Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail accepts forged YouTube emails

john-millikin.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: Gmail accepts forged YouTube emails

#71

Post by paddez »

tjpnz wrote: post #18
beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.

This was the concept behind HashCash, the concept behind BitCoin/Cryptocurrencies in general.

The idea being that each email would do a non-trivial amount of work, such compute a valid hash - encode it in the message header. This message header can be checked quickly on receivers side, but takes time for the sender.

This makes sending a large amount of email quickly infeasible without a significant amount of compute power.

https://en.wikipedia.org/wiki/Hashcash

Re: Gmail accepts forged YouTube emails

#72

Post by md_ »

jmillikin wrote: post #70
md_ wrote: post #68

Earlier quoted context omitted.

> I think requiring approval would be the correct behavior. For to be allowed to send email on behalf of should require explicit permission in DNS records (or similarly canonical location). Sorry, by "bidirectional approval" I meant that the author's (i.e. recipient's) mailbox would somehow confirm its desire to receive mail forwarded by robtoledoyour.com . What you describe is, I think, impossible without eliminatin…

> Mailing lists (which are the whole reason ARC exists) It would break mailing lists that want to have the original author's unmodified email address in the `From` header, which ... sounds fine? Contemporary mailing list software sends `From` headers like this: 'Jane User' via Some Mailing List which is verifiable. > Mail forwarding between a user's different mailboxes I would expect this to continue to work as befor…

I think you're basically describing the current ecosystem. :)

ARC allows what you describe for mailing lists, only, even better, it's machine-readable--the message metadata indicate that "Jane User" sent the mail, according to "Some Mailing List", and that Jane User's email was verified per DKIM!

And MTAs can (as you note) require bidirectional confirmation for forwarding and (as you note) can easily identify which authenticated senders actually sent the mail and, if they determine it's an open relay, bitbucket it!

So what you describe is pretty much the status quo, I think. The fundamental issue with the YouTube mail the author has encountered, of course, is that the forwarding domain is authenticated as having passed on an (unmodified) YouTube.com email, and Gmail--quite reasonably, I think--just doesn't know enough to know if the Gmail recipient of that forward wanted it. Since the message has no obvious signs of spam (like linking to a suspicious domain), it seems reasonable to me to treat this like any other authenticated, non-spammy email from a domain Gmail has not seen much volume from before (which I assume is the case here).

Ultimately, even with DKIM, DMARC, and ARC, email allows people to send mail to people they've never communicated with before, and this is an important function to preserve!

(As an aside, I totally acknowledge that a) the protocol complexity in email is a lot worse than it could be if all this functionality was built in up front, and b) there are alternative tradeoffs we could make that would remove some of this complexity. And the complexity is obviously a problem for user comprehension or else we wouldn't be having this conversation! But, fundamentally, if we want to make significant changes, we would have to revisit seemingly desirable features like non-matching envelope and header To, allowing unsolicited email from other people, authenticated forwarding, etc.)

Re: Gmail accepts forged YouTube emails

#73

Post by wakeupcall »

dane-pgp wrote: post #42
beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Big email providers need to set a flag day after which they will drop all email from domains that don't have DKIM+SPF. Their servers also have to support TLS for sending and receiving mail. That's the easy half. Next, we need a stronger system of domain reputation. For this, we grandfather in all existing domain names, but any newly registered domains need to put up a bond for good behaviour. If one of the big email…

This is fully misguided. Did you ever maintain a mail server and/or check your spam? SPAM is for the vast majority SPF/DKIM/whatever compliant (in fact, my regular email has less DKIM signatures). The joke was always that SPAM was passing all these checks _earlier_ than real email systems.

Why?

SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. Add a new check? Well, sorry to break it to you, your spam is going to have it too. In fact, on the systems I manage, 70%+ of all spam is coming from gmail itself.

People conflate SPF/DKIM/DMARC with spam checking.. they're not systems to prevent spam. They're intended to prevent forgery.

Realistically, to protect from the dumbest forms of forgery (which is what spam initially was leveraging on), SPF is really all you need.

If a spam email can leave a system configured with SPF, in practice it's already a problem with the organization that let that message out. No system is going to help you with such a problem, and so they're equally useless as spam filters.

Re: Gmail accepts forged YouTube emails

#74

Post by JCharante »

geoduck14 wrote: post #22
tjpnz wrote: post #18

Earlier quoted context omitted.

I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.

Ok. So. I'm not going to say that is a bad idea, but I will share a story. I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp. If people have to start paying for emails- it will eliminate a lot of the spam - but it won't eliminate all of the spam - and companies like the one I used to work for will start to shine.

What if you are able to set your own fee, so before sending mail you lookup the difficulty level for the receiver. People can just keep raising the dificulty until they stop seeing spam.

Re: Gmail accepts forged YouTube emails

#75

Post by Avamander »

wakeupcall wrote: post #73
dane-pgp wrote: post #42

Earlier quoted context omitted.

