On Tue, Apr 14, 2015 at 8:25 AM, Scott Kitterman <[email protected]> wrote:
> I haven't reviewed his in detail, so I've no opinion. I was talking about > this proposal. Not getting fancy with MIME parts would be nice, so if this > one can work, I already like it better than Murray's, but if we have to > pile > this onto the stack of nice ideas, then that's probably what I'll look at > next. > The elegance of John's idea is that it's content-agnostic, and is apparently backward compatible because v=1 verifiers will not consider the weak signature to be valid (unless they're already quite broken). There's no need to learn to parse MIME structure in order to produce a signature. I think the concerning part is deciding when to add the weak signature. The simplest thing is to always add it along with an "@fs=" signature, but then you're basically allowing the forwarding domain to sign any content it wants and you'll be approving it too, implicitly. If you want to be selective about when you add it, you have to apply some kind of heuristic to make that decision. We obviously can't specify that, but it becomes a burden to signers. It's also prone to replays. It might be enough to use a short expiration time, but that relies on everyone processing "x=" properly (or at all), and you need to make a good guess as to what expiration time to use. Of all the proposals before us, this would be the easiest for me to adopt and try, followed by dkim-delegate. dkim-list-canon and dkim-transform would be the hardest, not only because they will require more code, but I'm nervous about how sensitive they are to misinterpretations or abuses of MIME. For example, I've no idea what would happen to messages with MIME preambles. Still, there's something attractive about being able to tell what the original message was and what the added/modified content was, and determining who was responsible for what. Depends on who needs to change to mitigate things. If (as an example only) > we > decide that From rewriting is the best (least bad) solution, then that's a > mediator change. We don't need Yahoo and AOL except to the extent they > operate as mediators also, but AFAIK, that's different groups at Yahoo and > AOL. > I don't think we need to be worried about their participation. Unless they plan to embarrass me later for saying so, they are indeed paying attention, and will participate in trying something that seems viable. -MSK
_______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
