Subject: Re: ISSUE: 3.2.14 : <sender>

From: John Stanley <[email-masked]>
Date: Fri, 6 Jan 2006 18:14:19 -0800 (PST)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>And in practice
>the possibility for an injecting agent to know the email address of the
>sender is restricted to organizations which run their own injecting agent 
...

It does not exist even there. Since this issue is being brought up
again and the same incorrect statements are being made, I'm going to
take the opportunity to correct them again.

An injecting agent cannot possibly know "the email address" I want to use
for USENET-related correspondence EXCEPT by my using it in the From or
Sender header I SEND IT.

Before an agent should be allowed to CHANGE any of that data (or insert
"correct" data in another header) it MUST know that the data I give it
is incorrect. It cannot know this.

Not only is such action a privacy violation, it is a security issue. If
a server inserts any header containing "the email address" for me in a 
form
"username@host", it creates a security issue where a cracker now knows a
valid username and host that he otherwise would not have known. It is an
invitation for a brute-force attack.

Frank Ellermann <nobody@xxxxxxxxxxxxxxxxx>:

>"Killfiling" is an
>important feature for those who have it, but enforcing that
>possibility with a SHOULD goes to far.

Revealing account and mailbox information against the poster's
expressed wishes is not a "killfiling" issue. You can killfile on
the From header easier than on almost any other.

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 10 Jan 2006 13:06:21 GMT

>take the opportunity to correct them again.

And again and again it has been explained to you that you are wrong.

It so happens (as I have said many times) that I gateway this list into a
local newsgroup on my machine. Hence I am writing this reply using my
newsreader.

My newsreader is 'nn', which is quite commonly used.

My news server is CNews, which is also quite commonly used.

You will observe that this reply contains a From: header, indicating that
is came from me. The injecting agent in my CNews knows perfectly well that
it came from me BECAUSE THAT FROM HEADER WAS ACTUALLY INSERTED BY THAT
INJECTING AGENT (and not by nn).

>for USENET-related correspondence EXCEPT by my using it in the From or

Hence the falsity of your statement is evident from the counter-example
you are now looking at. And if my CNews were to be upgraded to generate an
Injection-Info header, it could quite easily generate a sender parameter
if I configured it so.

I grant you that your statement is true as regards user agents that
communicate with their servers via NNTP. I have never claimed otherwise.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: "Forrest J. Cavalier III" <[email-masked]>
Date: Tue, 10 Jan 2006 13:19:52 -0500

> communicate with their servers via NNTP. I have never claimed otherwise.

Thanks for the example of how one single-user toy news servers works.  Excuse
me if fail to see how such examples are convincing when discussing an IETF 
protocol. Glad it works for you, but you cannot generalize world-class
solutions from its example.

And Charles, are you being deliberately obtuse to frustrate?

 >for USENET-related correspondence EXCEPT by my using it in the From or

John did NOT write "No injecting agent can determine the email address".
But your counter-example seems to be refuting that exactly, and not
what he wrote.

If I can rephrase, and if John had all the time in the world to
write verbosely, perhaps it would have come across as....

An injecting agent, in general, cannot determine "the email address"
that the user wishes to appear in a message.  There are security and
privacy reasons to trust users will configure their user agents properly.
Therefore the server must not try to be helpful to remote recipients wishing
to do SPAM filtering (or other lesser goals) when it will compromise
a primary requirement of a local user.

The "in general" is implied, and no-one should need it to be present
to understand John's point.  The primary vs secondary design goal
"tie-breaker" is plain engineering choice.  And it is TOTALLY unacceptable to 
expose a user@host pair as a matter of protocol. The standard must not
even hint that a well-written server would do so.  How can anyone
disagree on this?

So I'm with John, compliant servers MUST NOT modify some of these
user-supplied headers.  Period.  End of story.  No SHOULD NOT, no
MAY.  Refuse the article if the server determines it violates policy,
but privacy and security are primary goals here.

But, you know, this is just a drop in the bucket.  If we cannot even
agree on how to write clearly so that we agree on the issues to discuss,
it's all pointless.  Please uncharter this working group.

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 11 Jan 2006 03:17:48 +0100

Charles Lindsey wrote:

> the falsity of your statement is evident from the
> counter-example you are now looking at.

news.t-online.de used RADIUS and had some magic to relate
this to mail address(es) of the corresponding account.

IIRC it used that to verify From user@t-online addresses
in the case of cancels.  It's definitely possible in some
cases.  It might be even a desirable feature if the AUP
is clear about it, and legal in the country of the server.

                       Bye, Frank

---

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 11 Jan 2006 12:10:08 GMT

>that the user wishes to appear in a message.

Nobody claims that it can (and if I misinterpreted what John was claiming,
then my apologies). But for sure some injecting agents in some setups can
determine the/a 'true' email address of the sender whatever the sender
actually put in his "From:", and such injecting agents _can_ then insert
that information in an Injection-Info header.

>  There are security and

Whether inserting such sender information in an Injection-Info header is
wise/legal/helpful/whatever is a separate issue which should be (and is -
using a paragraph we agreed on years ago) discussed in USEAGE, not in the
standard. Our chair seems to agree with that, since he recently said that
a pointer to USEAGE would be in order. And it also seems that a "SHOULD"
in the present wording regarding that "sender" parameter will have to be
removed at the same time since the general opinion seems against it.

>even hint that a well-written server would do so.  How can anyone

There is (and always has been, even in this group) a tension between those
who want to hide the source of an article except by showing information
that only the injecting ISP can associate with an individual poster/site,
and exposing the poster/site to plain view on the grounds that many ISPs
(especially the ones patronized by spammers/abusers/trolls/other-bad-guys)
are reluctant to take action or to assist in tracing such malpractices.
But, as I said, USEAGE is the place to discuss that tension and the pros
and cons of both views. The standard should merely provide various tools
that can be used for these purposes.

>user-supplied headers.  Period.

USEPRO says (and has always said) that injecting agents MUST NOT modify
headers that were placed there by the poster. But that is not the issue
under discussion.