[apps-discuss] Looking to begin discussion about email and IPv6

[Terry Zink]

Hi, everyone,

I am new to the IETF process but have wanted to get involved for some time.

I browsed through the various working groups and I didn't any that were related to the topic I need to discuss, so I am bringing it up here. If need be, perhaps we can create a separate WG.

The topic I want to discuss is IPv6 and email. At the Paris IETF, one of my colleagues presented some slides I drew up regarding the problem of email and IPv6. Because of widespread abuse of SMTP today in IPv4, the email industry is hesitant to move to IPv6 for sending anonymous email as the current techniques in use will not scale.

Has anyone else addressed this? There are workarounds floating around but most of what we see today is that most people don't send mail over IPv6 and those that do know who they want to receive it from. The problem is that once IPv6 becomes mainstream, eventually we will "build a better spammer" and the problem of abuse would swamp email servers.

I have some ideas on how to address this, at least in the short term. I'd also like go gauge interest for discussing this at the Vancouver IETF at the end of July.

Thanks.

-- Terry

[Marc Blanchet]

to me, the issue is real and relevant to IETF and apps area is a good place to start discussing. I would suggest you to write an internet-draft describing first the problem and maybe/optional the solution space you are thinking.

if you don't know how to start writing an Internet-draft, either take a look at another one or see: http://www.ietf.org/tao.html#anchor38

marc.

Post by Terry Zink
Hi, everyone,
I am new to the IETF process but have wanted to get involved for some time.
I browsed through the various working groups and I didn't any that were related to the topic I need to discuss, so I am bringing it up here. If need be, perhaps we can create a separate WG.
The topic I want to discuss is IPv6 and email. At the Paris IETF, one of my colleagues presented some slides I drew up regarding the problem of email and IPv6. Because of widespread abuse of SMTP today in IPv4, the email industry is hesitant to move to IPv6 for sending anonymous email as the current techniques in use will not scale.
Has anyone else addressed this? There are workarounds floating around but most of what we see today is that most people don't send mail over IPv6 and those that do know who they want to receive it from. The problem is that once IPv6 becomes mainstream, eventually we will "build a better spammer" and the problem of abuse would swamp email servers.
I have some ideas on how to address this, at least in the short term. I'd also like go gauge interest for discussing this at the Vancouver IETF at the end of July.
Thanks.
-- Terry
_______________________________________________
apps-discuss mailing list
https://www.ietf.org/mailman/listinfo/apps-discuss

[Murray S. Kucherawy]

-----Original Message-----
Sent: Thursday, April 05, 2012 3:17 PM
Subject: [apps-discuss] Looking to begin discussion about email and IPv6
[...]
I have some ideas on how to address this, at least in the short term.
I'd also like go gauge interest for discussing this at the Vancouver
IETF at the end of July.

Hi Terry,

This is a frequent topic in industry, especially at the Messaging Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not part of IETF. You'd probably get a lot of interested people if you put together a BoF there. You can probably get some people together at IETF in Vancouver too for a bar BoF.

Off the top of my head, I can only think of this document (now expired) on the topic:

https://datatracker.ietf.org/doc/draft-oreirdan-rosenwald-ipv6mail-transition/

I think this is of interest to people in the Applications area. I suggest writing up a draft and circulating it for discussion with what you have in mind.

-MSK

[Peter Saint-Andre]

Post by Murray S. Kucherawy

Subject: [apps-discuss] Looking to begin discussion about email and IPv6
[...] I have some ideas on how to address this, at least in the
short term. I'd also like go gauge interest for discussing this at
the Vancouver IETF at the end of July.

Hi Terry,
This is a frequent topic in industry, especially at the Messaging
Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not
part of IETF. You'd probably get a lot of interested people if you
put together a BoF there. You can probably get some people together
at IETF in Vancouver too for a bar BoF.

Which reminds me that there's been talk about holding IETF interim
meetings for relevant WGs at conferences like MAAWG and RIPE. Our new
AppsArea overlords might want to consider something like that at a
future MAAWG meeting. :)

Peter

[Terry Zink]

Okay.

I have written my very first Internet Draft and uploaded it to the IETF site, and it passed all of the nits. It is available here:

http://datatracker.ietf.org/submit/status/41308/

It is entitled "Recommendations for the use of whitelists for email senders transmitting email over IPv6". The abstract in the summary page is correct, but if you click on the .txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't... but the summary page is correct).

Reviews and comments are welcome. I hope to bring this up for discussion at the next IETF meeting in Vancouver, BC.

-- Terry


-----Original Message-----
From: apps-discuss-***@ietf.org [mailto:apps-discuss-***@ietf.org] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: apps-***@ietf.org
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Post by Murray S. Kucherawy

Subject: [apps-discuss] Looking to begin discussion about email and IPv6
[...] I have some ideas on how to address this, at least in the short
term. I'd also like go gauge interest for discussing this at the
Vancouver IETF at the end of July.

