Re: CBV

On Thu, Apr 29, 2004 at 02:57:14PM -0500, Seth Goodman wrote:
| > Meng was thinking about SES/CBV during his shower this morning and
| > wondered if we'd addresses the problem of replay attacks yet.  If a
| > spammer gets his hands on a good SES return-path, can't he send out a
| > spam with return-path?  CBV would pass.
| 
| We probably have not fully addressed that, so let's try.  Yes, a replay
| attack would definitely work.  SRS rewritten addresses are similarly
| vulnerable to replay attacks, as far as I can tell.  Both SES and SRS
| addresses are protected by the same timestamp field, so the usefulness of a
| harvested address would be time limited in both cases.

I should be clear --- when I say "replay attack" I mean a spammer gets
his hands on an SRS/SES address and sends mail *using it* as the return
path.  That attack works for SES, doesn't work so well for SRS/SPF.

An SRS address would (presumably) have SPF protection so a replay attack
wouldn't work.  If SES addresses refuse SPF protection (and if they
decline SRS, they refuse SPF protection) then replay attacks do work.

The vulnerability Shevek responded to was where the spammer uses an SRS
address as the *recipient address* to send spam to the original sender.
In this situation, under both SES and SRS the original sender gets the
spam, but this case is of limited interest outside the 5-player SRS1
game which Shevek has already solved by adding the "never shortcut"
subclass.