> On 3 May 2021, at 07:27, Hans-Martin Mosner <h...@heeg.de> wrote: > > Am 02.05.21 um 22:30 schrieb John Levine: >> It appears that Matthäus Wander <mail@wander.science> said: >>> envelope_to allows you to automatically correlate these reports and >>> reconstruct the forwarding path. This helps to identify the culprit who >>> is breaking DKIM signatures, especially with longer forwarding chains. >>> Without envelope_to, reconstructing the mail flow requires guessing and >>> manual work. >> It is none of your business to whom I forward my mail. > > True, unless you (generic you, not John L.) make it my business by > complaining about not receiving my mail either in a > support request (which may cause quite some work) or in a public forum (which > might damage my reputation and even cause > more work).
I will point out that for a lot of us online (specifically those of us who don’t check any or all of the the cis-het-white-male categories) forwarding mail and protecting our identities are crucial to our ability to actually participate in an online life. Stalking and harassment are real. I, personally, have been being low-level stalked by someone for over a decade now. I have been put into positions where I have to make calculated decisions about my ability to participate in places based on my personal safety. I have involved the police in the past for specific threats against me. The first time I was threatened and stalked online was more than 20 years ago. This is not some ‘oh, it only happens to some people’, it happens to a lot of people, regularly. The threats I’ve had to deal with, just for being a woman in an online environment, are minor compared to some threats other women, BIPOC and members of other marginalized groups have had to put up with. I’ve never had to move out of my house for my safety. ISPs HAVE doxxed individuals in the past, both accidentally and through deliberate policy decisions. Adding personally identifiable information into DMARC reports is problematic in a way I don’t think many men here realize. It is not anyone’s business how I might route mail to protect my safety. And, frankly, the issues of data privacy and safety for people online significantly trump the concern that someone’s reputation might be slightly impacted because they can’t troubleshoot an individual mail failure. > I am too often in a position of being requested to solve a problem but the > requestors don't even provide the minimal > logging info or even error texts to even start analyzing their problem. In > such cases I want to be able to look at as > much info as possible so as to provide a decent service. > > I don't snoop on mail logging info to satisfy my curiosity or to increase my > revenue, but to solve my user's problems. This is irrelevant. How, in fact, do you protect your users safety and privacy? How do you ensure that the request is actually coming from your user and not from someone attempting to discover where they are and defeat personal safety measures your user has put in place to protect themselves from harassment and stalking? Maybe they don’t provide the minimum logging info or texts because they’re attempting to social engineer you into revealing someone’s information and identity that forms a chain that leads to their safety being compromised. > Whether envelope_to would help my work isn't clear, but apparently it would > help Matthäus in his work. But is that work necessary and relevant? Does that process protect people? Does it faciliate online threats, harassment and stalking? Will someone who is trying to hide their location due to a credible threat be harmed by this protocol decision? laura -- Having an Email Crisis? We can help! 800 823-9674 Laura Atkins Word to the Wise la...@wordtothewise.com (650) 437-0741 Email Delivery Blog: https://wordtothewise.com/blog
_______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