Hi Terry,
This is a frequent topic in industry, especially at the Messaging
Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not
part of IETF. You'd probably get a lot of interested people if you
put together a BoF there. You can probably get some people together
at IETF in Vancouver too for a bar BoF.

Which reminds me that there's been talk about holding IETF interim meetings for relevant WGs at conferences like MAAWG and RIPE. Our new AppsArea overlords might want to consider something like that at a future MAAWG meeting. :)

Peter

--
Peter Saint-Andre
https://stpeter.im/

[Barry Leiba]

Hi, Terry.

Post by Terry Zink
I have written my very first Internet Draft and uploaded it to the IETF site, and it passed
http://datatracker.ietf.org/submit/status/41308/
It is entitled "Recommendations for the use of whitelists for email senders transmitting
email over IPv6".  The abstract in the summary page is correct, but if you click on the
.txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't...

If it's the wrong version, it's probably not a great idea to get
people to review it yet... and it looks like you actually cancelled
the submission, so the draft is not really in the system. I'll
contact you off list to help you get the right version uploaded.
Sometimes the system can be a bit confusing the first time one tries
to use it.

Barry

[Terry Zink]

Er, I meant this link here:

http://datatracker.ietf.org/submit/status/41309/42d68ba727abfd834c85707f0f651ffd/

Sorry about that.

-- Terry


-----Original Message-----
From: apps-discuss-***@ietf.org [mailto:apps-discuss-***@ietf.org] On Behalf Of Terry Zink
Sent: Friday, May 18, 2012 5:15 PM
To: apps-***@ietf.org
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Okay.

I have written my very first Internet Draft and uploaded it to the IETF site, and it passed all of the nits. It is available here:

http://datatracker.ietf.org/submit/status/41308/

It is entitled "Recommendations for the use of whitelists for email senders transmitting email over IPv6". The abstract in the summary page is correct, but if you click on the .txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't... but the summary page is correct).

Reviews and comments are welcome. I hope to bring this up for discussion at the next IETF meeting in Vancouver, BC.

-- Terry


-----Original Message-----
From: apps-discuss-***@ietf.org [mailto:apps-discuss-***@ietf.org] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: apps-***@ietf.org
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Post by Murray S. Kucherawy

Subject: [apps-discuss] Looking to begin discussion about email and IPv6
[...] I have some ideas on how to address this, at least in the short
term. I'd also like go gauge interest for discussing this at the
Vancouver IETF at the end of July.

Hi Terry,
This is a frequent topic in industry, especially at the Messaging
Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not
part of IETF. You'd probably get a lot of interested people if you
put together a BoF there. You can probably get some people together
at IETF in Vancouver too for a bar BoF.

Which reminds me that there's been talk about holding IETF interim meetings for relevant WGs at conferences like MAAWG and RIPE. Our new AppsArea overlords might want to consider something like that at a future MAAWG meeting. :)

Peter

--
Peter Saint-Andre
https://stpeter.im/

[Murray S. Kucherawy]

-----Original Message-----
Sent: Friday, May 18, 2012 8:10 PM
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6
http://datatracker.ietf.org/submit/status/41309/42d68ba727abfd834c85707
f0f651ffd/
Sorry about that.
-- Terry

That document is half-submitted. You need to go to that link yourself and complete the form before it will actually post to the datatracker.

-MSK

[Terry Zink]

Wow, I'm on a roll today (sigh). It's actually here.

https://datatracker.ietf.org/doc/draft-tzink-ipv6mail-whitelist/

-- Terry


-----Original Message-----
From: apps-discuss-***@ietf.org [mailto:apps-discuss-***@ietf.org] On Behalf Of Terry Zink
Sent: Friday, May 18, 2012 5:15 PM
To: apps-***@ietf.org
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Okay.

I have written my very first Internet Draft and uploaded it to the IETF site, and it passed all of the nits. It is available here:

http://datatracker.ietf.org/submit/status/41308/

It is entitled "Recommendations for the use of whitelists for email senders transmitting email over IPv6". The abstract in the summary page is correct, but if you click on the .txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't... but the summary page is correct).

Reviews and comments are welcome. I hope to bring this up for discussion at the next IETF meeting in Vancouver, BC.

-- Terry


-----Original Message-----
From: apps-discuss-***@ietf.org [mailto:apps-discuss-***@ietf.org] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: apps-***@ietf.org
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Post by Murray S. Kucherawy

Subject: [apps-discuss] Looking to begin discussion about email and IPv6
[...] I have some ideas on how to address this, at least in the short
term. I'd also like go gauge interest for discussing this at the
Vancouver IETF at the end of July.

