×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Big Internet Players Propose DMARC Anti-Phishing Protocol

timothy posted more than 2 years ago | from the gotta-have-a-license dept.

Facebook 92

judgecorp writes "Google, Microsoft, PayPal, Facebook and others have proposed DMARC, or Domain-based Message Authentication, Reporting and Conformance, an email authentication protocol to combat phishing attacks. Authentication has been proposed before; this group of big names might get it adopted." Adds reader Trailrunner7, "The specification is the product of a collaboration among the large email receivers such as AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America and others, all of whom have a vested interest in either knowing which emails are legitimate or being able to prove that their messages are authentic. The DMARC specification is meant to be a policy layer that works in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework)."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

92 comments

From: critical@paypal-warning.com (0, Offtopic)

Anonymous Coward | more than 2 years ago | (#38865935)

ATTN: This e-mail has got through yet another badly thought out anti-spam/phishing/whatever proposal. Please send your credit card details in response.

Sincerely,

A. Scammer

Obligatory (2, Informative)

Anonymous Coward | more than 2 years ago | (#38866049)

Had to be done. Someone else can fill it out, I don't have time.

Your post advocates a

( ) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Obligatory (2)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874165)

approach to fighting spam

GAME OVER ! The topic is *not* about SPAM, but about make sure it's impossible to forge a fake From (I should write "envelope-from", but you don't seem to be a technical person, so I wont confuse you too much...), when you don't own the domain. This, DKIM and DMARC (and I'd add: with DNSSEC) really can do it now. Please try to understand the topic before writing too much about it and exposing yourself. Maybe also, next time, you'll read the title of the slashdot headline? Because it clearly is about phishing, and *not* about SPAM (sorry to insist, but you've really missed the obvious...).

Re:From: critical@paypal-warning.com (0)

Anonymous Coward | more than 2 years ago | (#38867879)

I guess it's appropriate that a first post which is not only on-topic but perfectly summarises the most basic problem with this solution is modded down.

Phishers will simply send from other addresses as they always do. It's not as if there's any evidence that the majority of people base whether to click a link on whether the From: address is exactly right.

Re:From: critical@paypal-warning.com (4, Insightful)

hairyfeet (841228) | more than 2 years ago | (#38869767)

As someone who works 6 days a week fixing the things let me say why this won't work....users are fucking stupid. No seriously, dumb as post,thicker than Mississippi mud, make Forest Gump look like Stephen Hawking, spend a week at any shop and see if your gob isn't permanently smacked by the level of stupid we encounter.

Oh don't get me wrong, we do our best. most of us put on free AVs and try to educate the user but frankly the shit goes in one ear and out another, here let me give an example. One of the local insurance companies has an employee we call "Velma the disaster area' for how quickly she can hose a PC. Now the insurance company won't fire her because she has a mind like a steel trap for insurance, so when Joe the plumber walks in Velma can go "Hey Joe, how's Betty? you're youngest Cindy is about to be driving age and you know i can get you a discount if she gets good grades, does she have time to take a safety course? because i can get you a lower rate if she takes one" and so on. Needless to say the gal brings in business so they STFU and just make us poor fixit guys deal with Velma.

Here is my last exchange with Velma, swear to god its true: Me/Do NOT open that password protected email, its a virus! Velma "Oh you worry too much, its from my BFF Kim, see? that's her name right there, she wouldn't do anything bad she's my BFF!" /Me/ I KNOW Kim and she does NOT have the skills to password protect anything, hell she'd never even find the button! Do NOT open that! Velma "Oh Kim is not that bad on computers and she could have got her husband Bill to do it, and it says its kitten pics see? She know I like kittens!" /Velma promptly opens the zip, clicks on the .exe, and hoses the machine/ Velma "Ooops" /Me .......... [wordpress.com] .

So you see friends the malware guys will just do as they are doing now and hit the weakest link which is ALWAYS PEBKAC. I haven't see a Windows driveby since Vista came out, simply because malware writers are lazy and can just get the idiot behind the desktop to do the work for them instead of having to do all that coding work. So it doesn't matter if they make email dummy proof, the malware guys simply will switch to loading a keylogger in a match 3 game or kitty screensaver and that's all she wrote.. the only way to kill malware would also kill FOSS deader than Dixie because you'd have to switch all the users to locked down iShiny or Wintabs where they have ZERO rights to do anything but what the corps tell them to, and to turn the net into an oversized home shopping network. Personally i like having control over my machines too much to let the march of the morons destroy my ability to put what I want on them, so they can try all they want but i can tell them it just won't work. No matter how smart your solution is the monkey with the wrench will fuck that shit up big time.

Re:From: critical@paypal-warning.com (0)

Anonymous Coward | more than 2 years ago | (#38875441)

It makes me wonder why you don't whitelist binaries and lock that shit down on par with what Microsoft SteadyState did for WinXP.

Re:From: critical@paypal-warning.com (0)

Anonymous Coward | more than 2 years ago | (#38876363)

You've obviously never worked in SMB IT. Users will NOT tolerate a "locked-down" PC, and they whine to the boss if you SteadyState/DeepFreeze something. I have hopes for VDI in SMB, with snapshotting and rollback.

