Re: [Imap-protocol] DKIM signatures on this list

On Fri, 13 Mar 2015, John Levine wrote:

>>> The point of a signature is to have a way of verification of the 
>>> message as sent and received. If "you" received a message from your 
>>> boss saying "I approve that you spend ten thousand dollars in the 
>>> company party" and the signature of such message would not validate, 
>>> that would certainly not be a situation where "you" would say "the 
>>> correct thing to do is to ignore it."
>
> RFC 6376 is quite clear about what you do with an invalid DKIM signature 
> -- you ignore it, as though the signature wasn't there at all.  We 
> deliberately wrote it that way.

The question is who is "you" in the sentence above. If you mean to say 
that "you" is the client implementor, well, there is no much that can be 
done to recover from such error. It is hard to try to recover, so 
"ignoring it" is sensible.

However, the comment that originated this conversation was not a comment 
about the implementation of a RFC, it was about a user point of view, so 
while the comment you made may be sensible to implementors, I do not see 
it as such for users, and that is the context of what I saw.I 
read originally was not meant to say (in my opinion) that the list was

> It's fine to treat mail with valid signatures differently from mail 
> without valid signatures, but it's not fine to treat mail with an 
> invalid signature differently from mail with no signature.  That's why 
> you shouldn't depend on lists to strip the signatures they break.
>
> I would have hoped that people interested enough in mail software to be 
> on this list would go to the effort to read and understand the specs 
> they implement.

In generic terms I understand you. But the RFC is just that, and it is for 
implementors, not for users. I do not think that you can tell me, as a 
user, that it is "fine" when a signature does not validate, because I care 
to receive what was sent and I do not have any algorithmic way to know 
what the original message was. I know there is no much that can be done to 
fix it as an implementor, so in that sense, I should ignore the failure, 
but that is not what makes a user feels warm and fuzzy about the message 
they just received and fails to validate.

-- 
Eduardo
_______________________________________________
Imap-protocol mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-protocol