Big email providers need to set a flag day after which they will drop all email from domains that don't have DKIM+SPF. Their servers also have to support TLS for sending and receiving mail. That's the easy half. Next, we need a stronger system of domain reputation. For this, we grandfather in all existing domain names, but any newly registered domains need to put up a bond for good behaviour. If one of the big email…

This is fully misguided. Did you ever maintain a mail server and/or check your spam? SPAM is for the vast majority SPF/DKIM/whatever compliant (in fact, my regular email has less DKIM signatures). The joke was always that SPAM was passing all these checks _earlier_ than real email systems. Why? SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. Add a new check? Well, sorry to break…

> This is fully misguided.

It is not. There's still a significant amount of spam that doesn't have SPF, there's a lot of forgery and it's easier to filter if everyone used the holy trinity.

> SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now.

That's what you see on and from gmail, but it's not the majority of spam.

Re: Gmail accepts forged YouTube emails

#76

Post by Avamander »

dwallin wrote: post #45
beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going. Some of the most salient uses/qualities of email: - Asynchronous communication - Decentralized / Federated - Identity Issues: - Spam - Lack of room for the format to expand - Identification verification is hard My ideal replacement for email would look something like a decentralized/federated…

> Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going.

That's why it hasn't and won't happen any time soon.

> My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing.

Nobody stops you from implementing sender whitelists with email.

> Another tool that works decently in a decentralized system is introductions/vouching.

This idea boils down to PKI but that's far from perfect due to humans, not tech.

We could already absolutely significantly increase mail trustworthiness if we'd use S/MIME en-masse. If postmasters aren't improving mail integrity, end-users could. A few EU countries have deployed certificates to people, but it hasn't reached critical mass to act as an indicator yet.

Re: Gmail accepts forged YouTube emails

#77

Post by Avamander »

throwaway892238 wrote: post #33

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into…

Fun fact, gmail.com's is p=none.

Re: Gmail accepts forged YouTube emails

#78

Post by jmillikin »

md_ wrote: post #72
jmillikin wrote: post #70

Earlier quoted context omitted.

> Mailing lists (which are the whole reason ARC exists) It would break mailing lists that want to have the original author's unmodified email address in the `From` header, which ... sounds fine? Contemporary mailing list software sends `From` headers like this: 'Jane User' via Some Mailing List which is verifiable. > Mail forwarding between a user's different mailboxes I would expect this to continue to work as befor…

I think you're basically describing the current ecosystem. :) ARC allows what you describe for mailing lists, only, even better, it's machine-readable--the message metadata indicate that "Jane User" sent the mail, according to "Some Mailing List", and that Jane User's email was verified per DKIM! And MTAs can (as you note) require bidirectional confirmation for forwarding and (as you note) can easily identify which a…

I think the core disagreement is whether forwarding an unmodified signed email should be considered "from the original author" or "from the nearest authenticated hop".

You say that the email should be considered to be from YouTube, because it was originally created and signed by YouTube. In your model, the fact it was received from some unknown third party is non-notable.

I think it's the most recent hop that matters. Just because the original content of the email came from YouTube does not mean that it should be allowed to claim a @youtube.com From address. It should have a @robtoledoyour.com address, because that was the nearest hop in the forwarding chain that Gmail can verify (e.g. via TLS).

And then, since the email is "from" robtoledoyour.com but claims to be from YouTube, it should be discarded (or at least sent to spam).

As you note, this would break use cases that depend on DKIM to allow relaying email through unrelated third-party servers. I think that's fine, because I don't think third-party relays should be allowed to claim the identity of the original server.

Re: Gmail accepts forged YouTube emails

#79

Post by Avamander »

justsomehnguy wrote: post #57
beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Banning everyone who has a different RCPT TO: and To: would be enough.

This is intentionally allowed and very frequent. It's not a thing anyone could realistically change.

However, one Microsoft's patent expires, we could enforce "SPFv3" on both.

Re: Gmail accepts forged YouTube emails

#80

Post by wakeupcall »

Avamander wrote: post #75
wakeupcall wrote: post #73

Earlier quoted context omitted.

This is fully misguided. Did you ever maintain a mail server and/or check your spam? SPAM is for the vast majority SPF/DKIM/whatever compliant (in fact, my regular email has less DKIM signatures). The joke was always that SPAM was passing all these checks _earlier_ than real email systems. Why? SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. Add a new check? Well, sorry to break…

> This is fully misguided. It is not. There's still a significant amount of spam that doesn't have SPF, there's a lot of forgery and it's easier to filter if everyone used the holy trinity. > SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. That's what you see on and from gmail, but it's not the majority of spam.

> It is not. There's still a significant amount of spam that doesn't have SPF, there's a lot of forgery and it's easier to filter if everyone used the holy trinity.

Absolutely. But but again, this will _not_ solve SPAM as the parent implied.

> That's what you see on and from gmail, but it's not the majority of spam.

There's a huge variability on sources, depending also on the class of users you have on your server. However I do keep all copies of spam that could pass greylisting for classification purposes since the early 2010' from various sources and honeypot addresses -- correctly signed spam _is_ the vast majority.

Low-effort spammers are pretty easy to weed out. And while rejecting messages without SPF is still not feasible, it wouldn't _improve_ the ham/spam filtering ratio in my case.

Post reply on HN