Re:From: critical@paypal-warning.com (1)

zoloto (586738) | more than 2 years ago | (#38887227)

I have and it's the only way I run the network and systems my employer gave me responsibility over. Users have no right at the office to install software that's not approved for business reasons, nor visit websites that aren't in any way applicable to their position of responsibility. Those sites are whitelisted in a similar manner to what programs are allowed to run. This has effectively shut down all the 'bandwidth hogs' and time wasting game sites not to mention all the shitty sites that love to give people malware. And management has praised the work I've done. So yes, the users absolutely *WILL* tolerate it or they can find another job. That's been tested and proven to be effective.

Re:From: critical@paypal-warning.com (1)

ewhac (5844) | more than 2 years ago | (#38881115)

Hmm... You could set her up with the moral equivalent of a "Live CD," i.e. the core OS files are read-only, with maybe a UnionFS-type of writeable store overlaid on top. All her data files would be on normal read-write partitions. Thus, if she infects her machine, all that's required is a reboot. Naturally, installing new software would require administrative intervention, but honestly, other than OS updates, how many times does she need to install something?

You could also put her machine in a DMZ on the company's network so her machine doesn't reach out and contaminate others.

...And I imagine you've probably already thought of most of this...

Schwab

Re:From: critical@paypal-warning.com (1)

sootman (158191) | more than 2 years ago | (#38882873)

> ... the only way to kill malware would also kill FOSS deader than
> Dixie because you'd have to switch all the users to locked down
> iShiny or Wintabs where they have ZERO rights to do anything
> but what the corps tell them to, and to turn the net into an oversized
> home shopping network. Personally i like having control over my
> machines...

It's not an either/or situation. Apple just had their biggest quarter ever, selling tens of millions of iDevices.... did your personal computers disappear? Did Sourceforge or Freshmeat close up when Apple's App Store opened? Has the Internet changed in any meaningful way since the introduction of these things? (OK, maybe "yes" to that last one, but the **AA are a bigger threat to the 'Net than Apple, Google, or Microsoft.)

Re:From: critical@paypal-warning.com (0)

Anonymous Coward | more than 2 years ago | (#38897337)

You can easily stop malware without killing FOSS - by using FOSS. Give Velma a linux PC without admin rights. FOSS, but she can't mess with it. No kitty screensaver or malware so disguised.

And the downside is? (1)

who_stole_my_kidneys (1956012) | more than 2 years ago | (#38865945)

no really what the down side to this? my paranoia is curious....

Re:And the downside is? (4, Funny)

del_diablo (1747634) | more than 2 years ago | (#38866053)

Re:And the downside is? (0)

Anonymous Coward | more than 2 years ago | (#38870081)

How many more times will Slashdot reference the xkcd comic #927 "Standards"?

How many? I mean really.

Panel 1: "Situation: There are 14 competing standards."
Panel 2: "14?! Ridiculous! We need to develop one universal standard that covers everyone's use cases. Yeah!"
Panel 3: "[Soon:] Situation: There are 15 competing standards."

...and every time, it gets modded up. OH HO HO HO! OMG SOOOO FUNNEEEEEE!!!!1one

Re:And the downside is? (0, Redundant)

Sloppy (14984) | more than 2 years ago | (#38866075)

The downside is that they're tying it to DNS, which is totally wrong. user1@example.com and user2@example.com are different identities. example.com can't, and shouldn't, be able to attest that something was said by user1.

At most, example.com ought to be able to attest that an email came through their server. That's something, I'll admit, but decades behind the state of the art.

Re:And the downside is? (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874205)

Except that DKIM isn't there to authenticate HUMANS but SERVERS. So the protocol does what it should, and solves it well (well... if you use DNSSEC, that is...). If you want to authenticate users, then use PGP.

Re:And the downside is? (1)

gmuslera (3436) | more than 2 years ago | (#38866161)

Sending from not DKIM/SPF authenticated servers will be somewhat deprecated. Some uses (like mail forwarding) will become a bit more complex, and so the requirements for putting a "working" (by their definition) mail server on internet.

Is not a "think on the children" (at least, not yet), but a "think on all those scammed people around". Some honest mails will become rejected, and some scamming will remain anyway.

With all the multinational unilateral laws coming from US like NDAA, catching scammers/spammers was never a priority. Maybe i won't agree that is good to extradite someone because breaking copyright laws, but some spammers/scammers really deserve to be sent to Guantanamo, waterboarding included.

Re:And the downside is? (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874219)

Sending from not DKIM/SPF authenticated servers will be somewhat deprecated.

Wake up. IT IS already deprecated. Try for example to send a mail to Yahoo without using DKIM... It's been years it's like that by the way, and there for, it's been years I maintain the dkimproxy package in Debian for that reason...

Re:And the downside is? (0)

Anonymous Coward | more than 2 years ago | (#38866523)

no really what the down side to this? my paranoia is curious....

