From kito_mijiko_00005@yahoo.co.jp Fri Mar 09 06:13:51 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HPd2l-0004Ip-2k for marid-archive@lists.ietf.org; Fri, 09 Mar 2007 06:13:51 -0500 Received: from [203.177.214.39] (helo=pc15) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1HPd2g-0000Mh-P0 for marid-archive@lists.ietf.org; Fri, 09 Mar 2007 06:13:51 -0500 From: =?iso-2022-jp?B?a2l0b19taWppa29fMDAwMDVAeWFob28uY28uanA=?= Subject: =?iso-2022-jp?B?GyRCJSglQyVBJEpNRCRKOkokckp6JCQkRiRfJF4kOyRzJCshKRsoQg==?= MIME-Version: 1.0 Reply-To: Date: Fri, 09 Mar 2007 19:47:56 +0900 Content-Type:text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Spam-Score: 2.7 (++) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 　人妻に興味のある方限定での募集となります。 　人妻暦１年未満の遊び足りない女性が中心です。 　３０代〜４０代の女性はもちろんのこと、 　２０代の女性、１０代の女性も少しですがご紹介出来ます。 　一般独身女性と違い、人妻の方の登録が中心ですので、 　積極的にアプローチされる方が多く、 　男性登録者、特に初心者の方からご好評を頂いています。 　今回の募集につきまして、完全無料でのご紹介となりますので、 　早期終了の可能性がございます。 　募集終了となった場合でも、 　ご利用料金の発生は一切ありませんのでご安心下さい。 　http://qp-sp.com/sw/?media=pcya1 　------------------------------------------- 　　┌──┐。∵☆　今回のご紹介女性　☆ 　　│＼／│　　　☆　　　　　　　　　　☆ 　------------------------------------------- 　　名前：ユキ　　　　　　名前：真紀子 　　年齢：２７歳　　　　　年齢：３２歳 　　 　初浮気：会社の同僚　　　初浮気：主人の友達 　　　　詳細はコチラ　⇒　 　http://qp-sp.com/sw/?media=pcya1 From goody45goodyjp@yahoo.co.jp Sat Mar 17 05:39:21 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HSVNh-00043O-2E; Sat, 17 Mar 2007 05:39:21 -0400 Received: from [222.127.4.233] (helo=pc13) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1HSVNf-0000Uf-Av; Sat, 17 Mar 2007 05:39:21 -0400 From: =?iso-2022-jp?B?Z29vZHk0NWdvb2R5anBAeWFob28uY28uanA=?= Subject: =?iso-2022-jp?B?GyRCJDQ+N0JUJCQkPyQ3JF4kORsoQg==?= MIME-Version: 1.0 Reply-To: Date: Sat, 17 Mar 2007 18:17:53 +0900 Content-Type:text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Spam-Score: 4.5 (++++) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 　誘惑妻限定の出会いとなります。 　贅沢なエッチをお望みの方にはご満足頂けると思います。 　一般独身女性と違い、人妻の方の登録が中心ですので、 　積極的にアプローチされる方が多く、 　男性登録者、特に初心者の方からご好評を頂いています。 　エッチな人妻がたくさん登録しておりますが、 　その中でもすぐに会ってエッチな事を希望されている 　人妻の方を今回人数限定でご紹介させて頂きます。 　http://qt-h.cc/mad/i.php 　------------------------------------------- 　　┌──┐。∵☆　今回のご紹介女性　☆ 　　│＼／│　　　☆　　　　　　　　　　☆ 　------------------------------------------- 　　名前：めぐみ　　　　　名前：アキ 　　年齢：３１歳　　　　　年齢：３２歳 　　 　　　　詳細はコチラ　⇒　 　http://qt-h.cc/mad/i.php From owner-ietf-mxcomp@mail.imc.org Fri Mar 23 23:35:33 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HUx2T-0001c9-RQ for marid-archive@lists.ietf.org; Fri, 23 Mar 2007 23:35:33 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HUx2P-0000Pl-FC for marid-archive@lists.ietf.org; Fri, 23 Mar 2007 23:35:33 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2O2qLQR014552 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 23 Mar 2007 19:52:21 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2O2qLv4014551; Fri, 23 Mar 2007 19:52:21 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.235]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2O2q0xT014525 for ; Fri, 23 Mar 2007 19:52:20 -0700 (MST) (envelope-from perlstalker@gmail.com) Received: by wr-out-0506.google.com with SMTP id i22so1199719wra for ; Fri, 23 Mar 2007 19:51:56 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; b=ojZ7EUYJSxs+cfch+3zou78YWZOF14gJuyxXQuJuC6H4JMCAqycFjoJM2lW7b/9YpCph8Udx+tfW7bTDjs+u8QfHGiJII5VWFYXr60k3YEJwaPPb4P2yWvyTYLGmm+joTuPJtL6p0JpCugItTx0tOED2CRIUaKnR+VWY4laTwsg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; b=EzUWst8/Cd5oW0uCqzm3iT2GwhOTTrYFHmHpvCWkFJYquaSXW3bo5P9g3nCNv9k3bAyZ4fOH6yXG5AFzTaAY4H9KPELrVb95N5SGnCxqVMvPqvv74lnwRSveKcxn7IflwKGuD0+idJyupM13Xy4UyxlXwBO0EXerzfxYAqm1L48= Received: by 10.114.108.15 with SMTP id g15mr1510759wac.1174704715213; Fri, 23 Mar 2007 19:51:55 -0700 (PDT) Received: by 10.115.48.1 with HTTP; Fri, 23 Mar 2007 19:51:55 -0700 (PDT) Message-ID: Date: Fri, 23 Mar 2007 20:51:55 -0600 From: "Randy Smith" To: ietf-mxcomp@imc.org Subject: Mail Server Registries and Foreign Sender Authentication: A Proposal MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Google-Sender-Auth: 5a786434e2fcb9d9 Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Greetings, I was recently discussing various issues surrounding email with a coworker and had a couple of ideas for authentication systems that I would like to get some feedback on. You can read my ideas at http://perlstalker.blogspot.com/2007/03/mail-server-registries-and-foreign.html. As I said, I'm looking for feedback. Are these ideas worth pursuing or am I barking up the wrong tree? Thank you for your time. -- Randy Smith http://vuser.org/ http://perlstalker.vuser.org/ From owner-ietf-mxcomp@mail.imc.org Sat Mar 24 01:13:49 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HUyZZ-0005BQ-LE for marid-archive@lists.ietf.org; Sat, 24 Mar 2007 01:13:49 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HUyZY-0003U2-5G for marid-archive@lists.ietf.org; Sat, 24 Mar 2007 01:13:49 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2O4QGIa018841 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 23 Mar 2007 21:26:16 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2O4QGLA018840; Fri, 23 Mar 2007 21:26:16 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from ciao.gmane.org (main.gmane.org [80.91.229.2]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2O4PpXS018828 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Fri, 23 Mar 2007 21:26:15 -0700 (MST) (envelope-from gim-ietf-mxcomp@gmane.org) Received: from list by ciao.gmane.org with local (Exim 4.43) id 1HUxp4-0002Oz-JR for ietf-mxcomp@imc.org; Sat, 24 Mar 2007 05:25:46 +0100 Received: from d253247.dialin.hansenet.de ([80.171.253.247]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Mar 2007 05:25:46 +0100 Received: from nobody by d253247.dialin.hansenet.de with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 24 Mar 2007 05:25:46 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: ietf-mxcomp@imc.org From: Frank Ellermann Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Date: Sat, 24 Mar 2007 05:25:01 +0100 Organization: Lines: 15 Message-ID: <4604A81D.2153@xyzzy.claranet.