Subject: [apps-discuss] Comments on draft-wmills-rrvs-header-field-00

From: Kurt Andersen <[email-masked]>
Date: Fri, 19 Jul 2013 07:30:34 -0700

On Fri, 19 Jul 2013 07:20:03 -0700, Murray S. Kucherawy wrote:

> If an account was created at time T1, then an inquiry as to whether it's
> been under continuous ownership since time T0 (for T0 < T1) would be "no".

What would the expected response be for a mailbox provider who, for
instance, replaced their underlying infrastructure two years ago if
they receive an rrvs header that inquires about the continuity of
ownership for a time prior to the systems replacement? Their knowledge
horizon is limited to two years (in this example), yet the rrvs header
might be predicating five years of continuity.

--Kurt Andersen

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Jul 2013 11:49:39 -0700

> might be predicating five years of continuity.
Good question.  I would say that a participating receiver should reject
such a message; the author is asserting that the content of the message is
unsafe to deliver unless continuous ownership can be confirmed, for the
sake of protecting one of its users.  In the case you described, such
confirmation isn't possible.

Such an operator might also want to consider not participating at all.

What do others think?

-MSK

---

From: "John Levine" <[email-masked]>
Date: 19 Jul 2013 19:07:40 -0000

>Such an operator might also want to consider not participating at all.

Seems to me that if I'm buying a used domain without buying its users,
there is little reason to accept any mail that it asserts that it is
intended for one of those former users.

So assuming I already have the infrastructure to do body filtering in
the SMTP session, it seems like a cheap way to reject mail that I know
is a mistake.

R's,
John

---

From: Kurt Andersen <[email-masked]>
Date: Fri, 19 Jul 2013 12:38:11 -0700

On Fri, Jul 19, 2013 at 11:49 AM, Murray S. Kucherawy
<[email-masked]> wrote:
> Good question.  I would say that a participating receiver should reject such
> a message; the author is asserting that the content of the message is unsafe
> to deliver unless continuous ownership can be confirmed, for the sake of
> protecting one of its users.  In the case you described, such confirmation
> isn't possible.
>

It seems to me that "asserting that the . . . message is unsafe to
deliver . . . unless continuous ownership is confirmed" is a
significantly stronger statement than the position that is set forth
in the draft. To make such an assertion would limit the scope of
applicability for this mechanism to security and identity related
messages only: things like password reset but not "updates from your
friends".

--Kurt Andersen

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 19 Jul 2013 14:03:09 -0700

> messages only: things like password reset but not "updates from your
Who's to say updates from your friends aren't equally sensitive, or
possibly even more so?

-MSK