101–110 of 261 posts
Related: there are known problems with DKIM, and there's a DKIM2 effort: * https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motiva... * https://datatracker.ietf.org/wg/dkim/about/ * https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-... The recently-held IETF 122 had a session on it: * https://www.youtube.com/watch?v=o-0OKfyLlBs
Earlier quoted context omitted.
> As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. You know, the way that regular human people normally are able to transfer identities from one to the other. That's exactly what PGP's web of trust model is for. Someone you know, and trust, can sign and send you a public key of someone that they trust. This new key will be automatically trusted in your trust st…
> SPF/DKIM, as well as TLS etc., is just stupid shit we do because we're too lazy and/or incompetent to make web of trust work for us. Having key signing parties for the entire world wide web does not seem scalable to me. * https://en.wikipedia.org/wiki/Key_signing_party
Web of trust scales better than that, though. It gives you confidence in keys you haven't seen yet because they are signed by other keys that you do trust. The key signing parties strengthen the web of trust, making it more likely a potential correspondent will receive a key signed by someone they trust and therefore potentially not needing to verify it personally.
It all depends how much confidence you want to have for each key. At the end of the day there is no substitute for verifying each key personally if you want to be completely sure. PGP give you the option to hold keys with a lower level of confidence for e.g. less sensitive communications.
Earlier quoted context omitted.
> That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. There is: gpg/pgp signature, but many people find it complicated, primarily because they are reluctant to read the documentation. And it’s popular to criticize it, especially here on HN, in favor of various half-baked alternatives.
I think everyone can agree that any technology that "isn't complicated if you read the documentation" is by definition complicated. I don't need to read the documentation for Gmail to use Gmail successfully. Could I, as a trained programmer, use PGP and GPG? I'm sure I could if I spent some time reading about it. Could my 90 year old grandmother, who is otherwise quite comfortable with email and whatsapp? No, not to…
The important point from the above is it was worth the effort to learn. The only person I know who is a strong advocate of PGP was a missionary to Romania before the iron curtain fell - he had strong reason to hide what he was saying from government level actors and even today still is willing for extra effort to protect himself. For most of us though our threat profile isn't (or doesn't seem to be) that high and so learning how to use the tool isn't worth it.
For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…
> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
Earlier quoted context omitted.
> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…
Earlier quoted context omitted.
Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…
> I blocked 7 countries Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]? [1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...
Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.
Earlier quoted context omitted.
Doors and locks are purely social construct. For majority of people it's much easier to justify stealing from a porch compared to breaking in. No more, no less. For spammers on other hand it's just a business, there will be no reprecussions like ever and we know quite a few big and legitemate companies who started their path with marketing spam sometimes using leaked email databases.
The way you're using "justify" here, makes it seem as if you think people feel it's morally legit to steal, if it's on a porch for... reasons?! From a moral perspective, theft is theft. There's no way someone can sanely claim they thought it was a free thing, because it wasn't locked away. Doors and locks are there to make theft harder , more overt, loud, etc, and by no means validate when it's legit to be a vile thi…
Theft is theft, but for monkey brains there is huge difference between stealing someone wallet from a pocket vs picking dropped wallet and not returning it. So my point is that doors and locks work not because it's good technical measures, but due to how average Joe percieve social construct about them.
And for grey area activities online there is no such social construct because there is no percieved connection between bunch of email addresses and real people. Also in some countries it's totally legal to send you tons of physical mail spam.
Earlier quoted context omitted.
> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
But there are big problems with mapping from IPs to countries. My IPv6 is detected as Russian, though it is London-located tunnel exit point and I'm in the Netherlands.
Earlier quoted context omitted.
> I blocked 7 countries Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]? [1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...
How/why did you pick these 7? Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.
SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…
SPF/DKIM is literally how you establish sender identity instead of relying on the IP address of the email server so it is ironic to claim that they have anything to do with server reputation while lamenting a lack of sender reputation mechanisms.
Currently, SPF/DKIM are mostly used to prevent fraud, but they also provide the best tool we have to build sender based reputation systems.