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: d253247.dialin.hansenet.de X-Mailer: Mozilla 3.0 (OS/2; U) Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Randy Smith wrote: > am I barking up the wrong tree? The tree is right, but it's not here: This list is dead. For slightly more active lists see the ASRG or the SMTP lists. You might wish to check out DKIM (an RFC approved recently now waiting for its RFC number), SPF (RFC 4408), and draft-irtf-asrg-howe-siq-03.txt for proposals in similar directions, some pieces of the puzzle already exist. They're not based on OpenID, that's rather new. Frank From goody45goodyjp@yahoo.co.jp Sun Mar 25 06:06:39 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HVPcV-0006S2-Ba; Sun, 25 Mar 2007 06:06:39 -0400 Received: from [222.127.4.233] (helo=pc00) by ietf-mx.ietf.org with smtp (Exim 4.43) id 1HVPcT-0003Cu-9R; Sun, 25 Mar 2007 06:06:39 -0400 From: =?iso-2022-jp?B?Z29vZHk0NWdvb2R5anBAeWFob28uY28uanA=?= Subject: =?iso-2022-jp?B?GyRCJDQ+N0JUJCQkPyQ3JF4kORsoQg==?= MIME-Version: 1.0 Reply-To: Date: Sun, 25 Mar 2007 18:45:40 +0900 Content-Type:text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Spam-Score: 4.5 (++++) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 　誘惑妻限定の出会いとなります。 　贅沢なエッチをお望みの方にはご満足頂けると思います。 　一般独身女性と違い、人妻の方の登録が中心ですので、 　積極的にアプローチされる方が多く、 　男性登録者、特に初心者の方からご好評を頂いています。 　エッチな人妻がたくさん登録しておりますが、 　その中でもすぐに会ってエッチな事を希望されている 　人妻の方を今回人数限定でご紹介させて頂きます。 　http://qt-h.cc/mad/i.php 　------------------------------------------- 　　┌──┐。∵☆　今回のご紹介女性　☆ 　　│＼／│　　　☆　　　　　　　　　　☆ 　------------------------------------------- 　　名前：めぐみ　　　　　名前：アキ 　　年齢：３１歳　　　　　年齢：３２歳 　　 　　　　詳細はコチラ　⇒　 　http://qt-h.cc/mad/i.php From owner-ietf-mxcomp@mail.imc.org Sun Mar 25 17:19:44 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HVa7s-00082j-88 for marid-archive@lists.ietf.org; Sun, 25 Mar 2007 17:19:44 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HVa7q-0005Ob-Ow for marid-archive@lists.ietf.org; Sun, 25 Mar 2007 17:19:44 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2PKP5gF036814 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 25 Mar 2007 13:25:05 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2PKP55u036813; Sun, 25 Mar 2007 13:25:05 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from winserver.com (ftp.catinthebox.net [208.247.131.9]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2PKOiGd036788 for ; Sun, 25 Mar 2007 13:25:05 -0700 (MST) (envelope-from marid@winserver.com) Message-ID: Date: Sun, 25 Mar 2007 16:24:06 -0400 From: "HECTOR SANTOS" To: ietf-mxcomp@imc.org User-Agent: Thunderbird 2.0a1 (Windows/20060724) MIME-Version: 1.0 Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Organization: Santronics Software, Inc. X-NNTP-Server: WcNNTPServer v6.2.452.1 Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.1 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Randy Smith wrote: > > Greetings, > > I was recently discussing various issues surrounding email with a > coworker and had a couple of ideas for authentication systems that I > would like to get some feedback on. You can read my ideas at > http://perlstalker.blogspot.com/2007/03/mail-server-registries-and-foreign.html. > > > As I said, I'm looking for feedback. Are these ideas worth pursuing or > am I barking up the wrong tree? > > Thank you for your time. In my opinion, you are not barking up the wrong tree, but the "inevitable tree." Its not a new concept, but a concept we have moved away from in the name of having an open anonymous system. But we seem to be reinventing ourselves to go back to this direction. In short, you are simply talking about a client/server negotiation handshake stage. In my opinion, maybe not in our "engineering" life time, this is will be the ultimate method of client/server operations. The anonymous sender will be "thing" of the past. Look at the old Fidonet technology, 100% based on a similar client/server negotiation concepts. 1) Every server MUST be "registered" with a "HOST", in Fidonet, that would be your uplink Net or Zone Host. In the internet, that might be your "ISP", the early forms of Fidonet Net/Zone Hosting systems that were the backbone of the topology. 2) When installing the software, you applied for a FIDONET address and your "ISP" would check your system for 100% FTN compliance before you were assigned a Fidonet Address. 3) You were not allowed to be part of the "net" if you did not have a 100% FTN compliant client and server. Not compliant? No Fidonet address was given to you. 4) There were four basic requirements: 4.a) The software support the legacy FTN1 file transfer protocol. The more advanced IEMSI is akin to what we have today with EHLO and extended server attributes. 4.b) Although you can apply for a private address, ALL servers must be available during Zone Mail Hour (ZMH). This is akin to having a 100% closed system but there were designated times where you allowed anonymous mail (from a registered FTN member) to come in. 4.c) ZMH was designed for making sure ROUTED mail is ALWAYS available. So even if you didn't allow DIRECT mail, a person can send routed mail to you via your HOST which you must ALWAYS accept. 