A marked decrease in smug, self-important "clever" people posting that same goddamned form letter checklist of reasons why these things won't work. That's quite dangerous, as the internet runs entirely on short-sighted, smug arrogance*, and any decrease in those levels could mean that those same people will try to do something constructive with their lives for once and wind up killing themselves with a newspaper because they forgot how paper works.

*: Porn and cat pictures are merely subclasses of smug arrogance.

Re:And the downside is? (0, Redundant)

Anonymous Coward | more than 2 years ago | (#38866643)

Your post advocates a

( ) technical ( ) legislative ( ) market-based (x) vigilante

approach to fighting this anti-spam checklist. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(x) It is defenseless against brute force attacks
(x) It will stop this checklist for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats like me
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
(x) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(x) Posting to slashdot should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(x) I don't want the government reading my post
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Why a new protocol? (2)

Hentes (2461350) | more than 2 years ago | (#38865953)

What's wrong with PGP?

Re:Why a new protocol? (0, Funny)

Anonymous Coward | more than 2 years ago | (#38866001)

It's too 'open' and therefore, easily crackable.

Re:Why a new protocol? (0)

Anonymous Coward | more than 2 years ago | (#38866109)

Can't tell if trolling or just stupid.

Re:Why a new protocol? (1)

Pieroxy (222434) | more than 2 years ago | (#38866457)

It's too 'open' and therefore, easily crackable.

Can't tell if trolling or just stupid.

That's true. If it's open, you don't need to crack it since you can take a peek inside and grab whatever the squirrel left over.

Re:Why a new protocol? (4, Insightful)

rabbit994 (686936) | more than 2 years ago | (#38866017)

Because average users have issues with it and they are people this proposal are trying to protect.

If any security is going to happen for average user, it must be forced upon them. Otherwise, "it's too hard"

Re:Why a new protocol? (-1)

causality (777677) | more than 2 years ago | (#38866327)

Because average users have issues with it and they are people this proposal are trying to protect.

If any security is going to happen for average user, it must be forced upon them. Otherwise, "it's too hard"

All of this just to ensure that a fool and his money are not parted. What a waste.

If you're going to get "big players" involved in anything, how about user education? It's pretty damned hard to fall for a phishing attack when you have a clue about how the protocols work and can look for red flags. Any other solution? It will be an arms race.

Re:Why a new protocol? (1)

Synerg1y (2169962) | more than 2 years ago | (#38866937)

Well for one most people (users) don't care and can't be made to???

This is one of those cases where technology is the superior alternative, everybody uses email, and it's :

1. fix the problem
2. train everybody to work around the problem

seems like a fairly simple choice to me.

On that note, this is a lame solution. Imho we need to implement pgp properly on a large scale basis or something like it. DNS has proven unreliable in authentication over the past few decades.

Re:Why a new protocol? (1)

causality (777677) | more than 2 years ago | (#38873349)

seems like a fairly simple choice to me.

You honestly believe that a) this will perfectly eliminate all forms of phishing and won't just create an arms race, and b) people who currently fall for these (usually blatantly obvious) phishing scams won't fall for some other trick that will become the new trend when phishing is perfectly eliminated?

You really must enjoy games of whack-a-mole.

Re:Why a new protocol? (1)

Synerg1y (2169962) | more than 2 years ago | (#38877709)

I'm talking about stuff like man in the middle + spyware / malware / virus type stuff. In regards to phishing scams, there's already a decent set of preventive measures like mxlogic and spam black lists. Don't always work, but we don't live in a perfect world, IT even less so. User training is ok at best, we've tried it, a year later we had enough new people where we had to do it again after a couple of incidents. You can't 100% stop it, but if you get 99% your above the curve.

Re:Why a new protocol? (0)

Anonymous Coward | more than 2 years ago | (#38867343)

Yeah, and maybe we should forget about police. Who cares if a fool and his life are parted.

Re:Why a new protocol? (1)

scarboni888 (1122993) | more than 2 years ago | (#38869563)

Yeah good thing the police are always right there preventing those murders that don't happen every single day.

Re:Why a new protocol? (1)

causality (777677) | more than 2 years ago | (#38873381)

Yeah good thing the police are always right there preventing those murders that don't happen every single day.

Yeah, and I'll add one thing: we all know that someone using force to murder another person is exactly, precisely, in every conceivable way, just like asking them to trust someone who is not trustworthy and wouldn't pass even the most cursory smell-test.

No, unlike murder, this crime requires the "victim's" active cooperation. Anyone who doesn't recognize that difference is simply not being honest. If GP has to be deceptive to argue against my position, it reinforces my position.

Re:Why a new protocol? (1)

rocket rancher (447670) | more than 2 years ago | (#38877591)

Yeah good thing the police are always right there preventing those murders that don't happen every single day.

Yeah, and I'll add one thing: we all know that someone using force to murder another person is exactly, precisely, in every conceivable way, just like asking them to trust someone who is not trustworthy and wouldn't pass even the most cursory smell-test. No, unlike murder, this crime requires the "victim's" active cooperation. Anyone who doesn't recognize that difference is simply not being honest. If GP has to be deceptive to argue against my position, it reinforces my position.

