Slashdot Log In
PayPal Asks E-mail Services to Block Messages
Posted by
CmdrTaco
on Wed Mar 28, 2007 10:14 AM
from the at-least-they're-honest-about-it dept.
from the at-least-they're-honest-about-it dept.
roscoetoon writes ""PayPal, the Internet-based money transfer system owned by eBay, is trying to persuade e-mail providers to block messages that lack digital signatures, which are aimed at cutting down on phishing scams, a company attorney said Tuesday.So far, no agreements have been reached,..." "...PayPal is using several technologies to digitally sign its e-mails now, including DomainKeys, Sullivan said. DomainKeys, a technology developed by Yahoo Inc., enables verification of the sender and integrity of the message that's sent." "...An agreement with, for example, Google for its Gmail service could potentially stop spam messages that look legitimate and bypass spam filters.""
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Sure would be nice (Score:2)
Re: (Score:2)
Unfortunately, someone needs to trot out the anti-spam checklist now:
This isn't the right solution.... (Score:4, Insightful)
Re: (Score:2)
Errrr, this *is* an email signature (Score:4, Insightful)
Parent
SPF (Score:5, Informative)
Tries but fails (Score:4, Informative)
Parent
Re: Tries but fails (Score:4, Informative)
DomainKeys doesn't have a problem with that, though. It signs the message body and a select choice of headers (by default, all headers below the DomainKeys header) with a private key (which is only known to the submit servers). The receiving host checks foo.com's DNS for the public key, and verifies the signature. Obviously, this works with mailing lists as well, since it doesn't matter from which mail server the message arrives. All which matters is that the signature can be verified with the public key in the From address' domain's DNS records.
Naturally, it isn't just mailing lists which run into problems. A lot of mail systems rely on forwarding.
Parent
Even better (Score:5, Insightful)
I've seen lots of spoof Paypal emails and some of them look frighteningly close to the real thing. Even if Paypal's sending legitimate email, what is it? Emailed receipts? Just what I want hopping from mail server to mail server. Emailed promotions? No thanks, does anyone REALLY want those?
If it's that important, do what businesses have been doing for a good century: certified postal mail. If you don't wanna pay the dollar fifty for it, then it must not be very important and, by definition, it makes it non-essential.
Re: (Score:2)
This would be the motivation for Paypal to seek a real fix, the phishing is hitting their bottom line and there's nothing they can directly change; they have to take a global direction.
Paypal is Deceptive (Score:3, Insightful)
Probably because Paypal is deceptive in their own mails. Here's an excerpt from a recent PayPal mail as rendered by MailScanner [mailscanner.info]:
Re: (Score:3, Interesting)
Another is "We have sent you a secure message. Log into your account to see it."
The emails are only text, and they never have a link to the bank's website. The two sentences I have quoted above are pretty much the entire contents of the emails.
The bank has trained me that if they have something to tell me, I should go to the site on my own and log into my account like I would for anything else. No
That reminds me.. (Score:3, Insightful)
I know, you're thinking "why don't you just do something about your open front door?" But dammit, I've based my entire security model around having my front door open at all times, and I really can't be bothered to dream up a more secure system than a wide open front door. I'd much rather make it everyone else's problem instead.
Re: (Score:2)
There is no law involved here. They are -asking- ISPs to do this and help both PayPal and the ISP's customers. There is no law. There is no old woman nagging 'Now don't you do that!'
A better analogy: I'm sick of airports letting people carry knives onto airplanes. I want them to scan and prevent people from carrying them onboard.
Re:That reminds me.. (Score:5, Funny)
Parent
Re: (Score:3, Informative)
I'm not sure how this analogy is relevant. Isn't Paypal asking service providers to block Paypal messages that lack signatures? Wouldn't it be more like: if there were fake police officers going through people's houses and stealing things, and in response then the police department asked citizens not to let police officers into their houses unless those police carried some kind of official ID.
It doesn't sound unreasonable to me.
Re: (Score:3, Insightful)
Well, the problem with this, is unless they can get every service provider to block such messages, it's a worthless system.
