RE: CBV

> From: Mark
> Sent: Friday, April 30, 2004 7:22 AM
>
>
> Mark Shewmaker wrote:

<...>

> In that case, such a checksum could simply be added to the
> headers (like any
> other signing scheme); no need to cramp it into an envelope_from address.
> Anything you stick in an envelope_from, like used for SES, is only to
> "validate" the recipient in the SMTP dialogue. If you suck in an entire
> message, to calculate a checksum over it, then this checksum should really
> just be part of that same DATA (in the headers).
>
> No?

Yes, it certainly could be included in the headers and others have proposed
this, as well.  There is one advantage of including it in the MAIL FROM:,
however, and that is to foil spoofing based on the type of replay attacks
that Meng proposed.  Harvesting an SES address does you little good if it
contains a hash of the message body and some headers, which your spam won't
match.  It's not ideal, in that the MAIL FROM: would be accepted, but the
body check based on the hash embedded in MAIL FROM: would fail and you would
wind up rejecting the message at the end of DATA (ugh).  Spammers could
certainly send this stuff out, but since they know in advance that it will
fail any checks, they have little incentive to go that route.  It's very
similar to sending spoofed mail pretending to be from a domain that
publishes an SPF record.  There's nothing stopping you from doing it, but
the likelihood of successful delivery is low.  I think spam takes the path
of least resistance, kind of like a familiar substance that flows downhill,
and this does not sound like not that path.

--

Seth Goodman