NO. most murder victims actively cooperate in their demise by compromising their personal safety in some way, usually as the result of ignorance, laziness, or simple bad judgement. Ditto victims of phishing, who out of ignorance, laziness, or simple bad judgment get hacked. The difference you note is one of degree, not kind.

Re:Why a new protocol? (1)

Synerg1y (2169962) | more than 2 years ago | (#38866903)

It also effectively breaks email if the other side doesn't have it installed, while great for internal communications, creates an administrative nightmare quickly and without fail. You need a real damn good reason to invest the IT cost in PGP, and some have it that use it. This one's not simple to force on the user, you have to understand domains, internet vs intranet, as well as the additional UI steps to begin. PGP is a poor implementation of something that should parallel ssl in it's usage, maybe the US government had something to do with that ;)

Re:Why a new protocol? (1)

Karzz1 (306015) | more than 2 years ago | (#38866917)

This appears to be transparent to the user. It is a layer that runs on top of SPF/DKIM which a user should not even be aware of.

Re:Why a new protocol? (0)

Anonymous Coward | more than 2 years ago | (#38866123)

Nothing, except that Google and other industry giants cannot control it enough. It's better to have a closed-source solution where all the keys and data are on some Google and Microsoft servers, you know.

Re:Why a new protocol? (3, Insightful)

mlts (1038732) | more than 2 years ago | (#38866343)

PGP/gpg is ideal because it sits atop of everything else. However, most people wouldn't be bothered to generate and store securely a private key, much less build a usable WoT and making sure not just just absent-mindedly sign everyone's key that passes by.

I use PGP but... (2)

betterunixthanunix (980855) | more than 2 years ago | (#38866389)

A certain amount of "user effort" is required to use PGP -- at the very least, the user must obtain the public key of the person they are corresponding with, and they must then verify that the key actually belongs to that person, etc. Experience has shown that users are not willing to put in that level of effort, especially when most users do not really understand what their effort is accomplishing.

Users' failure to understand what they are protecting themselves from when they use PGP is the biggest problem here. I routinely shock people, even people with technical backgrounds, by showing them how easily email headers can be spoofed. People generally think that if their email program says, "This is from your bank," it must mean that the email came from their bank. Why would someone who thinks that "From: ..." indicates who the message came from go through the effort of setting up PGP?

Re:I use PGP but... (1)

SuiteSisterMary (123932) | more than 2 years ago | (#38869303)

Oh gods, this was something I went over, and over, and over with people when I worked tech support for an ISP, so many moons ago. People just don't get why the 'from' address isn't authoritative. I usually had to explain it like forging the return address on a physical envelope, then have them open Outlook Express, go to their mail account properties, and ask them what would happen if they changed the 'name' and 'email address' fields to something other than their own.

We already have email authentication (5, Informative)

Sloppy (14984) | more than 2 years ago | (#38865987)

Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."

Everybody sign your emails, so that email from fuck-knows-who sticks out like a sore thumb. This would strike a great blow to phishing, and spam in general.

And best of all, people don't need new software for it. You don't need a new standard because there are already two competing standards (PGP vs S/MIME) -- why add a third? Just start using what you've already got.

Re:We already have email authentication (5, Insightful)

Nemilar (173603) | more than 2 years ago | (#38866091)

The problem with PGP/signed-emails is that you're putting the burden on the user. I'm a pretty technical guy, and I don't even want to bother with it. There's no way that the average person it going to take the time to understand and implement PGP.

The proposed solution puts the burden entirely on the system and the providers, so is more likely to be adopted and actually used (and therefore, successful in its end-purpose of stopping phishing attacks).

Re:We already have email authentication (5, Interesting)

Albanach (527650) | more than 2 years ago | (#38866331)

There are also issues with PGP and webmail used by probably the majority of home users, as well as the multitude of devices people now have for email.

You need to sync keys between devices securely, and with webmail you pretty much need to have a browser plugin take over the signing part, unless you want to entrust your private key to a third party.

Simply checking mail onan untrusted web terminal then becomes problematic - sure you can read signed but not encrypted email, but if you tell people it's okay to trust that sometimes, they won't bother checking at other times.

Re:We already have email authentication (1)

Ihmhi (1206036) | more than 2 years ago | (#38867335)

Is there no easy tool that exists that will essentially do this for you? Why isn't there an application that automatically handles all of the PGP stuff on your computer so you don't even have to think about it?

Re:We already have email authentication (1)

dave420 (699308) | more than 2 years ago | (#38867561)

s/computer/every single device you want to send to or receive from

Re:We already have email authentication (1)

pclminion (145572) | more than 2 years ago | (#38868679)

I access the web from all kinds of different devices. They ALL support SSL. Why can't they all support email encryption? Diversity is no excuse.

Re:We already have email authentication (1)

mlts (1038732) | more than 2 years ago | (#38866357)

S/MIME is a compromise in this department. Signed E-mails will show that they are signed properly in Outlook, Thunderbird, and a number of web based E-mail readers.