See, going to all of the ISPs and saying "help us come up with a secure solution that applies only to us" doesn't solve the general problem or phishing and the like. And, any system which is (mostly) a widespread fix for Paypal doesn't cover all of the other ve
Re: (Score:3, Insightful)
My point was, and still is, doing verification on an ISP-level on a one-service-at-a-time basis is a completely worthless system
It's not completely worthless if it stops PayPal phishing. A large percentage of phishing that goes on is pretending to be PayPal or Ebay.
Or you're going to have a whole bunch of individual services all trying to get all of the ISPs to provide authentication for their crap
Not "provide authentication". They're not asking ISPs to devise an authentication service. The service ex
Already is illlegal (Score:3, Insightful)
Time to move past SMTP? (Score:2, Insightful)
Re:Time to move past SMTP? (Score:4, Insightful)
Parent
Re: (Score:3, Informative)
From the RFC #2821 (which defiens modern SMTP):
SMTP mail is inherently insecure in that it is feasible for even fairly casual users to negotiate directly with receiving and relaying SMTP servers and create messages that will trick a naive recipient into believing that they came from somewhere else. Constructing such a message so that the "spoofed" behavior cannot be detected by an expert is somewhat more difficult, but not sufficiently so as to be a deterrent to someone who is deter
Nope. SMTP works fine. (Score:2)
Rather than re-working an existing system so it is more "effective" in handling a specific case, why not look at how best to handle that specific case?
We've been over this before with regular banks. You need two different channels to confirm a transaction to make it "safe" enough for the average person. Web and phone is good combination.
I don't get it. (Score:4, Insightful)
Re:I don't get it. (Score:4, Insightful)
Parent
Re:I don't get it. (Score:4, Funny)
(My karma's gonna burn for this...)
Parent
Re: (Score:2)
It's not hard, but the fact is, the average user doesn't understand that the path in a link may not go to the place they think it will. The truly web-savvy are knowledgeable but in the minority. What is needed is for email clients to have an option similar to what you see here on Slashdot, where the domain of the link is displayed, although it would need to be expanded to accommodate the intricate URLs spoofer sometimes use. If the average user could see a visual representation of the link, they might be mo
I like this idea (Score:3, Insightful)
All that mail hosts would need to do is verify that the mail was signed by a valid certificate that was issued by the coalition. One certificate to verify against. The coalition can then issue revocation lists as necessary if a member's certificate is ever comprimised.
Seems like an ideal solution to reduce phishing. It could also be used by other organizations who could have their email signed in a similar way, which might allow these messages to bypass spam filters which would benefit the mail hosts.
I think of it as a way to implement a pseudo whitelist, which is by far the best way to ensure that you don't get spam.
KIE2ES: Keep it End-to-End Stupid (Score:2)
I guess I am just old-fashioned eh?
We need "Email 2.0" (Score:2)
But somehow we need to answer the need and perhaps under the premise of protecting financials, there might be some potential for movement. I'm thinking that if a consortium of financial groups got together and decided that from here
Digital signature is the correct approach (Score:2)
The barrier to acceptance of any signature approach (and there are several) is getting everybody on board, or at least a large enough segment of the user population to make a compelling case for others to follow. Paypal might be that segment, bec
Re: (Score:3, Interesting)
Signed email does, however, eliminate the presently very common and significant type of scam that depends on forging emails from legitimate domains.
Signed email also provides an effective basis for spam control, so I have to disagr
The funny part (Score:3, Interesting)
Problem is, they are taking advantage of the fact that people like me make up 10% of the total population, the rest fall for it because they don't take the time to be careful.
Good news! (Score:5, Insightful)
I run my own domain, and while I haven't found a good API for checking domain keys yet, one thing I do is check to see if a domain key signature is present in domains that are known to use them -- for example, if a message claims to be from gmail.com or yahoo.com, I just make sure there is a domain key signature header in the message... no need to validate it. Sure a spammer could put a fake signature in, but then it would be block by the major mail providers.
Granted, this is only a short term solution -- I'm hoping that good support for domain keys appears for Exim before too much longer.
I am also using Sender Policy Framework, as one poster suggested, however it does have two significant limitations. The first limitation is that it doesn't work for forwarded account... for example, I use an @acm.org forwarder for some traffic, which means that the host connecting to my mail server is from acm.org, which won't be listed in the SPF entry for iwanttohireyou.com. There have been some proposed methods for re-writing From lines, but it's really not workable. In my case, I know what servers are allowed to forward mail to my domain, and I simply bypass the SPF check in those cases.
