Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

2020-07-31 Thread Dave Crocker
On 7/23/2020 6:07 AM, Joseph Brennan wrote: I'd be happier for the proposed standard to say that DMARC policy "SHOULD NOT" be compromised by rewriting From lines-- and see how that goes over. Consider coming along, in the middle of a 45-year practice and suddenly declaring the an independent

Re: [dmarc-ietf] Response to a claim in draft-crocker-dmarc-author-00 security considerations

2020-07-31 Thread Jesse Thompson
On 7/23/20 8:07 AM, Joseph Brennan wrote: >> I think that we just have to agree that From-munging by MLMs is a permanent >> reality. It needs to be documented more prominently (and promoted as part >> of the DMARC marketing) so that implementations are more consistent, so that >> un-munging tac

Re: [dmarc-ietf] non-mailing list use case for differing header domains

2020-07-31 Thread John R Levine
On Fri, 31 Jul 2020, Jesse Thompson wrote: I think they want their IT staff to deploy an email system and policies that work the way they would expect. They want their organization to be seen as secure, so they don't want to be on the Buzzfeed list of Fortune 500 companies that have neglected

Re: [dmarc-ietf] non-mailing list use case for differing header domains

2020-07-31 Thread Jesse Thompson
On 7/31/20 2:30 PM, John Levine wrote: > In article you write: >> I think you're right, and isn't the market indicating that there is demand >> for DMARC designed for other usage patterns? e.g. >> Would the CEO of any of those fortune 500 companies like the idea of their >> personal address bei

Re: [dmarc-ietf] non-mailing list use case for differing header domains

2020-07-31 Thread John Levine
In article you write: >I think you're right, and isn't the market indicating that there is demand for >DMARC designed for other usage patterns? e.g. >Would the CEO of any of those fortune 500 companies like the idea of their >personal address being spoofed? I dunno. Would they like the idea of

Re: [dmarc-ietf] non-mailing list use case for differing header domains

2020-07-31 Thread Jesse Thompson
On 7/30/20 5:52 PM, Jim Fenton wrote: > There's an underlying assumption here that I don't agree with: that > DMARC adoption equates to the publication of a p=reject DMARC policy, > and that everyone (or at least all Fortune 500 companies) should be > doing that. p=reject should only be used when t

[dmarc-ietf] LSAP - Lightweight Signer Authorization Protocol methodology

2020-07-31 Thread Hector Santos
On 7/31/2020 4:06 AM, Alessandro Vesely wrote: hector wrote: base32(sha1(SIGNER-DOMAIN))._atps.isdg.net Isn't that overly complicated? I don't think so, but sure, it is not 100% "Low Code." A hash "calculator" is needed. Why SHA1? The intent was for a lightweight hashing that won

Re: [dmarc-ietf] non-mailing list use case for differing header domains

2020-07-31 Thread Alessandro Vesely
On Wed 29/Jul/2020 19:34:48 +0200 Hector Santos wrote: On 7/28/2020 1:19 PM, Doug Foster wrote: Hector, I do not understand this comment: "The DKIM Policy Model since ADSP lacked the ability to authorize 3rd party domains. DMARC did not address the problem and reason ADSP was abandoned. Hence