John R Levine writes: > On Thu, 24 Sep 2026, Tero Kivinen wrote: > > I think most of the text changes in body are something that are > > suspicious. I mean if someone changes "I agree" to "I do not agree" > > that is modifying important things. Additions to the end of body are > > most likely mostly harmless, but text changes inside the body should > > be limited to things like removing or replacing links etc. > > But that could be just as bad. What if a malevolent system rewrote a > password reset link to a phish site. Or if a bank sends a message asking > about a credit card charge with links for good or bad (I got one of those > yesterday) and it switches the links. I can think of some heuristics, > e.g., rewrites to point at proofpoint are probably OK, but I wouldn't want > to try to put it in the spec.
We have been trying to teach both senders and receivers that do not send links, and if someone sends you links do not click on them. I think only safe rewrite for links is to remove them, and I know lots of security gateways etc either do that, or change them to point to security gateway. Removing link could be considered safe, replacing link would need some configuration or heuristics to decide whether they are safe. But the main point was not really about the links, but the actual text changes. Do we really need such capability at all, or can we consider all of those being malicous? And I am talking about changes or deletions, not additions to the end or beginning of email. -- [email protected] _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
