Re: [Fwd: [Asrg] Re: Documents for LMAP BOF]

On Sun, Feb 08, 2004 at 05:45:19PM -0500, Yakov Shafranovich wrote:
> >Hadmut Danisch wrote:
> >>
> >>Let me be the devil himself:
> >
> >
> >If so, then HELO checking with DRIP is sufficient :)

Of course, this is wrong. But I didn't want to argue, 
I want to trigger your own thoughts and convince you.

The HELO approach does not protect against open relays,
viruses, worms with faked sender addresses. You know whom 
to play, and he'll say "Sorry, caught a worm". What's the point in
this? 



> Come to think of it, why do we care about tying domains to the IP? If it 
> is solely for the contact information, than rDNS data should be 
> sufficient. If it is in order to get around the problem of bad rDNS 
> management, than falsified WHOIS data is not much better.

Good question.


 
> Which brings us back to your original point - why do we want to 
> authenticate identity? Identity of the incoming MTA or the sender by 
> itself will be meaningeless unless combined with some form of a 
> reputation system.

And that's where those problems begin SPF etc. don't solve.

In Germany, I am required to have an identity card, to provide
an impressum on my web site and so on. 

What kind of reputation is there in the USA except for your
driving license and Social security number? People use to 
change their name arbitrarily and can lease domains anonymously 
just by sending cash in a fedex envelope. I just learned that you 
can even perform a conference at the MIT without leaving a track 
of who is responsible.

That is the main problem.


> Additionally, there is a limited number of IP 
> addresses as opposed to domains and senders. If we seek to create 
> reputation system, then it would make more sense to have it IP based 
> since it will be less data.

No. There are too many shared and dynamic IP addresses. And what about
IPv6?

But you could have registries where you register as a well known
person and will be covered bei an LMAP entry with your IP address
until you logout. 

See my scaf draft where I describe exactly such a scheme for providers
like Yahoo, Hotmail, AOL. Logging in into Hotmail etc. is a kind of
such a reputation system.




> As for stopping forgery, since this operates only on the SMTP Session 
> level, it does not stop forgery of the mail content itself. Rather it 
> autheticates the SMTP transaction which lets the network administrators 
> complain to the originator. BUT, if the incoming IP is know, we know who 
> the admin is anyway, so what's the point to tie it in with a domain.

Because a malicous admin (spammer's admins are malicous by definition)
could still send tons of mail with forged sender addresses. If you tie
it with a domain, the malicous admin is forced to use the own domain 
name as the sender address. Unfortunately, the spam is still spam.

But it is a good protection in case the admin is not malicious. It
stops those tons of worm and virus messages with forged sender
addresses. 

With the HELO approach anyone could still send messages with 
sender domain @danisch.de. You will know whom to blame for doing 
so, but this doesn't make you feel better. Blaming is slow and expensive.

With the sender approach only one machine could send messages from 
@danisch.de. That's much better. 


Hadmut