Hi Terry,
This is a frequent topic in industry, especially at the Messaging
Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not
part of IETF. You'd probably get a lot of interested people if you
put together a BoF there. You can probably get some people together
at IETF in Vancouver too for a bar BoF.

Which reminds me that there's been talk about holding IETF interim meetings for relevant WGs at conferences like MAAWG and RIPE. Our new AppsArea overlords might want to consider something like that at a future MAAWG meeting. :)

Peter

--
Peter Saint-Andre
https://stpeter.im/

[Barry Leiba]

Post by Terry Zink
I have written my very first Internet Draft and uploaded it to the IETF site
https://datatracker.ietf.org/doc/draft-tzink-ipv6mail-whitelist/
It is entitled "Recommendations for the use of whitelists for email senders
transmitting email over IPv6".
Reviews and comments are welcome.  I hope to bring this up for discussion at
the next IETF meeting in Vancouver, BC.

I have some comments to kick things off, mostly editorial, not to the
substance of the proposal. You might consider these and work up an
-01 version, while others are working on their comments on the
substance:

-- Abstract --
This document contains a plan for how providers of email services
can manage the problem of email abuse over IPv6. Spammers can
send mail from a very large range of IPv6 addresses, and this will
make current antispam technology less effective.

Be careful about making it sound like you think you have the FUSSP. I
suggest "manage one aspect of the problem", or some such, and "current
antispam blocklisting technology".

Later in the abstract: "interim transition" seems a bit redundant to me.

-- Sections 1.x --

I suggest that you try to use terms from RFC 5598, and cite that as a
normative reference. Your definition for "email", for example, is
fluffy, and in this document it really means "SMTP mail" anyway.
Don't try to re-invent terms, when we have a good reference set up
already.

-- Section 1.8 --

I suggest you use RFC 5782 as a (normative) reference for IP
black/white listing, and cite it here and in Section 2.

-- Section 2 --

In IETF terms, IP is not "transport" (TCP is transport, and IP is at a
lower stack layer). I suggest that you change things like
"transitioned from an IPv4 transport to that of IPv6," to simply
"transitioned from IPv4 to IPv6," and "when operating using IPv4 as a
transport mechanism," to "when operating over IPv4."

OLD
By rotating through IPs quickly, a blocklist would always
be one step behind spammers and lose its effectiveness.
COMMENT
The referent is wrong here -- the blocklist is not what's rotating
through the "IPs", and they're IP addresses anyway.
NEW
By rotating through IP addresses quickly, a spammer would
always be one step ahead of the blocklists, and the lists
would lose their effectiveness.

(I similarly suggest that you look around at where else you should be
saying "IP address", "IPv4 address", and "IPv6 address", where the
word "address" is absent now. It doesn't have to be in every place,
but things would be clearer if it were in most places.)

-- Section 3 --
The second paragraph is a good example of what I noted parenthetically
above: I would use "IP addresses" for all instances of "IPs" here. In
the second sentence, the comma needs to be a semicolon. The third
sentence feel awkward, and I suggest this:
OLD
IPs on this
whitelist are there because they send email over IPv6 intentionally,
not because they are part of a botnet and are sending email without
the computer owner's consent.
NEW
IP addresses on this
whitelist are there because they send email over IPv6 intentionally,
and are not sending email without the computer owner's consent, as
part of a botnet.

You say "known good IP [addresses]", but say nothing about how they're
known to be good. Perhaps simply a forward reference to Section 4
would be nice.

In the third paragraph, I suggest not using "content filter" as a
compound verb. Try rephrasing (perhaps "filter the mail by content").

-- Section 4 --
This seems to say that whitelisting will always be symmetric: "once
one party or both parties have agreed to whitelist each other". I
know you don't mean to say that, so you might rephrase to be clearer.
In fact, you and I might not even know each other, but I might be
relying on your reputation from some other source when I add you to my
whitelist... and you wouldn't know I had done it nor consider adding
me to your whitelist at all. Just focus on a receiving end
whitelisting a sending IP address.

-- Section 5 --
At some point, we'd have to look at issues that are specific to IPv6
whitelists, but for now, you should cite the security considerations
in RFC 5782, note that much of that applies here, and note that
v6-specific considerations need to be addressed as the document is
developed.

-- Section 6 --
Expand "PII" on first use.

Second paragraph: "As noted"... where?

-- References --
I would say that RFC 5321 is normative.

You have references to RFCs 1958, 4213, and 5211, with no citations to them.

--
Barry

[Nico Williams]

How does IP6 have any kind of an effect on spam? Just curious,

Nico
--

[Murray S. Kucherawy]

-----Original Message-----
Sent: Thursday, April 05, 2012 3:42 PM
To: Terry Zink
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6
How does IP6 have any kind of an effect on spam? Just curious,

The portion of an anti-spam framework that evaluates based on client IP address (DNSBLs, for instance) has a far larger problem to deal with in IPv6.

