Subject: [dmarc-ietf] Issue #22 - perverse incentives to use p!=none & pct=0

From: "Kurt Andersen (b)" <[email-masked]>
Date: Fri, 6 Apr 2018 09:48:10 -0700

*I filed issue 22 after observing a discussion today on another list:*

Pursuant to an email thread on the mailop list, we may want to consider how
(or if) to do something about the ways that people have developed different
processing handling for p=none vs. p!=none. Here's the example:

Does anyone know of any negative side effects of setting a DMARC policy:
p=quarantine pct=0 ?

Is it equivalent to: p=none ?

I'm curious because I want to trigger Google Groups (and maybe others list
forwarders?) to rewrite the From in a DMARC compliant fashion *prior* to
changing the domain's DMARC policy... to avoid the "leap of faith" that
p=none's monitoring mode was supposed to alleviate.

(https://trac.ietf.org/trac/dmarc/ticket/22#ticket)

---

From: Brandon Long <[email-masked]>
Date: Tue, 10 Apr 2018 19:47:06 +0000

Trying a reply from my dmarc protected address...

What are you proposing we do?  Specify what handling should be done more
specifically in that case?

Brandon

On Fri, Apr 6, 2018 at 9:48 AM Kurt Andersen (b) <[email-masked]> wrote:

> Pursuant to an email thread on the mailop list, we may want to consider
> how (or if) to do something about the ways that people have developed
> different processing handling for p=none vs. p!=none. Here's the example:
>
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Tue, 10 Apr 2018 12:54:04 -0700

On Tue, Apr 10, 2018 at 12:47 PM, Brandon Long <[email-masked]> wrote:

>> I'm curious because I want to trigger Google Groups (and maybe others
>> list forwarders?) to rewrite the From in a DMARC compliant fashion *prior*
>> to changing the domain's DMARC policy... to avoid the "leap of faith" that
[looks like your email worked]

> specifically in that case?

It may not be palatable, but I would consider some sort of recommendation
along the lines of "SHOULD NOT" in the to-be-revised standards-track spec
for DMARC to discourage special case processing of p=none.

--Kurt

---

From: Brandon Long <[email-masked]>
Date: Tue, 10 Apr 2018 23:48:48 +0000

> for DMARC to discourage special case processing of p=none.

Well, obviously there is some difference in handling of p=quarantine and
p=none ;)

I guess the question is, in terms of forwarders, should they handle those
differently or not.  I'm not sure how many are p=none vs p=quarantine vs no
dmarc (I could look at our mail flow for some numbers, but some others on
the list may have better numbers), but if a lot are at p=none, things will
be yucky if it changes.  Ie, right now, gmail.com/hotmail.com/outlook.com
are all p=none, so changing Groups or mailman for p=none will affect a lot
of folks.

Brandon

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 10 Apr 2018 22:35:54 -0400

On Tuesday, April 10, 2018 11:48:48 PM Brandon Long wrote:
> >> On Fri, Apr 6, 2018 at 9:48 AM Kurt Andersen (b) <[email-masked]>
> >> 
> >> wrote:

I'd have to rethink if p=none was really worth publishing if that happened.  I 
guess we'd need p=none-really then.

Scott K

---

From: Brandon Long <[email-masked]>
Date: Fri, 13 Apr 2018 17:27:42 +0000

> guess we'd need p=none-really then.

p=none pct=0

Brandon

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 16 Apr 2018 20:01:34 +0200

> guess we'd need p=none-really then.

Given that From: rewriting is the de-facto standard, this WG should publish an
RFC about that, including recommendations and caveats about how to do it.

Its Security Considerations, for example, should mention cases like, say:

    From: The POTUS via phishing-attempt <[email-masked]>
    X-Original-From: The POTUS <[email-masked]>

For a personal opinion, I don't know what is the purpose of having GG rewrite
From:'s of a given domain.  Perhaps, it is to let users participate to groups
without revealing their real addresses to spammers.  That sounds legitimate to
me...

Ale
--

---

From: Brandon Long <[email-masked]>
Date: Mon, 16 Apr 2018 23:23:17 +0000

> without revealing their real addresses to spammers.  That sounds

Do you mean, that user's don't understand why some are rewritten and some
aren't?

That's definitely true, and an interesting question as to whether Groups
should always rewrite.

