Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Alessandro Vesely
On Wed 16/Aug/2023 19:48:30 +0200 Murray S. Kucherawy wrote: On Wed, Aug 16, 2023 at 10:25 AM Alessandro Vesely wrote: On Wed 16/Aug/2023 15:26:43 +0200 Laura Atkins wrote: On 16 Aug 2023, at 12:59, Alessandro Vesely wrote: On Wed 16/Aug/2023 11:17:50 +0200 Laura Atkins wrote: On 16 Aug 202

Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Alessandro Vesely
On Wed 16/Aug/2023 20:19:44 +0200 Dave Crocker wrote: On 8/16/2023 10:48 AM, Murray^W Ale wrote: Yet, an open signer is for DKIM the equivalent of what an open relay is for SPF. It is nothing of the sort. Open relays perform a relaying function, which actively moves mail, where the abuse is

Re: [Ietf-dkim] replay is a bogus concept

2023-08-17 Thread Alessandro Vesely
On Thu 17/Aug/2023 04:45:48 +0200 Bron Gondwana wrote: On Tue, Aug 15, 2023, at 21:36, Alessandro Vesely wrote: On Tue 15/Aug/2023 08:10:23 +0200 Bron Gondwana wrote: We've love to not sign spam at all, but short of never allowing users to send email, it's not actually possible. We're not tr

Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Murray S. Kucherawy
On Thu, Aug 17, 2023 at 3:30 AM Alessandro Vesely wrote: > > I'm not convinced advice is necessary here. Do you really need signs in > > banks that say "Don't put your signature on random financial > documents"? I > > have to believe that people understand what it means to sign something, > and

Re: [Ietf-dkim] replay is a bogus concept

2023-08-17 Thread Steffen Nurpmeso
Alessandro Vesely wrote in <652789f7-0a0a-f8db-11f9-2558bc9ec...@tana.it>: |On Thu 17/Aug/2023 04:45:48 +0200 Bron Gondwana wrote: |> On Tue, Aug 15, 2023, at 21:36, Alessandro Vesely wrote: |>> On Tue 15/Aug/2023 08:10:23 +0200 Bron Gondwana wrote: |>>> We've love to not sign spam at all, but

Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Alessandro Vesely
On Thu 17/Aug/2023 18:21:35 +0200 Murray S. Kucherawy wrote: On Thu, Aug 17, 2023 at 3:30 AM Alessandro Vesely wrote: I'm not convinced advice is necessary here. Do you really need signs in banks that say "Don't put your signature on random financial documents"? I have to believe that peopl

Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Emanuel Schorsch
On Thu, Aug 17, 2023 at 2:06 PM Alessandro Vesely wrote: > On Thu 17/Aug/2023 18:21:35 +0200 Murray S. Kucherawy wrote: > > On Thu, Aug 17, 2023 at 3:30 AM Alessandro Vesely > wrote: > > > >>> I'm not convinced advice is necessary here. Do you really need signs > in > >>> banks that say "Don't

Re: [Ietf-dkim] replay is a bogus concept

2023-08-17 Thread Jesse Thompson
On Thu, Aug 17, 2023, at 12:02 PM, Steffen Nurpmeso wrote: > More, usually (it happened in the past) they then point to their > web site, where you then *do*, and isn't the certificate of that > website, which itself is likely verified by some CA in some CA > pool that you do not have control over,

Re: [Ietf-dkim] Replay attack definition discussion

2023-08-17 Thread Jesse Thompson
On Thu, Aug 17, 2023, at 5:30 AM, Alessandro Vesely wrote: > When domain authentication arrived, they considered that /all/ messages from > their domain must be authenticated. Some receivers only send FBLs if the messages are DKIM=pass. So, the responsible thing to do is for a MBP/ESP to sign e