Of course, the ideal would be PGP/gpg validation of mails automatically because PGP wouldn't rely on CAs, as opposed to a WoT, but it would be better than nothing.

Re:We already have email authentication (4, Interesting)

doublebackslash (702979) | more than 2 years ago | (#38866587)

The problem with PGP/signed-emails is that you're putting the burden on the user.

Okay, I'll bite. (not TOO hard, mind)

So lets use PGP and still put the burden on the ISP / email provider / Facebook / anyone but the user

  1. Every email client in the world ships with PGP support
  2. Every email provider issues a key to their users. This can be done by the email client getting the key from the server when it authenticates (say a specially crafted email that it then hides from the user. No need to make it complex like extending the protocol! Just use existing technologies like "Magic emails") And emails of this format could be filtered trivially from being recieved (so no emailing someone a new private key!)
  3. Every email is signed and verified and those that aren't are flagged as "DANGER DANGER!" or ones signed but from somewhere not trusted, etc etc. PGP has a wonderful system of trust built in. It can be used in any way they want (google, MS, Yahoo, etc publish public keys and sign user keys with it, etc)

Lastly if someone savvy enough wants to use their own PGP key they can. Just get it signed by their email provider or some other such proof that they control that email address. PGP has this sort of thign already, very nice! https://keyserver.pgp.com/ [pgp.com]

Bonus points to PGP: since it already has the idea of a web of trust it can be used to GREAT effect. The email client could regognize that you seem to work with this person or email them a lot and ask, "Do you know this person in real life? Do you trust that this email is from them?" and sign keys that way. In this way one could have direct evidence that an email comes from someone that they can trust rather than just Google's big red rubber stamp. How novel!

We could really make this work with popular social media sites like facebook (I'm not a member, but lotsa people are) and show where this person is on your social graph (if they are at all)

So that is how we can use PGP, have it be as good AND BETTER than something new and not make the users do it. Sure there are more than a few flaws in the above but that is the basic outline.

Re:We already have email authentication (1)

Anonymous Coward | more than 2 years ago | (#38867153)

So, basically, you want an asymmetric algorithm for signing where your provider would store your private key.
Then, to authentify an email, your client would ask the announced server of your contact for the public key.
The server can be authentified by its certificate and the transaction would be secure over ssl.
This way, it would be transparente to the user because all the asymmetric complex part is done by your provider and you trust him thanks to its certificate.

But, wait a minute, remind me what is in the proposed protocol.
PGP is not the ultimate solution. PGP is just an implementation.
What we need is asymmetric cryptographie used as an authentification system.
And well, that's more or less what the draft does.

Re:We already have email authentication (1)

tokul (682258) | more than 2 years ago | (#38868911)

Every email provider issues a key to their users. This can be done by the email client getting the key from the server when it authenticates (say a specially crafted email that it then hides from the user. No need to make it complex like extending the protocol!

Existing protocols are about getting or sending emails. They have nothing about feeding custom settings to client. You also missed two major part of signing emails. User must know private key password and private key must be private as in "available only to key owner".

Providers can't switch on IPv6 until their asses are at stake and you expect them to make other trivial change in their infrastructure without any financial return value.

Get real.

Re:We already have email authentication (1)

melikamp (631205) | more than 2 years ago | (#38867327)

The problem with PGP/signed-emails is that you're putting the burden on the user.

How? All these clowns want is for the user to be able to recognize the bank. The bank recognizes the user by password, so as long as the user isn't giving out the password to phishers, the account is secure. The only "hard" part of using GPG with email is maintaining your own identity, but here it's not needed. They just have to make their clients display S/MIME and PGP/MIME and then distribute in a secure way a list of public keys of all their buddies.

But companies like Microsoft want a lot more pie than that. They get paid a lot more if they reinvent this wheel badly and then patent it. And make it impossible to authenticate with free software, even though there is no technical reason for that.

Re:We already have email authentication (1)

Magada (741361) | more than 2 years ago | (#38876889)

Key management is more of a bitch than it needs be, for sure.

Frankly, I'd rather rely on OpenID providers to authenticate sent e-mails somehow. Nonces, probably.

Oh, I claim prior art on this idea, by the way...

Re:We already have email authentication (1)

DarthBart (640519) | more than 2 years ago | (#38866365)

I used PGP to sign my emails. I stopped because too many people were pissing and whining about "all the extra crap" in my emails and they didn't know what it was for and dammit will you just stop it you're confusing my little brain. Granted, that was a couple of years ago so I don't know if mail clients have gotten smarter about presenting the messages without the PGP signing info (but you can damn well guarantee they know how to render HTML in the client).

Re:We already have email authentication (5, Interesting)

heypete (60671) | more than 2 years ago | (#38866489)

I'm an American studying in Switzerland. I bank with PostFinance, the post office-run financial institution.

Any electronic documents or messages from the bank are digitally signed: PDFs are signed and time-stamped using the built-in PDF signature methods. Emails, even the general informative newsletter containing no account-related information at all, are signed with S/MIME. Any account related communications take place using the internal messaging system on their secure website (which requires the user have access to their bank-issued smartcard and offline calculator-like challenge-response device). The instructions that came with the bank card and calculator device make it very clear how to verify that one is actually on the bank's website.