4.d) During ZHM, at a minimum FTN1 must be supported. There were probably others, but the above were the main things and in addition, the most contentious issues during the "Fidonet/Internet Migration Days." The legacy FTN1 protocol was REALLY old and it has major problems in packet switching networks. ZMODEM and other file transfer protocols designed for Packet switching networks were part of the newer generation Fidonet software, but were OPTIONAL and not required. However, new developers were not bothering with the older problematic FTN1 protocol and using the new protocols which at least 99% of all systems supported. But the old school FTN net police insisted on FTN1 and rejected applications, registrations of any person installing newer and better software if it didn't have FTN1 support. This turned off alot of developers and with the Internet humming around the corner, and new FTSC (akin to IETF) groups created to get around these policing issues, Fidonet began on a death spiral. The one thing the FTSC had control of was the NodeList, this would be akin to DNS. So new Nodelist ZONE files were created to establish new networks where the FTSC had no control. In any case, conceptually, we are talking about the same type of direction. - Registration of servers and clients within some "controlled and centralized" nodelist/DNS system. - It will confronted with the same Legacy issues of supporting legitimate clients that might not part of the "controlled network." As with Fidonet, this is where you will have the major uphill battle. The IETF is dead set against breaking the the current open network integrity of the system. Legacy software must be supported. I happen to agree. Legacy software must be supported, however, I am also open to introducing a ZMH like idea where systems are allowed to designate "open" and "closed" times for legacy systems. Based on these experiences, I had started a IETF draft awhile back that basically defined "SERVER ATTRIBUTES" records that clients will use to obtain server attributes that will cover these client/server negotiation parameters. I happen to believe the idea will be eventually be a major part of the system, in some form or another and we are beginning to touch based with it with DKIM and its SSP ideas. Also look at the growth of SIP communications. It is all going (back) in this direction. -- Hector Santos/CTO Santronics Software, Inc. From owner-ietf-mxcomp@mail.imc.org Mon Mar 26 02:06:53 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HViM1-0003Pr-NJ for marid-archive@lists.ietf.org; Mon, 26 Mar 2007 02:06:53 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HViLw-0004cG-W5 for marid-archive@lists.ietf.org; Mon, 26 Mar 2007 02:06:53 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2Q5Z6Br056144 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 25 Mar 2007 22:35:06 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2Q5Z6ko056143; Sun, 25 Mar 2007 22:35:06 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from ciao.gmane.org (main.gmane.org [80.91.229.2]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2Q5Yh76056129 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Sun, 25 Mar 2007 22:35:05 -0700 (MST) (envelope-from gim-ietf-mxcomp@gmane.org) Received: from list by ciao.gmane.org with local (Exim 4.43) id 1HVhqg-0001uF-95 for ietf-mxcomp@imc.org; Mon, 26 Mar 2007 07:34:30 +0200 Received: from du-001-092.access.de.clara.net ([212.82.227.92]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 26 Mar 2007 07:34:30 +0200 Received: from nobody by du-001-092.access.de.clara.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 26 Mar 2007 07:34:30 +0200 X-Injected-Via-Gmane: http://gmane.org/ To: ietf-mxcomp@imc.org From: Frank Ellermann Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Date: Mon, 26 Mar 2007 06:33:09 +0200 Organization: Lines: 21 Message-ID: <46074D05.252A@xyzzy.claranet.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: du-001-092.access.de.clara.net X-Mailer: Mozilla 3.0 (OS/2; U) Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 HECTOR SANTOS wrote: > But the old school FTN net police insisted on FTN1 and rejected > applications, registrations of any person installing newer and > better software if it didn't have FTN1 support. Nobody was forced to use it for sending mail, unless that person was a *C obliged to test that applicants can receive FTN1 mails. I needed FTN1 for crash mails (rarely, but still). > The one thing the FTSC had control of was the NodeList Nope. The FTSC was the standards committee, like IETF/IESG/IAB. The NodeLists were controlled by the *Cs (ultimately the ZCs of the relevant zones), that's like ICANN. The FTSC controlled the definition of the nodelist format (in theory, never changed in my time), not the content. Frank From owner-ietf-mxcomp@mail.imc.org Mon Mar 26 22:00:23 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HW0z0-0003xt-VI for marid-archive@lists.ietf.org; Mon, 26 Mar 2007 22:00:22 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HW0yy-0002TE-Hl for marid-archive@lists.ietf.org; Mon, 26 Mar 2007 22:00:22 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2R1Ki9p033241 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 26 Mar 2007 18:20:44 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2R1KiSx033240; Mon, 26 Mar 2007 18:20:44 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from a.mail.sonic.net (a.mail.sonic.net [64.142.16.245]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2R1KNZW033226 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 26 Mar 2007 18:20:43 -0700 (MST) (envelope-from dotis@mail-abuse.org) Received: from [192.168.2.40] (64-142-13-68.dsl.static.sonic.net [64.142.13.68]) (authenticated bits=0) by a.mail.sonic.net (8.13.8.Beta0-Sonic/8.13.7) with ESMTP id l2R1KKU8026786 