News for hackers. Stuff that matters.
Re:Stop Trying to Fix the User (2016) by cm2187 on Wednesday October 18, 2017 @04:03AM (#15497600)
A good exemple of that is SMTP. This protocol is fundamentally broken and needs to be fixed. There is really no good reason to allow any server to send emails on behalf of any random domain. The vast majority of users are still unaware of this behavior. The fixes that have been developped so far (spf, dkim, etc) are merely lipstick on the pig, they are so optional (and rarely used and when used often broken), that you can’t safely block traffic based on that. IP reputation has its own shortfalls and will become impractical with IPv6. If we don’t come up with a successor now, how will it ever be fixed ever? Emails aren’t going away.
Re:Stop Trying to Fix the User (2016) by starkanop on Wednesday October 18, 2017 @05:15AM (#15497833)
> There is really no good reason to allow any server to send emails on behalf of any random domain.

Except for mailing lists. And email forwarding. And a lot of other stuff you take for granted. Users might not explicitly know about the technical details of how a lot of things work, but that doesn't mean they don't expect the resulting behavior.

It's fashionable, these days, to put authentication and authorization in the transport layer. It's not a natural law, though. As an example, consider s/mime or pgp message signing. MDAs could validate signatures and discard messages that are not correct. This is an example way to solve the auth problems you describe without breaking existing mailing lists, since you'd be validating the content instead of the envelope.

Just food for thought. SMTP isn't as broken as you think, and replacing it isn't necessary to solve today's problems.

Re:Stop Trying to Fix the User (2016) by cm2187 on Wednesday October 18, 2017 @05:23AM (#15497855)
I am not sure I agree with mailing lists. I don't think the email needs to look like it is coming from a user. There is nothing wrong with the email looking like it is coming from the mailing list itself (unless I misunderstood what you mean by mailing list being a problem).

You can't ask regular users to run pgp themselves. This is a prime example of the sort of technical details that a user shouldn't be asked to even understand or be aware it exists.

Re:Stop Trying to Fix the User (2016) by zimpenfish on Wednesday October 18, 2017 @04:37AM (#15497698)
https://en.wikipedia.org/wiki/Internet_Mail_2000 would have been a reasonable first step.
Re:Stop Trying to Fix the User (2016) by dtech on Wednesday October 18, 2017 @05:12AM (#15497817)
> The fixes that have been developped so far (spf, dkim, etc) are merely lipstick on the pig, they are so optional

Lipstick on a pig yes, optional, no. If you want to have your e-mail delivered to Gmail you'll need them. And since Gmail is 50%+ of all e-mail that means it's pretty much mandatory.

Re:Stop Trying to Fix the User (2016) by cm2187 on Wednesday October 18, 2017 @05:25AM (#15497861)
Last time I looked at my incoming email traffic, a significant number of mail wasn't signed or/and didn't have spf entries. Even if it is 20% of the traffic, it's still too large to safely block.
Re:Stop Trying to Fix the User (2016) by shawabawa3 on Wednesday October 18, 2017 @06:03AM (#15497969)
> Even if it is 20% of the traffic, it's still too large to safely block.

Maybe for you. But considering I use gmail I block it all and never notice any problems

Re:Stop Trying to Fix the User (2016) by cm2187 on Wednesday October 18, 2017 @07:15AM (#15498174)
Gmail has the scale and the means to run all sort of sophisticated heuristic to determine whether a message is a spam or not. It's good for gmail users that they make up for the shortfall of the protocol that way. But for everyone else, the protocol needs to be fixed, you can't expect every company in the world, large or small, to build and maintain the spam/phishing/malware filters that gmail runs.
Re:Stop Trying to Fix the User (2016) by empath75 on Wednesday October 18, 2017 @07:36AM (#15498253)
I’ve noticed that recently I check my email less and less often. I use gmail as an auth service more than anything else.