It's trivial to verify that documents and emails are actually issued by the bank, and the login method for the bank's website makes phishing much more difficult.

Compared to USAA, one of the more clueful US banks, this is excellent. Emails from USAA have the last four digits of the account number in the top-right of the message so as to "authenticate" that the message came from the bank. Of course, this is trivial to reproduce and offers no real validation. It's a shame, really.

If more banks (and indeed, more senders in general) signed their messages, that'd be a major improvement. If the big webmail providers (Gmail, Yahoo, and Hotmail) verified S/MIME signatures and displayed a suitable indicator to users, that'd be even better.

Re:We already have email authentication (2)

jader3rd (2222716) | more than 2 years ago | (#38866497)

While I realize this is more of an implementation issue than a conceptual issue, the reason why people aren't signing their emails is how clients make the signed emails stand out. I had a coworker who had digitally signed emails, and Outlook showed a little red ribbon next to the message. I'm sure the idea being that it was letting me know that the message was digitally signed. Did I know for %100 that the email was from this person? No. Perhaps someone had his credentials and was using his system in a malicious way. So having it signed didn't matter. Plus one day emails from him stopped being signed. Did I accept those emails just as readily and I did his signed ones? yes. Why? I didn't care. He had moved clients and hadn't setup signing emails yet. The emails sounded like the emails he sends, so there was no reason to not believe them. What should have happened was my client should have freaked out that someone who was sending signed emails had stopped sending signed emails (which I suspect is a red flag in the digital signature situation), but it didn't. I trusted that the emails where from my coworker without the signature just as much as I did with the signature. I think that a much more useful system would be one which detects discrepancy. One example would be the stopping of signed emails. Another would be receiving an email from a person, but the domain is different than the domain they usually get sent from. I did have that happen to me. Someone created an account under my name, with my handle, but on a different domain. Then this person sent a very hurtful email my fiancee. My fiancee was going to break up with me, but I was able to point out to them that I'd never sent them an email from that domain, and that it wasn't my account. I would have really liked it if the system had flagged that email saying "This email looks a lot like it came from someone you usually get emails from, except it's different". If that can be done correctly I imagine my fiancee would have looked at the email and thought "A potentially suspicous email, I will read it, but realize it might not be legit", and after having read it would realize that it wasn't from me. So a system that flags slight alterations would go a mile further in protecting people than digital signatures that people consider to be more of a bother than a benefit.

Re:We already have email authentication (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874045)

The question would more be: did you manually check the fingerprint he gave you on a paper, before sending you signed emails, when you thought that receiving signed emails was safer? If you didn't, then it was as good as if they were not signed.

Re:We already have email authentication (1)

jader3rd (2222716) | more than 2 years ago | (#38874307)

I didn't think that signed emails were safer. That was kind of the point of my comment. Due to the overwhelming percentage of unsigned emails I've received, who have been from the sender, I nearly always believe that an email actually came from the supposed sender. Someone can sign their emails one day, and not on another and it's hardly noticeable. A proper warning system would be one where the clients notice a slight aberration from the norm, not something which relies on humans to notice that signatures have changed.

Re:We already have email authentication (2)

betterunixthanunix (980855) | more than 2 years ago | (#38866507)

Even on cryptography mailing lists and newsgroups most people are not signing their messages. Getting people to put in the effort needed to set up PGP is just not going to happen; it needs to be the default, and it needs to be easier. I say this as someone who has been signing his emails for years, and who has tried for years to get other people to do the same.

Here is how the conversation usually goes, assuming that you get as far as convincing them that signing is something worth the time to do:

Cryptonerd: Hey, you should sign your mail, so that everyone will know it really came from you!
Other person: Oh, good point, someone might steal my password and send an email from my account. OK, what do I do?
Cryptonerd: It's easy, just install GnuPG, and now Thunderbird, and now Enigmail, and now set up your key -- make sure it is at least 2048 bits -- OK now enter a passphrase and now you can only read or send emails from this computer!
Other person: You mean I cannot just log in from some random other person's computer and read my mail? I'll pass thanks.

Thanks to the RSA patents and the efforts of the NSA and DOJ, cryptography just never became the default online. Users are not going to take the time to set up something as complicated as PGP, especially not when it means restricting themselves to particular computers that happen to have their keyring. Asking users to do something special is an uphill battle, and in the case of PGP it is like climbing Everest.

Re:We already have email authentication (0)

Anonymous Coward | more than 2 years ago | (#38866607)

I already sign my Slashdot posts, and nothing bad has every come of it!

-AC

Re:We already have email authentication (3, Interesting)

IamTheRealMike (537420) | more than 2 years ago | (#38866857)

Sign your emails. The tech has been out there for two decades. Decades, and that's real world time, not "internet time."