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Mon, 26 Mar 2007 18:20:21 -0700 Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal From: Douglas Otis To: Randy Smith Cc: ietf-mxcomp@imc.org In-Reply-To: References: Content-Type: text/plain Date: Mon, 26 Mar 2007 18:20:20 -0700 Message-Id: <1174958420.5962.76.camel@dcore.sonic.net> Mime-Version: 1.0 X-Mailer: Evolution 2.8.3 (2.8.3-1.fc6) Content-Transfer-Encoding: 7bit Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 On Fri, 2007-03-23 at 20:51 -0600, Randy Smith wrote: > Greetings, > > I was recently discussing various issues surrounding email with a > coworker and had a couple of ideas for authentication systems that I > would like to get some feedback on. You can read my ideas at > http://perlstalker.blogspot.com/2007/03/mail-server-registries-and-foreign.html. > > As I said, I'm looking for feedback. Are these ideas worth pursuing or > am I barking up the wrong tree? It would seem OpenID is ideal for controlling a recipient's access to information being sent using BURL style messages. OpenID means the sender would not need to control how the recipient confirms their identity. There would need to be a convention established to translate email-addresses to a URI convention suitable for use with OpenID. This would protect message content as well as confirm the recipient actually received their message. This seems like an ideal mechanism for various sensitive commerce related transactions. By pointing to the message with a URI, there would not be any need to verify the identity of the message source. However, the source URI should use the same conventions as that used for OpenID recipient. As OpenID really needs a specialized viewer, where one designed to function as an MUA would not be unreasonable. OpenID could also help establish filtering criteria as well. OpenID is an interesting mechanism. -Doug From owner-ietf-mxcomp@mail.imc.org Wed Mar 28 10:11:01 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HWYrd-0002xZ-Ab for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:11:01 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWYra-0002Sz-5O for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:11:01 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SDb6ml063584 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Mar 2007 06:37:06 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2SDb6om063583; Wed, 28 Mar 2007 06:37:06 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.229]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SDahA2063563 for ; Wed, 28 Mar 2007 06:37:05 -0700 (MST) (envelope-from perlstalker@gmail.com) Received: by nz-out-0506.google.com with SMTP id z3so1996509nzf for ; Wed, 28 Mar 2007 06:36:42 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=FwgdgSAcwGGLmgPOAPrPb2UT+xwTEMDozFK6dqXuw4VwcBR09bIyiMN3/C/IWVfhGB/bFCKhK/wGdTCgxNwjjkV44KFPss/mbIWSVkbwkT7agRRmkN+QLlnsJAoNwxED+IWBuz2IAqIq7zifxSjmQ8hP8iha8nPUpsqepOgIe/w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=JrK2dWlURKhTr+pogFuLb2aaTceeVNlXDGjEmXHxuw44veATd05Y6ULOOllMFKcomgh7pYhINWK0OwQdRX4k8g+cv0EffQbgO5QXDI0mpsMXESzJTczeaBnbN3HBZr1EDtuxTGHn39W2wq3m7jrNLBCoojndtRKXAGYWdjBIRDY= Received: by 10.114.201.1 with SMTP id y1mr3713290waf.1175089001574; Wed, 28 Mar 2007 06:36:41 -0700 (PDT) Received: by 10.115.48.1 with HTTP; Wed, 28 Mar 2007 06:36:41 -0700 (PDT) Message-ID: Date: Wed, 28 Mar 2007 07:36:41 -0600 From: "Randy Smith" To: "Hector Santos" Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Cc: ietf-mxcomp@imc.org In-Reply-To: <4606E11C.3050904@santronics.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <4606E11C.3050904@santronics.com> X-Google-Sender-Auth: 423f2ddd99c5d0db Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 32b73d73e8047ed17386f9799119ce43 On 3/25/07, Hector Santos wrote: > Randy Smith wrote: > > > > Greetings, > > > > I was recently discussing various issues surrounding email with a > > coworker and had a couple of ideas for authentication systems that I > > would like to get some feedback on. You can read my ideas at > > http://perlstalker.blogspot.com/2007/03/mail-server-registries-and-foreign.html. > > > > > > As I said, I'm looking for feedback. Are these ideas worth pursuing or > > am I barking up the wrong tree? > > > > Thank you for your time. > > > In my opinion, you are not barking up the wrong tree, but the > "inevitable tree." Its not a new concept, but a concept we have moved > away from in the name of having an open anonymous system. But we seem to > be reinventing ourselves to go back to this direction. The biggest problem, IMO, is not the open system but the anonymous one. One reason spam works so well is that its so very easy to lie about who the sender is. I don't think there's any reason why a mail admin couldn't setup their own registration server but as the recipient, I need to have some way of knowing that I can trust the registry, hence the web of trust built around server keys. > > In short, you are simply talking about a client/server negotiation > handshake stage. In my opinion, maybe not in our "engineering" life > time, this is will be the ultimate method of client/server operations. > The anonymous sender will be "thing" of the past. > [snip: fidonet history] > > In any case, conceptually, we are talking about the same type of direction. > > - Registration of servers and clients within some "controlled > and centralized" nodelist/DNS system. > > - It will confronted with the same Legacy issues of supporting > legitimate clients that might not part of the "controlled network." > > As with Fidonet, this is where you will have the major > uphill battle. The IETF is dead set against breaking the > the