16 Dec 2012 21:03:59 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 9A23D21F8549 for ; Sun, 16 Dec 2012 21:03:58 -0800 (PST) Received: (qmail 84663 invoked from network); 17 Dec 2012 05:03:57 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 17 Dec 2012 05:03:57 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cea7bd.xn--yuvv84g.k1212; i=johnl@user.iecc.com; bh=5GpurZY8wRQAm6z0CZx2JZIVIqjmcBsSpNg866mvJV0=; b=gHbCJbHP2QW6VSK0YByxoVd4HsRmatmCvyiE0KS68IiKrv1KFhhfTRGJnfRXTTp7bdcWZ+Uuj2YXCjpCCqIX9L8qBsX6SmLSSpfgxTaM4Yn6R+8WhgheupUqtpsKQaG3MaEwkY8ercwOmhHmL/xlnoOu5BH8UuZeW53YNbV0r7E= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cea7bd.xn--yuvv84g.k1212; olt=johnl@user.iecc.com; bh=5GpurZY8wRQAm6z0CZx2JZIVIqjmcBsSpNg866mvJV0=; b=cNb1SOfdGzIJ73VBCZfG+YdJ5PbPZIjlcTCnPMTY07BBEfuV9FxPtbOfOWkpFInW1sdnM56y6+8LyFwhBq7oIlK2IeTkXeLSEq8DDbUnSzCkAolP8rx/Y9rQnwbz420RfpeSXTw2u8Zn034nUZQDYB7LDfiT4xpalE2bjJI77rw= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 17 Dec 2012 05:03:34 -0000 Message-ID: <20121217050334.67526.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2012 05:03:59 -0000 > Improving on DCC in distributed systems can be achieved simply with > Digg.com techniques, with more complex voting systems, and with > logic-based techniques, such as evidence-based distributed computing > and uses of machine-utilizable argumentation which include user and > mechanical observations. Do you have any basis whatsoever for these assertions? More bad data is not better data. From adamsobieski@hotmail.com Mon Dec 17 06:33:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6701121F853C for ; Mon, 17 Dec 2012 06:33:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.436 X-Spam-Level: X-Spam-Status: No, score=-2.436 tagged_above=-999 required=5 tests=[AWL=0.162, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mD1tR2fEebMe for ; Mon, 17 Dec 2012 06:33:31 -0800 (PST) Received: from snt0-omc4-s41.snt0.hotmail.com (snt0-omc4-s41.snt0.hotmail.com [65.54.51.92]) by ietfa.amsl.com (Postfix) with ESMTP id CB20621F852D for ; Mon, 17 Dec 2012 06:33:31 -0800 (PST) Received: from SNT002-W61 ([65.55.90.201]) by snt0-omc4-s41.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 17 Dec 2012 06:33:31 -0800 X-EIP: [JA9viG0TCzQ+OlROL8u9VJZ52IE3malI] X-Originating-Email: [adamsobieski@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_54052239-d04e-420a-89e1-10412fe15b3c_" From: Adam Sobieski To: Anti-Spam Research Group - IRTF Date: Mon, 17 Dec 2012 14:33:31 +0000 Importance: Normal In-Reply-To: <20121217050334.67526.qmail@joyce.lan> References: , <20121217050334.67526.qmail@joyce.lan> MIME-Version: 1.0 X-OriginalArrivalTime: 17 Dec 2012 14:33:31.0398 (UTC) FILETIME=[7C9A6A60:01CDDC63] Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2012 14:33:32 -0000 --_54052239-d04e-420a-89e1-10412fe15b3c_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Internet Research Task Force=2C Anti-Spam Research Group=2C John Levine=2C Some techniques for annotating message or system objects include tallying b= ooleans=2C annotations from a list=2C or typed hyperlinks from users. In p= eer-to-peer systems=2C during search processes=2C tallied annotations on ob= jects can adorn search result items. Some social networking websites utili= ze thumbs up or likes. In Digg-based or Reddit-based systems=2C tallied an= notations are utilized in sorting search results. Extending on those premises=2C towards the aforementioned more complex voti= ng systems=2C or more complex annotational systems=2C a specific example in= cludes that=2C beyond a button per message or system object=2C for indicati= ng whether a message or system object is spam or not=2C or beyond a button = pair=2C we can envision a forms-based process with an initial user interfac= e item of a drop-down menu of spam or other annotational categories. Such = a drop-down menu could suffice for either annotations from a list or typed = hyperlinks. Beyond that user interface=2C however=2C each category from that drop-down = menu could have its own form to complete=2C where=2C in each such form=2C u= sers could indicate one or more text or hypertext selections. At the end o= f each such form=2C there could be a navigational option to either return t= o the aforementioned drop-down menu to add another such annotative object o= r to complete the forms-based user interaction. In the indicated example=2C the selections of text or hypertext=2C along wi= th categorized annotations=2C resemble granular and machine-utilizable evid= ence and observations and users would then have more to either agree or dis= agree with one another about than with tallied booleans=2C tallied annotati= ons from a list=2C or tallied typed hyperlinks. Kind regards=2C Adam Sobieski = --_54052239-d04e-420a-89e1-10412fe15b3c_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Internet Research Task Force=2C<= br/> Anti-Spam Research Group=2C
John Levine=2C