You're way behind the times. Go read up on email authentication and DKIM. You will find that a significant fraction of all email on the internet is being signed automatically - that is how DKIM works. The difference is, it's signed with the email providers keys instead of the users keys. But this is good enough to stop phishing because if an email claims to be from info@paypal.com or sloppy@gmail.com, the signature proves it came from PayPal or Gmail and you can then trust that they won't sign such mail unless it really did come from that address.

DMARC solves a problem that real world DKIM deployments have - merely signing your mail is not enough. You need to tell people what to do if signature checks fail. And you need a way to learn about failing signature checks, because large organizations often have incredibly complex mail streams, including mail they know nothing about because some random guerilla marketing team contracted a third party provider and told them to send as "campaign@foo.com", even though it's not being sent via foo.coms servers. This has made real deployments of DKIM quite tricky and ad-hoc affairs. DMARC will standardize this and make deployment feasible even for smaller organizations.

DKIM has other problems, like the number of mail relays that think it's OK to modify mail in transit whilst claiming it comes from the original sender, but those are all issues you get with retrofitting digital signatures onto an existing infrastructure./p

Re:We already have email authentication (2)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874099)

DMARC solves a problem that real world DKIM deployments have - merely signing your mail is not enough. You need to tell people what to do if signature checks fail.

Note only that. With DKIM, when you receive a mail, basically, its header are telling that the mail is signed, and that you can go ahead and check the DNS for the key. But if there's no such thing in the email, then no further check will be made. With DMARC, you will finally have a way to tell if a domain requires DKIM or SPF checks, which wasn't in the specs before.

some random guerilla marketing team contracted a third party provider and told them to send as "campaign@foo.com", even though it's not being sent via foo.coms servers

DMARC will force M. marketing to send his emails correctly, because now it's going to be really impossible to send emails without the foo.fr servers.

DKIM has other problems, like the number of mail relays that think it's OK to modify mail in transit whilst claiming it comes from the original sender

I haven't seen any relay explicitely deleting DKIM signatures. They even can add their own, and you'd receive a mail signed multiple times (which is fine in the DKIM specs). The issue with relaying (in fact, forwarding) is more with SPF, which is a stupid technology that DKIM supersedes.

Re:We already have email authentication (1)

Wowsers (1151731) | more than 2 years ago | (#38867939)

As an experiment (and desire to use it) I tried signing my emails, but I got a LOT of complaints from people using Microsoft Outlook etc. What MS email package did was just append the text code of the signature to the email, making it look very long, and full of nonsense text. Other packages understood what to do and just displayed the email as normal, with a padlock which you could click to read the signature.

I haven't used a signature since as too many use Microsoft Outlook... although maybe it has been fixed??

Re:We already have email authentication (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874115)

After 20 years of PGP existence, we still get this stupid answer that it's the fault of Microsoft? Come on! Move on, that excuse is not acceptable anymore. If you have stupid contacts that don't understand, either send then a link to wikipedia (I'm sure it explains well what PGP does and how to use it), or just ignore the complains, for the benefits of all the others who aren't using retarded software!

Re:We already have email authentication (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38874015)

This is totally irrelevant to the topic of DMARC. Here, we're talking about authenticating SERVERS, not HUMANS, to make sure that you aren't receiving spam from any random robot, part of any random botnet / hacked servers. Plus there's all sorts of reason why you don't want to receive only PGP signed emails, one of them is that you still want to receive emails from people you don't know, in which case they wont be authenticated (because you *DO* manually check the fingerprint of the PGP public key you download before you send emails, right?). There's no certificate authorities for PGP...

Re:We already have email authentication (0)

Anonymous Coward | more than 2 years ago | (#38874449)

I sign all my emails. I have a signature block right there in every single one. Funny how that does not seem to stop the phishing emails. Maybe there is something you left out of your explanation. After all, your name is "Sloppy". You should be more careful. As for "PGP vs S/MIME" -- speak English, man. How do you expect to communicate if you babble in acronyms and leave crucial bits of your explanation out?

Where is that fixed font check box post? (2)

140Mandak262Jamuna (970587) | more than 2 years ago | (#38866055)

Someone used to post a form with few boxes checked saying stuff like, "your idea will not work because: [x] blah [*] yadda yadda yadda", everytime there was an idea to combat spam/phish. Wonder what happened to him.

Re:Where is that fixed font check box post? (1)

mcgrew (92797) | more than 2 years ago | (#38867935)

LOL, you just beat him by one comment! Scroll down...

You're proposing (4, Funny)

guruevi (827432) | more than 2 years ago | (#38866277)

Your post advocates a

(x) technical ( ) legislative (x) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:You're proposing (0)

Anonymous Coward | more than 2 years ago | (#38870065)

So wrong in all levels. Besides that they're not proposing anti-spam fighting method, nearly all of your (x)es are placed wrong.

Re:You're proposing (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38875571)

Mod parent up, and the stupid ticks in the form down. All answers are indeed wrong, and we're talking about anti-phishing, not anti-spam...

Still have to fight layers of stupidity (4, Interesting)

sootman (158191) | more than 2 years ago | (#38866373)

Random fun fact: Yahoo uses something domain keys to authenticate their email. I can send myself a short message (like, just a URL) and it winds up in my spam folder.