current open network integrity of the system. Legacy > software must be supported. > > I happen to agree. Legacy software must be supported, however, I am also > open to introducing a ZMH like idea where systems are allowed to > designate "open" and "closed" times for legacy systems. What I'm thinking of would be an extension to SMTP rather than an entirely new system. As the main admin for an ISP, the last thing I want to do is build a second system to handle a new protocol that hardly anyone uses (at least, until the rest of the Net migrated). I think the hand shake could be complete wrapped within the SMTP conversation. > > Based on these experiences, I had started a IETF draft awhile back that > basically defined "SERVER ATTRIBUTES" records that clients will use to > obtain server attributes that will cover these client/server negotiation > parameters. I happen to believe the idea will be eventually be a major > part of the system, in some form or another and we are beginning to > touch based with it with DKIM and its SSP ideas. Also look at the > growth of SIP communications. It is all going (back) in this direction. It may be necessary to add a capabilities keyword similar to IMAP or specify that the EHLO response include a list of supported keywords. Thank you for taking the time to respond to my ramblings. :-) > > -- > Hector Santos/CTO > Santronics Software, Inc. > > > > -- Randy Smith http://vuser.org/ http://perlstalker.vuser.org/ From owner-ietf-mxcomp@mail.imc.org Wed Mar 28 10:11:02 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HWYre-0002xm-45 for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:11:02 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWYrZ-0002SD-Lo for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:11:02 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SDhFWu063919 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Mar 2007 06:43:15 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2SDhF5c063918; Wed, 28 Mar 2007 06:43:15 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.175]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SDgr7D063906 for ; Wed, 28 Mar 2007 06:43:14 -0700 (MST) (envelope-from perlstalker@gmail.com) Received: by ug-out-1314.google.com with SMTP id j3so225432ugf for ; Wed, 28 Mar 2007 06:42:53 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=Xn23GlYhqHnLZubF/NTf9qI6QkH8rlZVKblqbzsyBo//fBnFaLVBPSUTE/FUCF6Y92Mrd3yEB45HL8hzFW3vuXy31YUmcBtMbyZMqKK8vJeV0VcNW9HC8bgAJfNBjmv2VVzUnLA5u8R/9949zN8L2HpYWP33L5+HX3P3BexAqQQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=eiIFkBeXayDmnpDW+3PLhX+nLE+0KAUP4SjpGiGIuu0pg/pLQIUSBEwVAKxrprh5yJAoWx2A/CbGbmRBpjaxA7J7Mbdhp5twhFpG7BkbaDj+tpPNLz3A+ajrLDee2cXyLnZtST4NotuanuSYtBasVjbatXt1G1WcYkayT3tvvyY= Received: by 10.114.137.2 with SMTP id k2mr3722247wad.1175089371663; Wed, 28 Mar 2007 06:42:51 -0700 (PDT) Received: by 10.115.48.1 with HTTP; Wed, 28 Mar 2007 06:42:51 -0700 (PDT) Message-ID: Date: Wed, 28 Mar 2007 07:42:51 -0600 From: "Randy Smith" To: "Douglas Otis" Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Cc: ietf-mxcomp@imc.org In-Reply-To: <1174958420.5962.76.camel@dcore.sonic.net> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <1174958420.5962.76.camel@dcore.sonic.net> X-Google-Sender-Auth: d340263847530f16 Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c On 3/26/07, Douglas Otis wrote: > On Fri, 2007-03-23 at 20:51 -0600, Randy Smith wrote: > > Greetings, > > > > I was recently discussing various issues surrounding email with a > > coworker and had a couple of ideas for authentication systems that I > > would like to get some feedback on. You can read my ideas at > > http://perlstalker.blogspot.com/2007/03/mail-server-registries-and-foreign.html. > > > > As I said, I'm looking for feedback. Are these ideas worth pursuing or > > am I barking up the wrong tree? > > It would seem OpenID is ideal for controlling a recipient's access to > information being sent using BURL style messages. OpenID means the > sender would not need to control how the recipient confirms their > identity. There would need to be a convention established to translate > email-addresses to a URI convention suitable for use with OpenID. Perhaps. Simpler from the recipient's perspective would be to have the send specify a the URL as part of the SMTP conversation. > > This would protect message content as well as confirm the recipient > actually received their message. This seems like an ideal mechanism for > various sensitive commerce related transactions. I hadn't thought of that but it might be an interesting fringe benefit. > By pointing to the > message with a URI, there would not be any need to verify the identity > of the message source. However, the source URI should use the same > conventions as that used for OpenID recipient. > > As OpenID really needs a specialized viewer, where one designed to > function as an MUA would not be unreasonable. OpenID could also help > establish filtering criteria as well. OpenID is an interesting > mechanism. Since OpenID is built to allow authentication, among other things, against 3rd party systems, it seems like an excellent way to allow and recipient server to authenticate all users who wish to send or deliver mail with their server. Thanks for taking the time to respond. -- Randy Smith http://vuser.org/ http://perlstalker.vuser.org/ From owner-ietf-mxcomp@mail.imc.org Wed Mar 28 10:35:35 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HWZFP-00045o-Es for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:35:35 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWZFM-00066w-S1 for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 10:35:35 