Re:Attacks on Email Sender Authentication
by quesera on Sunday January 16, 2022 @02:05PM
(#29958822)
True, but you're continuing to use confusing nomenclature.
SPF is Sender Policy Framework.
Something like "Originating Entity Policy Framework" might be more correct.
"Sender" refers to the domain, read it as: the sender domain policy allows X and Y servers to deliver emails for this domain (or subdomains).
But I agree that is confusing, also I was unaware that only the HELO and MAIL FROM in the envelop are used, I should check my postfix config..
Re:Attacks on Email Sender Authentication
by quesera on Tuesday January 18, 2022 @01:42PM
(#29983735)
Right, the "Sender" in SPF is the Originating Entity (domain/domain owner), which defines a policy to explicitly bless a set of mailhosts allowed to send messages on behalf of users.
Posted article uses "Sender" for the user, not the entity. Authentication inside the entity is the entity's responsibility. SPF is only concerned with verifying that the mailhosts offering to deliver messages on behalf of entity are allowed to do so.
Re:Attacks on Email Sender Authentication
by fguerraz on Sunday January 16, 2022 @02:30PM
(#29959092)
If you read the paper you will understand that they actually managed to forge what you call "the postmark" to fool the recipient server/software.
Email being a distributed system, the responsibility of identifying the sender is shared, and if implemented property works well.
The job of the client and recipient server is to verify the domain of the sender, according to rules defined by the sender.
The job of the sender server is to authentify the user account.
Implementing things properly is hard...
If you want to authenticate an individual email sender then that sender would sign their email. Just like with paper mail. Sure you can try to determine if the sender is legit by looking at the postmark on the outside of the envelope but that is not what it is for. The result will and can not be reliable.