-MSK

[John Levine]

Post by Murray S. Kucherawy
https://datatracker.ietf.org/doc/draft-oreirdan-rosenwald-ipv6mail-transition/

There's also my draft of an alternate way to publish DNSBLs as B-trees that
can directly express address ranges:

http://tools.ietf.org/html/draft-levine-iprangepub-02

Something that would make our lives a lot easier is a way for networks
to publish their customer allocation size, be it /64 or whatever.
Sure, some naughty networks will like, but the largest ones won't, and
when you get spam from a 'bot, it'd be a useful hint to know how large
a range the bot has infected.

R's,
John

[Murray S. Kucherawy]

-----Original Message-----
Sent: Thursday, April 05, 2012 5:43 PM
Cc: Murray S. Kucherawy
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6
Something that would make our lives a lot easier is a way for networks
to publish their customer allocation size, be it /64 or whatever.
Sure, some naughty networks will like, but the largest ones won't, and
when you get spam from a 'bot, it'd be a useful hint to know how large
a range the bot has infected.

I've been keeping an eye on various work in sidr, dnsop, and weirds to see where this capability is more likely to emerge. It's definitely desirable specifically for the email-over-IPv6 space, but possibly for other security-related things as well. I'll be putting work into it wherever it appears, and/or will submit a draft of my own if I come up with an idea that seems workable.

[John Levine]

Post by Murray S. Kucherawy
I've been keeping an eye on various work in sidr, dnsop, and weirds to see where this capability
is more likely to emerge. It's definitely desirable specifically for the email-over-IPv6 space,
but possibly for other security-related things as well. I'll be putting work into it wherever
it appears, and/or will submit a draft of my own if I come up with an idea that seems workable.
I just haven't found that yet.

In Paris I had dinner with the guys who were running the conference
network, and explained to them why we wanted the allocation size.
They had a bunch of plausible ideas, none of which I remember in
detail (darn that cheap but tasty wine from southern France) other
than that if WEIRDS succeeds, it could either be a field in the
response for the allocation, or they could SWIP all of the
suballocations. I suggested that for both scale and privacy reasons
ARIN would probably not welcome 50,000,000 SWIPs from Comcast, but
they noted that large networks can run their own subservers, and it's
quite possible to have entries for individuals that don't include the
PII.

R's,
John

[John Levine]

[ someone noted limited interest in v6 mail ]

I think the main reason is that nobody in North America or Europe sees
any but hypothetical reasons to accept v6 mail any time soon. I do,
and I can assure you that 100% of the mail I get on v6 could equally
well have been sent on v4. If it were up to me, I would put all of my
v6 effort into web services, which loses a lot more with NAT or
proxies than mail does.

There's two basic problems with v6 whitelists: making them and using them.

For using them, we have a version of rbldnsd with basic v6 support,
but nobody has any real idea how well it'll work, because we don't
understand very well how DNSxL traffic caches. If you're a large
provider and can run rbldnsd or the equivalent on the same LAN and
have the sophistication to fetch or manage the DNSxLs it serves,
caching doesn't matter, but for everyone else it does. The limited
data I have is utterly unclear about practical v4 DNSBL cache
behavior. At the very low end, it doesn't cache and doesn't matter,
for some kinds of woodpeckering it does cache which does help, in
between, who knows.

For making them, the problem is how you come up with a registration
system that is simple enough that unsophisticated MTA operators can
use it, but hostile enough that bots can't script it, not unlike the
problem of webmail signups. If we could figure that out, we could at
least try some experiments.

Regards,
John Levine, ***@iecc.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

[Martijn Grooten]

Post by John Levine
For making them, the problem is how you come up with a registration
system that is simple enough that unsophisticated MTA operators can
use it, but hostile enough that bots can't script it, not unlike the
problem of webmail signups. If we could figure that out, we could at
least try some experiments.

ipv6whitelist.eu uses a CAPTCHA to prevent automated mass-registration
of IPv6 MTAs.

I'm not a big fan of CAPTCHAs in general, but it in this case it should
prevent botnet spammers from registering all of their IPv6 addresses.
It doesn't stop them registering a handful of addresses and sending
lots of messages per address, but the list is only supposed to be a
first step: don't accept anything that isn't listed and run blacklists,
whitelists and reputation services on the small subset of listed
addresses. It sounds like a reasonable solution to me.

One potential issue is the question of who should run such lists. I
don't think we should want a situation where there are dozens of bigger
and smaller lists like this and where you'd have to register your
address with all of them, just because you don't know which lists
recipients are using.

Martijn.


________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.