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SE5NEE065291 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Mar 2007 07:05:23 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2SE5NSa065290; Wed, 28 Mar 2007 07:05:23 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from sokol.elan.net (sokol.elan.net [216.151.192.200]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2SE4x5n065267 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 28 Mar 2007 07:05:22 -0700 (MST) (envelope-from william@elan.net) Received: from sokol.elan.net (sokol [127.0.0.1]) by sokol.elan.net (8.13.1/8.13.1) with ESMTP id l2SF3f9G009713; Wed, 28 Mar 2007 07:03:41 -0800 Received: from localhost (william@localhost) by sokol.elan.net (8.13.1/8.13.1/Submit) with ESMTP id l2SF3eaP009709; Wed, 28 Mar 2007 07:03:41 -0800 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs Date: Wed, 28 Mar 2007 07:03:40 -0800 (PST) From: "william(at)elan.net" To: Randy Smith cc: Hector Santos , ietf-mxcomp@imc.org Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal In-Reply-To: Message-ID: References: <4606E11C.3050904@santronics.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 On Wed, 28 Mar 2007, Randy Smith wrote: > The biggest problem, IMO, is not the open system but the anonymous > one. One reason spam works so well is that its so very easy to lie > about who the sender is. Hence we have SPF and proposals such as DKIM and others. > I don't think there's any reason why a mail > admin couldn't setup their own registration server but as the > recipient, I need to have some way of knowing that I can trust the > registry, hence the web of trust built around server keys. One of the issues is that SMTP is not fully client-server but rather store-forward protocol. When you communicate with someone over SMTP as a client you do not know if its true end-user or not. > What I'm thinking of would be an extension to SMTP rather than an > entirely new system. As the main admin for an ISP, the last thing I > want to do is build a second system to handle a new protocol that > hardly anyone uses (at least, until the rest of the Net migrated). SMTP is built in such a way that extensions to SMTP that any serious extensions only you support are to large degree exactly like a new protocol. > I think the hand shake could be complete wrapped within the SMTP > conversation. We have that in a way - EHLO provides list of capabilities of the server. keywords issued during RCPT and MAIL FROM provide list of capabilities of the client. Even with additional EHLO-like keyword that client would issue the issue is that it could "lie" if it does not want to list certain capabilities based on what it saw capabilities of the server are - so its all volunterily in the same way MAIL FROM and RCPT keywords are when client wants to advertise and turn on certain protocol functions. > It may be necessary to add a capabilities keyword similar to IMAP or > specify that the EHLO response include a list of supported keywords. EHLO is already basicly list of supported extensions where each one can be further subdevided (this is rarely used) into support sub-extensions/parameters > Thank you for taking the time to respond to my ramblings. :-) No problem, that's what we're still here for :) >> -- >> Hector Santos/CTO >> Santronics Software, Inc. From owner-ietf-mxcomp@mail.imc.org Wed Mar 28 23:17:10 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HWl8Q-0002Ew-U1 for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 23:17:10 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWl8O-0007Os-ER for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 23:17:10 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2T2owif014199 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Mar 2007 19:50:58 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2T2owCC014198; Wed, 28 Mar 2007 19:50:58 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from cirrus.av8.net (cirrus.av8.net [130.105.36.66]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2T2oaYa014187 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for ; Wed, 28 Mar 2007 19:50:57 -0700 (MST) (envelope-from dean@av8.com) Received: from [130.105.12.10] ([130.105.12.10]) (authenticated bits=0) by cirrus.av8.net (8.12.11/8.12.11) with ESMTP id l2T2oTYt019441 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO); Wed, 28 Mar 2007 21:50:29 -0500 Date: Wed, 28 Mar 2007 22:50:28 -0400 (EDT) From: Dean Anderson X-X-Sender: dean@citation2.av8.net To: Randy Smith cc: Hector Santos , Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.8 (/) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc On Wed, 28 Mar 2007, Randy Smith wrote: > > The biggest problem, IMO, is not the open system but the anonymous > one. One reason spam works so well is that its so very easy to lie > about who the sender is. This is myth, stated since at least 1996, probably earlier. 10+ years of anti-spam work shows that one does not need to know "who" is sending mail to effectively complain. One only needs the IP address and a time. Their ISP knows who they are, or they don't. The ability to lie is irrelevant. That's as good as that identity information gets, too. Privacy laws would preclude anything else. The biggest problem is that the real commercial bulk emailers comply with CAN-SPAM, and thus aren't a problem, while the miscreants send pure annoyance with no commercial purpose, but it takes a bit of research to figure that out. One really needs to find out who the miscreants are. I've identified a few: they were pretending to be anti-spammers. They still pretend to be anti-spammers. > I don't think there's any reason why a mail admin couldn't setup their > own registration server but as the recipient, I need to have some way > of knowing that I can trust the registry, hence the web of trust built > around server keys. This was tried and didn't work. 