RE: CBV

> From: Stuart D. Gathman
> Sent: Friday, May 07, 2004 12:09 PM
>
>
> On Fri, 7 May 2004 [email protected] wrote:
>
> > The key problems with SES seem to be EITHER:
> >
> > a) If a spammer gets hold of an SES source address, he has a
> > free ticket
> > to spam people using replay
>
> In conjuction with SPF, an SES or SRS source address only allows
> the spammer
> to spam 1 particular recipient for a limited time via a forged
> bounce.  An SES
> source is not a general relay ticket.  It is true that without SPF,
> general spam victims that only check CBV will for a limited
> time be tricked into thinking the sender is genuine.

That's the vulnerability that we attempted to address by incorporating a
body hash in the MAIL FROM:.  The recipient can detect that the message
content does not belong with that MAIL FROM: and can reject the message,
albeit at the end of DATA.


> But this is no worse than
> the current situation of completely unauthenticated senders.  The obvious
> solution is to publish SPF records *and* do SES (and SRS where needed).

This would give the best overall protection.  The final recipient can do a
CBV to validate that the message did originate from the domain.  If
implemented optimally, a side benefit is validating the local part in MAIL
FROM:, as well.  The only down side is the extra complexity of address
rewriting and limiting where legitimate domain mail can come from.

--

Seth Goodman