Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Kurt Andersen
So I was able to retrace our design steps which led to the 3-piece model (AAR + AMS + AS) and the reasoning for the AS, signing just the ARC header sequence was to provide the verifiable chain of custody trace (though, of course, only from participating intermediaries). Some of the recent tweaks to

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Brandon Long
On Thu, Aug 17, 2017 at 2:46 PM, Bron Gondwana wrote: > On Fri, 18 Aug 2017, at 05:11, Brandon Long wrote: > > dammit, posted from the wrong address again... > > > You'll be dealing with this until the bulk of mailing lists AND receivers > have become ARC aware, so you've got a while to get used

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Bron Gondwana
On Fri, 18 Aug 2017, at 04:48, Seth Blank wrote: > On Thu, Aug 17, 2017 at 1:09 AM, Bron Gondwana > wrote:>> I laugh as well, but it's more than > p=reject isn't enough in the ARC >> world, because it doesn't distinguish between:>> a) I'm OK with email from >> my domain being sent via mailing

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Bron Gondwana
On Fri, 18 Aug 2017, at 05:11, Brandon Long wrote: > dammit, posted from the wrong address again... You'll be dealing with this until the bulk of mailing lists AND receivers have become ARC aware, so you've got a while to get used to changing which address you post from :p > On Wed, Aug 16, 2017 a

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Murray S. Kucherawy
On Thu, Aug 17, 2017 at 11:48 AM, Seth Blank wrote: > On Thu, Aug 17, 2017 at 1:09 AM, Bron Gondwana > wrote: >> >> I laugh as well, but it's more than p=reject isn't enough in the ARC >> world, because it doesn't distinguish between: >> a) I'm OK with email from my domain being sent via mailing

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Brandon Long
dammit, posted from the wrong address again... On Wed, Aug 16, 2017 at 5:47 PM, Bron Gondwana wrote: > On Thu, 17 Aug 2017, at 10:34, Seth Blank wrote: > > On Wed, Aug 16, 2017 at 5:21 PM, Bron Gondwana > wrote: > > The only way you could even hope (as a mailing list) to avoid rewriting > the s

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Murray S. Kucherawy
On Thu, Aug 17, 2017 at 1:09 AM, Bron Gondwana wrote: > On Thu, 17 Aug 2017, at 15:28, Murray S. Kucherawy wrote: > > On Wed, Aug 16, 2017 at 5:47 PM, Bron Gondwana > wrote: > > While there exists A SINGLE SITE which is ARC-unaware and DMARC p=reject > aware, you can't use ARC on a DMARC p=rejec

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Seth Blank
On Thu, Aug 17, 2017 at 1:09 AM, Bron Gondwana wrote: > > I laugh as well, but it's more than p=reject isn't enough in the ARC > world, because it doesn't distinguish between: > a) I'm OK with email from my domain being sent via mailing lists; and > b) no, this domain is only ever used for direct

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Brandon Long
On Wed, Aug 16, 2017 at 5:47 PM, Bron Gondwana wrote: > On Thu, 17 Aug 2017, at 10:34, Seth Blank wrote: > > On Wed, Aug 16, 2017 at 5:21 PM, Bron Gondwana > wrote: > > The only way you could even hope (as a mailing list) to avoid rewriting > the sender is for every site that currently has DMARC

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread mham...@americangreetings.com
On 8/17/2017 4:09 AM, Bron Gondwana wrote: On Thu, 17 Aug 2017, at 15:28, Murray S. Kucherawy wrote: On Wed, Aug 16, 2017 at 5:47 PM, Bron Gondwana mailto:br...@fastmailteam.com>> wrote: While there exists A SINGLE SITE which is ARC-unaware and DMARC p=reject aware, you can't use ARC o

Re: [dmarc-ietf] ARC-Seal is meaningless security theatre

2017-08-17 Thread Bron Gondwana
On Thu, 17 Aug 2017, at 15:28, Murray S. Kucherawy wrote: > On Wed, Aug 16, 2017 at 5:47 PM, Bron Gondwana > wrote:>> While there exists A SINGLE SITE which is > ARC-unaware and DMARC >> p=reject aware, you can't use ARC on a DMARC p=reject domain without >> rewriting the sender. Otherwise that