'Trust' for email sending, extends to everyone, and the system is still subject to abuse, albeit cryptographically signed abuse, and now you have a problem with key management, and you still need their ISP to translate a real identity to a crypto key, which they still can't do without a court order or warrant. And a new account comes with a different crypto key, and keys will be stolen by viruses and rooting. Same problem, many dollars later. But good if you are selling crypto-email systems and consulting. I showed in 2003 that information theory PROVES that the miscreant abusers cannot be stopped by technical means, because a communications system that is free from abuse [that is 'can't be abused' in contrast to just 'isn't being abused'] is also free from covert channels, and hence contrary to a thereom of information theory which states that a communication system can't be proven free of covert channels. Covert channels are always possible. It is always possible to abuse a communication system. So, whack-a-mole is as good as it gets. Actually, that's not a strong enough statement. This is better: Whack-a-mole is as good as it CAN get, without upending information theory. Since information theory is tied to thermodynamics, and is physically and mathematically sound, that probably won't happen. What to do? Get good a whack-a-mole. Indeed, we can get better at that: standard forms for abuse complaints comes to mind. Maybe a standarized web app for submitting such forms, that can be supported by every ISP complaint/ticket system as a standard interface. -- It is quite ironic that the people who talk most about reputation systems have no problem associating _themselves_ with very disreputatable people and court-proven liars, people pretending to be anti-spammers, but obviously not. I suspect there is a story there, somewhere; amid the people who pretend to be anti-spammers while engaging in abuse and lies for their personal gain. A long time ago, I said that someday, when the script kiddies get to be adults, and the statute of limitations expires on their activity, that they will come forward and spill their beans on who, what, why and when. I think the "Kevin Mitnicks" of the script-kiddie spamming world will want to tell their stories. The first generation of script kiddies should be coming of age and beyond the statute of limitations pretty soon. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000 From owner-ietf-mxcomp@mail.imc.org Wed Mar 28 23:17:23 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HWl8d-0002H5-2h for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 23:17:23 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWl8b-0007Q0-Jo for marid-archive@lists.ietf.org; Wed, 28 Mar 2007 23:17:23 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2T2rP38014431 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Mar 2007 19:53:25 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2T2rPxP014430; Wed, 28 Mar 2007 19:53:25 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from corp-mail.e-dialog.com (corp-mail.e-dialog.com [64.28.75.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2T2r4IF014418 for ; Wed, 28 Mar 2007 19:53:24 -0700 (MST) (envelope-from JMacDonald@e-dialog.com) Received: from jmac ([10.200.6.69]) by corp-mail.e-dialog.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 28 Mar 2007 22:53:03 -0400 Date: Wed, 28 Mar 2007 22:52:57 -0400 From: Jeff Macdonald To: Randy Smith Cc: Douglas Otis , ietf-mxcomp@imc.org Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Message-ID: <20070329025257.GB3646@jmac> References: <1174958420.5962.76.camel@dcore.sonic.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.12-2006-07-14 X-OriginalArrivalTime: 29 Mar 2007 02:53:03.0367 (UTC) FILETIME=[5E985170:01C771AD] Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 On Wed, Mar 28, 2007 at 07:42:51AM -0600, Randy Smith wrote: > Since OpenID is built to allow authentication, among other things, > against 3rd party systems, it seems like an excellent way to allow and > recipient server to authenticate all users who wish to send or deliver > mail with their server. Randy, could you use OpenID terms in describing your SMTP extension? I'm having trouble understanding how this would work from your description in your blog. Adding PGP seems to add additional overhead for what OpenID provides (unless I'm totally mis-understanding OpenID). Here are what I think are some of the relevant terms: MTA terms: C: Sending MTA - sending message S: Receiving MTA - receiving message OpenID terms: Consumer - wants proof End User - wants to prove their identity to Consumer User Agent - End user web browser I is the Identity server Say there is a new ESMTP keyword, OPENID. Here's a breakdown loosely following your example: C->S: connects S->C: banner C->S: ehlo S->C: OPENID is returned along with whatever else C->S: OPENID S: S->I: S->C: 250 S->I: associate with identity provider? Section 4.1.x C->I: go to identity provider? Section 4.2.x C->S: OPENID CRED S->C: 250 Ok Credentials are OK I may of abused SMTP extensions in this example (re: OPENID CRED). -- :: Jeff Macdonald | Principal Engineer, Messaging Technologies :: e-Dialog | jmacdonald@e-dialog.com :: 131 Hartwell Ave. | Lexington, MA 02421 :: v: 781-372-1922 | f: 781-863-8118 :: www.e-dialog.com From owner-ietf-mxcomp@mail.imc.org Thu Mar 29 15:19:53 2007 Return-path: Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1HX05x-0005U2-Ih for marid-archive@lists.ietf.org; Thu, 29 