Re: Mailing lists - assumptions

>> I'm not seeing where it addresses bad actors posing as mailing lists.
>
>Are you worried about me sending to a bad actor and that bad actor 
>re-sending my message plus or minus some modifications to my message? 
>That's what I was trying to capture with 4:

The bad actor sends a fake message with a fake return address that
pretends to be you, with a fake token and fake everything else.

The problem is that there are entirely legitimate mail scenarios that
are technically indistinguishable from this, e.g., gmail account
consolidation and WSJ mail an article.  (Well, they wouldn't add a
fake token, but you get the idea.)

The only way I know to tell evil fakes from good ones is to
whitelist the good ones, and since they're technically the
same, you can't run the whitelist mechanically.

R's,
John

_______________________________________________
ietf-822 mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ietf-822