On Jan 28, 2009, at 6:41 PM, Suresh Ramasubramanian wrote: > On Thu, Jan 29, 2009 at 8:03 AM, Mark Delany <[email protected]> > wrote: >> >> Colo(u)r me dumb/confused/take-your-pick, but is i= effectively the >> moral equivalent of IDENT (RFC1413)? > > Not that I saw people trying to build a reputation model around > IDENT (thank god?), but yeah .. interesting idea.
Building a reputation model around DKIM creates concerns related to replay abuse. DKIM's signature time constraint will not mitigate the replay concern either. When there are problematic accounts, a reputation service could add a secondary query to mitigate problematic and non-rate-limited accounts of the larger domains within minutes of detection. When the number of problematic accounts becomes too large, rejecting at the initial query may become necessary. Today, malware, that morphs within 7 hours, is distributed through exponentially growing botnets where new threats are generated every few seconds. A signature distribution scheme is unable pace with this problem. For malware, this is especially true since reversible signatures can intentionally collide with essential files. Even so, it would be ill considered to expect a mitigation effort based upon the DKIM signature can endure the torrent of signatures already being generated by the spam emitted from these large domains. The numbers would be daunting to support for just one large domain, without considering the thousands of such domains. When a signing domain accurately, even opaquely, indicates the on- behalf-of entity within the DKIM signature, this dramatically reduces the size of the problem. Such a reputation model will be expensive, so it better have a chance to scale to the problem at hand. -Doug _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