Mar 2007 15:15:37 -0400 Received: from balder-227.proper.com ([192.245.12.227]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1HWzyk-00082d-BU for marid-archive@lists.ietf.org; Thu, 29 Mar 2007 15:08:14 -0400 Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2TIe3iO087609 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 29 Mar 2007 11:40:03 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id l2TIe3R2087607; Thu, 29 Mar 2007 11:40:03 -0700 (MST) (envelope-from owner-ietf-mxcomp@mail.imc.org) X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-mxcomp@mail.imc.org using -f Received: from b.mail.sonic.net (b.mail.sonic.net [64.142.19.5]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id l2TIdgo3087577 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 29 Mar 2007 11:40:03 -0700 (MST) (envelope-from dotis@mail-abuse.org) Received: from [10.2.165.149] (net-office-sjc.mail-abuse.org [168.61.0.42]) (authenticated bits=0) by b.mail.sonic.net (8.13.8.Beta0-Sonic/8.13.7) with ESMTP id l2TIdXa1017831 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Thu, 29 Mar 2007 11:39:36 -0700 In-Reply-To: <20070329025257.GB3646@jmac> References: <1174958420.5962.76.camel@dcore.sonic.net> <20070329025257.GB3646@jmac> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Cc: ietf-mxcomp@imc.org Content-Transfer-Encoding: 7bit From: Douglas Otis Subject: Re: Mail Server Registries and Foreign Sender Authentication: A Proposal Date: Thu, 29 Mar 2007 11:39:33 -0700 To: Jeff Macdonald X-Mailer: Apple Mail (2.752.2) Sender: owner-ietf-mxcomp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: X-Spam-Score: 0.0 (/) X-Scan-Signature: b22590c27682ace61775ee7b453b40d3 On Mar 28, 2007, at 7:52 PM, Jeff Macdonald wrote: > On Wed, Mar 28, 2007 at 07:42:51AM -0600, Randy Smith wrote: > >> Since OpenID is built to allow authentication, among other things, >> against 3rd party systems, it seems like an excellent way to allow >> and recipient server to authenticate all users who wish to send or >> deliver mail with their server. > > Randy, could you use OpenID terms in describing your SMTP extension? I don't think an SMTP extension is required. Explaining follows: > I'm having trouble understanding how this would work from your > description in your blog. Adding PGP seems to add additional > overhead for what OpenID provides (unless I'm totally mis- > understanding OpenID). Here are what I think are some of the > relevant terms: > > MTA terms: > C: Sending MTA - sending message > S: Receiving MTA - receiving message There are OpenID extensions proposed to allow the exchange of public keys related to an Identity. http://openid.net/specs/openid-service-key-discovery-1_0-01.html There are OpenID extensions proposed for email-addresses such as: http://www.sappenin.com/openid/ext/oet/openid-email-transform- extension-1_0.html http://blog.phpbb.cc/2007/02/04/smtp-service-extension-for-yadis- discovery/ Now imagine an extension to DKIM, OpenPGP, or S/MIME where a query method is defined for OpenID. This would allow senders to sign messages and allow recipients to verify using extensions proposed for identifying email-addresses using OpenID. This would not require any change to SMTP, but would require a minor change to DKIM, OpenPGP, or S/MIME. But it gets better... > OpenID terms: > Consumer - wants proof > End User - wants to prove their identity to Consumer > User Agent - End user web browser Add: Sender - wants proof of recipient and secure receipt for web exchanged information. It would also be possible to forgo any public-key cryptography related to the message by using standardized conventions for where the web exchanged information is placed with regard to a specific identity. Perhaps a subdomain of OMail. could work where the local-part is normalized within the first path. Sub-path components could function as the message-ID, for example. When a message is exchanged using something like BURL, the identity of the sender can be deduced from the embedded URI. Nothing else is needed as it would be expected this location would be identified using SSL certs when related to commerce. It would be rather difficult to forge such messages when the entire message body is found via the link. The web server could then use OpenID to ensure only the intended recipient receives the message. When done using HTTPS, email becomes secure without use of encrypted messages. OpenID is already establishing whitelists to protect blogs. This effort could extend to whitelisting email that is sent using such conventions. > I is the Identity server > > Say there is a new ESMTP keyword, OPENID. Here's a breakdown loosely > following your example: > > C->S: connects > S->C: banner > > C->S: ehlo > S->C: OPENID is returned along with whatever else There could be extensions made in the HTTP header structures found in OMail subdomain that lists the root names of all "authorized" SMTP clients, for example. I doubt this would be needed once only BURL style messages are adopted as an exclusive mode of exchange. This will take awhile. > C->S: OPENID > S: > S->I: > S->C: 250 Possible, but this would require a lengthy adoption process. There could be a convention used for the SMTP client host-name that also signals use of an authorization field found within the OMail subdomain. This convention might look something like: EHLO: OMAIL-.. > S->I: associate with identity provider? Section 4.1.x > > C->I: go to identity provider? Section 4.2.x > > C->S: OPENID CRED > S->C: 250 Ok Credentials are OK > > > > I may of abused SMTP extensions in this example (re: OPENID CRED). An extension could also be used. Which ever shows the least resistance will likely be the best choice. -Doug