That much trouble? [LWN.net]

That much trouble?

Posted Sep 6, 2004 10:41 UTC (Mon) by khim (subscriber, #9252)
In reply to: That much trouble? by ametlwn
Parent article: Debian rejects Sender ID

The fact is: with PGP you know who to trust and wuth SPF you do not. You trust some random DNS server - and there are literally thousands of points where you can add your server without much checking. SPF is designed with the stupid idea in mind: you should trust any server with valid SPF information. That's absurd. PGP, on the other hand is designed to live in hostile environment: it's not enough to have valid PGP signature in mail. You somehow should be in trustpath.

Plus you need to sign each and every outgoing mail - just add requirement to sign From: and To: lines as well and voila - great strain for initial sender (==spammer). Relay do not change signature at all so they are not affected.

to post comments

That much trouble?

Posted Sep 6, 2004 13:29 UTC (Mon) by arafel (subscriber, #18557) [Link] (2 responses)

If receiving servers are expected to verify that a PGP signature is valid, that's quite a lot of work added to the machine. If they're not expected to verify it as valid, then what do you gain? You've still received the spam.

Basically, I don't think I understand your point. A mail being PGP signed proves absolutely nothing except that the sender had a copy of PGP. (Or GPG, if you're being picky :)

That much trouble?

Posted Sep 6, 2004 13:52 UTC (Mon) by khim (subscriber, #9252) [Link] (1 responses)

Argh. Of course receiving servers do not need to verify PGP signature - they do not even need to check if it's there or not. End-user mail agent will do it.

And as for "simple PGP signed (by unknown key) mail" being not better then normal mail - it's not. It's harder to create and you can not generate 1'000'000 different PGP keys with ease. Plus if you can not find key on public keyserver - it's reason enough to reject mail. If it's there - you can see about who'll signed it. Read PGP documentation - there are a lot of information about trustpath and such.

The fact is: with PGP you can change policy easily and you need only deal with 10-20 public signers while in case of SPF you're forced to trust god knows whom.

That much trouble?

Posted Sep 7, 2004 12:19 UTC (Tue) by arafel (subscriber, #18557) [Link]

>Argh. Of course receiving servers do not need to verify PGP signature - they
>do not even need to check if it's there or not. End-user mail agent will do
>it.

Then it doesn't accomplish what SPF is trying to do. A spammer I've annoyed before has used my domain as the 'source' for one of his spam floods. If SPF had been deployed, I wouldn't have received the 100,000 bounces or so that I got.

How do you propose that PGP signing of email would help with that? Because I can't see how it would make any real difference.

Bear in mind that the aim is to drop the mail before it even really enters the system, not to post process it. We can already do that.

>And as for "simple PGP signed (by unknown key) mail" being not better then
>normal mail - it's not. It's harder to create and you can not generate
>1'000'000 different PGP keys with ease. Plus if you can not find key on
>public keyserver - it's reason enough to reject mail.

So all the spammers will do is use their zombie machines to generate keys and submit them to keyservers. Congratulations, we now have another wrecked resource.