Subject: [dispatch] FYI draft-levine-mailbomb-header-00

From: "John Levine" <[email-masked]>
Date: 19 Jun 2017 17:42:25 -0000

This draft came out of a discussion last week at M3AAWG.  The issue is
that bad guys (or more likely bad bots) fill out web forms and include
fake mail addresses, the forms provoke confirmation mail which then
mailbombs the address(es).

This draft adds a new header to indicate that a message is in response
to a form submission:

 Form-Sub: v=1; ip4=198.51.x.x

The IP address is that of the web client, which may be partly redacted
with "x" for privacy reasons.  If a recipient mail system sees too
many of them, it may block the system that's sending them.  The draft
also asks for an enhanced status code which means we rejected this
message because it's part of a flood with Form-Sub headers.

When we had the discussion there were people from at least two large
consumer mail systems and a dozen hosters and (sending) mail service
providers in the room, so it is likely this will be implemented
enough to see if it's useful.

At this point the main point of writing the draft was to have a
reference so I could ask IANA to register the header and status code.
If it does turn out to be useful I'll come back and ask for it to be
dispatched into a standards track document.

R's,
John

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 19 Jun 2017 23:02:20 +0100

>  Form-Sub: v=1; ip4=198.51.x.x

Why not some hashed form of the address?

I'd assume a bad bot will generate a load of subscribes per
IP address, so a (maybe keyed) has of the full address might
be better than the /16 or whatever. And if you only had hashes
then it's harder to accidentally be privacy invasive.

S.

> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: "John R Levine" <[email-masked]>
Date: 19 Jun 2017 18:12:02 -0400

> Why not some hashed form of the address?

As Richard Clayton pointed out, it is trivial to reverse unsalted IPv4 
hashes with rainbow tables (and not all that hard to do salted hashes), 
and you can't use hashes with different salts to see if it's the same 
guilty party.  I added a sentence about that to -01.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Brandon Long <[email-masked]>
Date: Tue, 20 Jun 2017 00:00:05 -0700

So, we think these form providers are more likely to do this than actually
protect their forms from abuse by bots?

This seems like putting the onus on receivers to work around the junk
they're putting out.

I'd be tempted to put on a BOFH hat and use a couple mailbombs to create a
blacklist and never accept mail from them again.  Hmm, maybe I could pay
one of these mailbomb services to mailbomb a couple honeypots.

Though, if they include this header, it's also easy to drop them all, I
guess.

Perhaps a bit hyperbolic, ok.

Brandon

On Jun 19, 2017 3:12 PM, "John R Levine" <[email-masked]> wrote:

As Richard Clayton pointed out, it is trivial to reverse unsalted IPv4
hashes with rainbow tables (and not all that hard to do salted hashes), and
you can't use hashes with different salts to see if it's the same guilty
party.  I added a sentence about that to -01.

Regards,

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 20 Jun 2017 12:21:57 -0600

For v6, how much would typically be redacted ?

> On Jun 19, 2017, at 11:42 AM, John Levine <[email-masked]> wrote:
>

---

From: "John R Levine" <[email-masked]>
Date: 20 Jun 2017 14:27:01 -0400

> For v6, how much would typically be redacted ?

I get the impression it'd usually either be the high half or the low half. 
We worked this out with some German ISPs who had strong opinions about 
what they would be allowed to include.

Keep in mind that the alternative to a redacted IP is not a full IP, it's 
no IP at all.

R's,
John