Some techniques for annotating message or system objects include tallying b= ooleans=2C annotations from a list=2C or typed hyperlinks from users. In p= eer-to-peer systems=2C during search processes=2C tallied annotations on ob= jects can adorn search result items. Some social networking websites utili= ze thumbs up or likes. In Digg-based or Reddit-based systems=2C tallied an= notations are utilized in sorting search results.

Extending on those premises=2C towards the aforementioned more complex voti= ng systems=2C or more complex annotational systems=2C a specific example in= cludes that=2C beyond a button per message or system object=2C for indicati= ng whether a message or system object is spam or not=2C or beyond a button = pair=2C we can envision a forms-based process with an initial user interfac= e item of a drop-down menu of spam or other annotational categories. Such = a drop-down menu could suffice for either annotations from a list or typed = hyperlinks.

Beyond that user interface=2C however=2C each category from that drop-down = menu could have its own form to complete=2C where=2C in each such form=2C u= sers could indicate one or more text or hypertext selections. At the end o= f each such form=2C there could be a navigational option to either return t= o the aforementioned drop-down menu to add another such annotative object o= r to complete the forms-based user interaction.

In the indicated example=2C the selections of text or hypertext=2C along wi= th categorized annotations=2C resemble granular and machine-utilizable evid= ence and observations and users would then have more to either agree or dis= agree with one another about than with tallied booleans=2C tallied annotati= ons from a list=2C or tallied typed hyperlinks.



Kind regards=2C

Adam Sobieski
= --_54052239-d04e-420a-89e1-10412fe15b3c_-- From johnl@iecc.com Mon Dec 17 09:55:13 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FBD121F8B37 for ; Mon, 17 Dec 2012 09:55:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.961 X-Spam-Level: X-Spam-Status: No, score=-108.961 tagged_above=-999 required=5 tests=[AWL=2.238, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mr7TxMG9ghiN for ; Mon, 17 Dec 2012 09:55:10 -0800 (PST) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 3F40621F8532 for ; Mon, 17 Dec 2012 09:55:09 -0800 (PST) Received: (qmail 75405 invoked from network); 17 Dec 2012 17:55:08 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 17 Dec 2012 17:55:08 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cf5c7b.xn--yuvv84g.k1212; i=johnl@user.iecc.com; bh=wTmZnMX0IV0YmtmvUg4lzBxjBzjmkP3hkHc9X+x5REA=; b=nTN4WWXNNBD8KM/x9GWI5aLFxEL1WZvSH6OE6H1F1ukA2UvbgcoloWbYCIF02chEGUXImEhBg8BB2lrj507UzCzK0JNYKhU81wY1B4aDOkG/Nm0ZCfl5C/6DZfemC4+276Aizd1W6NRAVgcgiDEzKr85lyzFhbHEF1D2zQkLsnM= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50cf5c7b.xn--yuvv84g.k1212; olt=johnl@user.iecc.com; bh=wTmZnMX0IV0YmtmvUg4lzBxjBzjmkP3hkHc9X+x5REA=; b=Pexg8tYXndkSn3vjmqnIzFzbHYf/mruVpxnnnuTh8RyEdhZ9C4/nvgyL/liv4847xAWM3TFR7IATBDZmbgkL8LEAxYetQmhD5sI4bzzkvQblXFr8mx/0Aqj3uWhMOWC28kFeMiS223mhY81BEmiNu/naE7dwvX04RYrV8nsRt7I= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 17 Dec 2012 17:54:45 -0000 Message-ID: <20121217175445.4617.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] Computer Security Communication Network X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2012 17:55:13 -0000 In article you write: >-=-=-=-=-=- >-=-=-=-=-=- > >Internet Research Task Force, >Anti-Spam Research Group, >John Levine, > >[ a lot of stuff ] I can't help but note that you didn't answer the question. In any event, if you think this stuff is a good idea, start implementing it. If your plan is plausible, you might (and I stress might), get other people to help. R's, John