Subject: [saag] Ubiquitous Encryption: spam filtering

From: "John Levine" <[email-masked]>
Date: 23 Jun 2015 15:19:02 -0000

I can't find in the archives whether the ubiquitous encryption
discussion has looked at the knotty issues of spam filtering.

It's a really hard problem -- filtering is essential to keep mail
usable, both due to the sheer volume of the spam and the need to keep
phishing and malware away from recipients.  You can do some filtering
on the envelope, but there's no substitute for looking at the contents
of the message.

All of the middlebox issues apply, it's much easier to do the
filtering on a large shared server than at endpoints.  Partly that's
because the endpoints often have limited bandwidth and compute power
(think phones) and partly it's because effective filtering needs to
consult shared frequently updated lists of malware signatures and
malicious urls.

R's,
John

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 23 Jun 2015 11:22:42 -0400

Hi John,

There is some text in the draft. If we missed anything or didn't go into
enough detail yet, contributions are welcome, especially if you are active
in this area.

Thank you!

On Tue, Jun 23, 2015 at 11:19 AM, John Levine <[email-masked]> wrote:

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

-- 

Best regards,
Kathleen

---

From: "John R Levine" <[email-masked]>
Date: 23 Jun 2015 12:30:15 -0300

> enough detail yet, contributions are welcome, especially if you are active

I guess I count as active in this area.  Will send text when I'm not 
pretending to pay attention in an ICANN session.

R's,
John

PS: Editorial nit: "SPAM" is pink meat, "spam" is unwanted messages.

>> consult shared frequently updated lists of malware signatures and

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Nico Williams <[email-masked]>
Date: Tue, 23 Jun 2015 11:11:53 -0500

On Tue, Jun 23, 2015 at 03:19:02PM -0000, John Levine wrote:
> filtering on a large shared server than at endpoints.  [...]

I agree.  E-mail is different from web.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 29 Jun 2015 23:13:19 -0400

> consult shared frequently updated lists of malware signatures and

I don't think it is actually much of a problem in practice. People just
have to be prepared to accept that they probably don't want end-to-end
encrypted mail from people they don't know. Once that is accepted, the
solutions are fairly straightforward, the publicly visible email encryption
key is to the spam filter, after a reply send an end to end key...

Main constraint is that you don't want to accept end-to-end encrypted email
unless it is signed by someone you know. So the endy mail problem becomes
an introduction problem.

---

From: joel jaeggli <[email-masked]>
Date: Mon, 29 Jun 2015 23:27:43 -0700

On 6/29/15 8:13 PM, Phillip Hallam-Baker wrote:
> 
> 
> On Tue, Jun 23, 2015 at 11:19 AM, John Levine <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
> solutions are fairly straightforward, the publicly visible email
> encryption key is to the spam filter, after a reply send an end to end
> key...
> 
> Main constraint is that you don't want to accept end-to-end encrypted
> email unless it is signed by someone you know. So the endy mail problem
> becomes an introduction problem. 

The fact that parties that are known to each other have not in general
been mutually authenticated is a, if not the, significant conduit of
phishing.

---

From: Eliot Lear <[email-masked]>
Date: Tue, 30 Jun 2015 08:46:00 +0200

Hi,

> been mutually authenticated is a, if not the, significant conduit of

That is A component but not THE component.  When someone gets hacked,
the bad guy usually has access to sufficient bonafides to get something
through the MSA.  To avoid this we would have to go to OOB
authentication systems, and that just ain't happening.

Eliot

---

From: Dave Crocker <[email-masked]>
Date: Tue, 30 Jun 2015 11:42:46 -0700

> been mutually authenticated is a, if not the, significant conduit of

There is a very strong tendency to try to characterize one or another
underlying aspect of human communication as simple, and therefore to
believe that imposing adequate quality control on its conduct is
relatively straightforward.

As an example, new contacts from individuals with whom one has had no
previous contact, constitute an essential component of human
communication.  The constraint stated at the top of this message would
eliminate that capability.

(Another problem with the constraint is that, as noted, it ignores
various other abuse vectors that are based on exploiting those we
already know.)

For every line of anti-abuse pursuit or proposed mechanism for
controlling it, one should always begin by asking how badly it is
Procrustean and whether chopping or stretching online communications
that little bit more really is tolerable.  When the answer is yes,
consider carefully who is making the assessment and what gives them the
right to add that (global) restriction...

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 30 Jun 2015 15:54:31 -0400

> been mutually authenticated is a, if not the, significant conduit of

The first last and only reason phishing is possible is that we use
authentication credentials that we expect people to keep in their head,
never write down and only ever give them to people who are trustworthy.

Needless to say, the result has been a fiasco.

If a tenth the amount of whining that goes on complaining about the
occasional failures of the part of the Web security infrastructure that
(mostly) works had gone into avoiding relying on usernames and passwords
thirty years after crack.

---

From: "John R Levine" <[email-masked]>
Date: 30 Jun 2015 16:04:25 -0400

> never write down and only ever give them to people who are trustworthy.

That's some of it, but I've seen malware that does MITM attacks to 
redirect transactions authenticated with uncompromised two-factor devices. 
If all of the pieces are used exactly correctly, you're pretty secure, but 
we know how likely that is in the long term.

Like I said about spam, it's a hard problem.  In spam, exempting people 
you know from spam filtering doesn't work.  Partly that's because the 
introduction problem is as hard as the spam problem, partly that's because 
it'll just push spammers toward using compromised legit accounts, 
something they do a lot of already.

Regards,