Why can't free mail services PGP-sign everything? (2)

mistapotta (941143) | more than 2 years ago | (#38866521)

Seriously, if all the major free e-mail services signed every outgoing e-mail, wouldn't that cover about %MADEUPPERCENTAGE (but certainly more than half, perhaps closer to 90%) of all e-mail? Have Gmail/Yahoo/Hotmail/whathaveyew create a public/private key for each user, create a new e-mail header for keys (so it's not lurking in the sig confusing people.) This covers most of the Joe User situations (people who run their own server would know enough to sign their own email) and puts the onus on Hotmail/Gmail/Yahoo/whathaveyew policing their own users (heaven forbid!)

Re:Why can't free mail services PGP-sign everythin (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38875627)

Seriously, what you are asking for above is DKIM, since there would be no point into having a different signature for each users if they aren't the only one holding the private key... With DNSSEC, you wouldn't need Gmail/Yahoo/Hotmail/whathaveyew to have their key signed, but just a record like this:

$origin _domainkey.example.com.
postfix TXT "k=rsa\;p=an-rsa-key-that-slashdot-dont-let-me-post"

would simply be trust-able. So, DKIM + DMARC + DNSSEC == authenticated From: domain. If you need the user@ part, then use PGP (and don't ask for your provider to host/provide you a private key, that's simply wrong!).

um... (1, Interesting)

Charliemopps (1157495) | more than 2 years ago | (#38866593)

Is it just me or doesn't the majority of the spam I get come from: AOL, Gmail, Yahoo Mail and Hotmail, and major email senders such as Facebook, Bank of America.

To me, this just seems like an attempt by big spammers to eliminate little spammers.

Re:um... (4, Informative)

jmkaza (173878) | more than 2 years ago | (#38866731)

The majority of your spam SAYS it comes from [insert provider here]. This is intended to stop that.

Re:um... (0)

Anonymous Coward | more than 2 years ago | (#38867499)

Meaning that this exercise exists to find out if that claim is right? Well, let us watch then. Where's the popcorn?

USEPO (1)

ArhcAngel (247594) | more than 2 years ago | (#38866813)

If you want a certified email then set up an electronic postal service and give the new certified domain to them. To send a certified email an account would need to be set up with them and your information verified before you are permitted to send anything through them. The domain would have a set range of IP addresses certified and when a recipient receives a an email from Bank of America if it isn't from BofA@USEPO.gov AND an IP in the white-listed range then delete it. The service would need to charge a fee to maintain the service but how much is your security worth?

DMARC (0)

Anonymous Coward | more than 2 years ago | (#38866873)

and Jell-o at Tanganyka?

DMARC OF DBEAST (-1)

Anonymous Coward | more than 2 years ago | (#38868459)

911 WAS AN INSIDE JOB

Forgeries are only half of the problem (0)

Anonymous Coward | more than 2 years ago | (#38871433)

Question: For 1000 points: What exactly does this do to stop all of that spam I get from Yahoo users, that I report (using ARF) to Yahoo only to be told by one of their retards that I need to include full headers (which I do every time, since ARF requires that) or that the spam didn't come from Yahoo when it most clearly did?

Answer: What is abso-fucking-lutely nothing Alex?

Forgeries are only half of the problem. The other half is all of that spam that is coming from legitimate mailboxes from freemail accounts like Yahoo where said freemail providers staff their abuse desk with bricks.

Actually that's offensive to bricks. Bricks have a use and are not a waste of space (or oxygen).

Re:Forgeries are only half of the problem (1)

GPLHost-Thomas (1330431) | more than 2 years ago | (#38875633)

What exactly does this do to stop all of that spam

It's not an anti-spam tool, so you are right: nothing. But ...

or that the spam didn't come from Yahoo when it most clearly did?

... DMARC does something for that.

How does this stop phishing? (1)

rocket rancher (447670) | more than 2 years ago | (#38877865)

The weak link in any security scheme is the humans that are involved. I don't see how DMARC, DKIM, SPF or any other combination of policies and technology is going to prevent the compromise of the human elements. Phishing is *way* too lucrative an enterprise to be abandoned; the phishers and the criminal organizations that back them are not going to give it up without a fight. What is going to stop a criminal organization, for example, from suborning the system administrators at a DMARC-compliant hosting provider? What will stop them from bribing/extorting sysadmins to look the other way (or whatever that means in terms of compromising DMARC) if/when DMARC starts to compromise their profits?

User-Level DKIM Verification (1)

ewhac (5844) | more than 2 years ago | (#38880995)

About a year ago, when I was trying to figure out why notices from BofA were crashing my Moto RAZR, I did a little reading up on DKIM, and found it rather interesting. What I found even more interesting is that all the DKIM support I could locate operated at the MTA level (sendmail, postfix, etc.). I couldn't find any client-side tools that would verify DKIM signatures.

Has this situation changed (or did I miss something)? Are there any tools I could plug in to, say, 'mutt' to verify DKIM signatures?

Schwab

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...