Brandon

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 17 Apr 2018 13:11:05 +0200

On Tue 17/Apr/2018 01:23:17 +0200 Brandon Long wrote: 
>>>> I guess the question is, in terms of forwarders, should they handle
>>>> those differently or not.  I'm not sure how many are p=none vs
>>>> p=quarantine vs no dmarc (I could look at our mail flow for some
>>>> numbers, but some others on the list may have better numbers), but if
>>>> a lot are at p=none, things will be yucky if it changes.  Ie, right
>>>> now, gmail.com/hotmail.com/outlook.com are all p=none, so changing
>>>> Groups or mailman for p=none will affect a lot of folks.>>>
>> Given that From: rewriting is the de-facto standard, this WG should 
>> publish an RFC about that, including recommendations and caveats about how
>> to do it.>>
>> For a personal opinion, I don't know what is the purpose of having GG 
>> rewrite From:'s of a given domain.  Perhaps, it is to let users
>> participate to groups without revealing their real addresses to spammers.
>> That sounds legitimate to me...>

Some may understand.  I recall when it was rather common to see addresses like,
say, [email-masked], supposedly obvious to human subscribers.  As email
authentication took on, tools tended to disallow such kind of free editing of
From: (a trend that possibly impacted negatively on posters' ability to
understand email mechanisms.)  Now, servers should supply something else to
provide a similar grade of privacy to mailing list subscribers.  The address
blong=[email-masked] (to which I'm writing) results in a similar
soft concealing as the former example.  However, the X-Original-From betrays
such purpose.

> That's definitely true, and an interesting question as to whether Groups

Yes, and I bet there are various other interesting questions as well.  rfc7960
quickly covers the whole topic in the first bullet of Section 4.1.3.3.  And, as
an informative rfc, it makes no recommendations.  This WG can do better than that.

Ale
--

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 17 Apr 2018 13:11:05 +0200

Ale
--

---

From: Brandon Long <[email-masked]>
Date: Tue, 17 Apr 2018 23:46:26 +0000

> soft concealing as the former example.  However, the X-Original-From

Frankly, the number of people who did that was vanishingly small, and the
general utility
of such things was also pretty tiny.  The major mailing list providers did
a better job of just
not publishing the email address unhidden in the archives.

Brandon

---

From: Brandon Long <[email-masked]>
Date: Tue, 17 Apr 2018 23:46:26 +0000

Brandon

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 18 Apr 2018 11:37:57 +0200

On Wed 18/Apr/2018 01:46:26 +0200 Brandon Long wrote:
>>>>>> Well, obviously there is some difference in handling of
>>>>>> p=quarantine and p=none ;)>>>>>>
>>>>>> I guess the question is, in terms of forwarders, should they
>>>>>> handle those differently or not.  I'm not sure how many are p=none
>>>>>> vs p=quarantine vs no dmarc (I could look at our mail flow for 
>>>>>> some numbers, but some others on the list may have better 
>>>>>> numbers), but if a lot are at p=none, things will be yucky if it
>>>>>> changes.  Ie, right now, gmail.com/hotmail.com/outlook.com are all
>>>>>> p=none, so changing Groups or mailman for p=none will affect a lot 
>>>>>> of folks.>>>>>
>>>>> I'd have to rethink if p=none was really worth publishing if that happened. 
>>>>> I guess we'd need p=none-really then.
>>>>
>>>> to do it.
>>>> That sounds legitimate to me...
>>>
>> Some may understand.  I recall when it was rather common to see addresses 
>> like, say, [email-masked], supposedly obvious to human 
>> subscribers.  As email authentication took on, tools tended to disallow
>> such kind of free editing of From: (a trend that possibly impacted 
>> negatively on posters' ability to understand email mechanisms.)  Now,
>> servers should supply something else to provide a similar grade of privacy
>> to mailing list subscribers.  The address 
>> blong=[email-masked] (to which I'm writing) results in a 
>> similar soft concealing as the former example.  However, the 
>> X-Original-From betrays such purpose.>
> general utility of such things was also pretty tiny.  The major mailing list
> providers did a better job of just not publishing the email address unhidden 
> in the archives.
You mean spammers would rather harvest from web archives than subscribe to
mailing lists directly?  Many lists restrict archive access, or have no archive
at all.

I slightly disagree about the general utility of those tricks.  The more
spammers have to code around idioms such as "@NOSPAM" or "user at domain dot",
the slipperier their harvesting.  Anyway, what's the practical merit of
X-Original-From or added Reply-To?  Don't posters enjoy better privacy when
From:-rewriter omit them?

However old-fashioned, the @NOSPAM idiom had an advantage over =40...@, namely
that it just bounced rather than creating duplicates[*].  Grr... fixing To: now.

Ale
-- 

[*] Hm... that  might be a bug somewhere in dmarc-reverse handling.  The copy
collects four signatures by d=ietf.org instead of two as usual.