Hacker News Reader

Comment by bombcar | Hacker News Reader

Back when domains were easy to spoof (I could setup a server and send mail as ycombinator.com easily enough) it made sense to track the IPs, but now that you have DKIM and SPF links to cross-check, you should be able to use the domain reliability as a strong indicator. Sure you would have to catch people buying a "good" domain that expired, but that shouldn't be an insane hurdle.

The real story is nobody cares.

View on HN

> The real story is nobody cares.

Exactly. Why should the major players care about those too small to matter?

> Sure you would have to catch people buying a "good" domain that expired

Adding to my earlier point, Google and Microsoft are well-enough connected to the domain registrars to know when that scenario has happened as well. If they put any effort into it, they could reliably determine whether a new IP address for an established domain is legitimate or a fraud. But as we've said, why put any effort into it when the only people complaining are not important?

And it's even worse - if we theorize a email competitor appearing out of nowhere to rival Gmail, and people complaining, all that would happen is Google and Microsoft would special-case that provider, and the underlying issue wouldn't be solved.

a class action lawsuit could make them care.

as far as how to solve this problem technically, I think a reputation system based not on domains or ips but on email certificates is the real answer here.

DKIM is certificates, so I'm guessing you're talking about sender certificates?

How would that help? Spammers can get certificates too. Maybe it cuts down on some of the misconfigured http email senders, maybe, but not enough to matter. Scam sites run https these days.

You can't use like age of activity of the cert to help because a) things get compromised, b) you need to rotate your certs frequently anyway.

Shouldn't the authority (or key) used to sign those certs be long lived? The certificates themselves should be rotated frequently, bit not the key used to sign them.

There's only S/MIME, TLS and BIMI+VMC that use actual certificates.

DKIM does not and DKIM keys should be rotated once in a while, but few do.

Being able to tie together letters and senders, knowing who sent what, would help.

It wouldn't help to fully trust, nothing would, it's a human problem, it would help to trust more.

If the email is DKIM signed, it's expected that the sender was authorized to send the message.

Any wide spread certificate program will just have the email address as the identity, and it will be authorized by establishing control of the email (just like the majority of certificates used for https are domain control only, no organizational verification, not that organizational verification means much anyway). Anyway, identity is hard; there are many people with my name, including a Pulitzer winning author.

Isn't the problem more about how to treat brand new domains the first time you encounter them? In order to be friendly to small/new email servers, you would presumably need to initially grant new domains a sufficient reputation for them to send mail reliably. But since domains are essentially unlimited, a bad actor can trivially circumvent your reputation system by spinning up endless domains. This seems like a fairly textbook example of a Sybil attack.

Spinning up endless domains is something that can be detected perfectly well. Very few entities can do it in a way that interferes with other people.

Domains aren't free, they're limited.

Keep in mind that there are a lot of domains out there without SPF records, there's really no lack of domains to abuse.

Not to mention all the websites that get hacked or the uber-cheap registrars.

Using DKIm you don’t actually have the problem that people can buy so-called good domains, because the system works with private and public keys, so not only do you need a good domain, you also need the private key for that specific DKIM in signature

I wonder how many systems actually track DKIM signatures over time, beyond just checking at the moment of email receipt.

Most, check results are usually kept in the final stored letter.

You wouldn't need to.

At the point of receipt, when verifying via DKIM that foobar.com did indeed send this email, then update your spam statistics for foobar.com and you're good.

Reply on news.ycombinator.com