The other problem with SPF, that I see more and more, is that most spammers have stopped putting well known domains in their from lines and are instead using garbage domains, which of course do not have SPF entries. If SPF was universal, then the absence of an SPF entry would tell you something, but it isn't, so it doesn't.
Still, between SPF, domain keys, and well monitored RBLs, you can keep spam to a minimum, and I applaud PayPal for trying to get other ISPs to implement these sorts of controls.
-brian
Email is Stupid (Score:3, Insightful)
I rely on forums and chats for 99% of my useful communications on the internet.
The whole concept of email needs to be redesigned, as others have pointed out.
Paypal should communicate with users through it's site, NOT through email.
they need to 'hard fail all' in their SPF record (Score:3, Informative)
The first thing they should do is change the "~all" to "-all" at the end of their SPF [openspf.org] records.
paypal.com. 3600 IN TXT "spf2.0/pra mx include:s._sid.ebay.com include:m._sid.ebay.com include:p._sid.ebay.com include:c._sid.ebay.com include:spf-2._sid.paypal.com ~all"
paypal.com. 3600 IN TXT "v=spf1 mx include:s._spf.ebay.com include:m._spf.ebay.com include:p._spf.ebay.com include:c._spf.ebay.com include:spf-1.paypal.com ~all"
DomainKeys (Score:3, Interesting)
Re:How about just block emails from paypal? (Score:5, Funny)
I mean why on earth would a third party have the right to request that I stop recieving my emails.
Parent
Re: (Score:3, Interesting)
I run a script that loads their page mercilessly and attempts to log in through their proxy/spoof with random credentials.
It's a practice that's gotten me DOS'd more than once.
But your average joe sixpack is susceptible to these scams, and as such I like what ebay corp. is attempting to do.
-nB
Re:How about just block emails from paypal? (Score:5, Insightful)
Joe Sixpack needs to get off his ass, and actually learn something about the tool (yes its a TOOL, not a toy) he is using to send/receive REAL money to/from other people. If he is too lazy/ignorant/unmotivated to do that, then he will get ripped off, and its not ebay, paypal, or the government's job to protect him from his own stupidity.
Parent
We've been through this before (Score:3, Interesting)
Today email is being forged for criminal gain. The anti-forgery technology already exists. Paypal is negotiating with their business partners to get it deployed.
We all benefit from closing off easy opportunities for crime. Blaming the victim doesn't work very well in the case of a pharming attack anyway.
Re:How about just block emails from paypal? (Score:5, Funny)
They're willing to try. That's why the Dremel tools come with a warning, "This is not a dental tool."
Parent
Re: (Score:3, Insightful)
Re:How about just block emails from paypal? (Score:4, Insightful)
I'm in a position to criticize this education system, having spent 12 years attempting to teach mathematics (including remedial mathematics) to its graduates. I've spoken with the students and their previous instructors, and determined that their public school teachers don't understand the material they "teach". My colleagues who teach history, art, biology, political science, and English say the students do little better in those areas. So yeah, the schools suck --- except when it comes to sports, of course.
You want to accuse "Joe-6-pack" of being stupid then go right ahead, but it's a result of his own choices. Anybody who wants to learn in an American school can still do fairly well.
Here's the rub --- in order to make an informed, rational, intelligent choice you have to be educated. It's a vicious circle: bad decisions lead to
Parent
Re:How about just block emails from paypal? (Score:5, Insightful)
I'll tell you a little story. Once I was operating a cash register, and got conned by a change-raising artist. How humiliating. I guess I shouldn't handle cash.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
Correct. Its a relatively common occurance: you have everything going to me@myisp.com but you start using me@gmail.com instead so you have your ISP forward everything that goes to me@myisp.com to me@gmail.com.
If that's the case I'm guessing that Ebay/Paypal are just betting on there being a minim
Re: (Score:3, Informative)
That means every mail server operator, even the home hobbiest, has to subscribe to some third-party authentication service like domain keys.
I'm just a hobbier, not a hobbiest. Of course, public key stuff means you just have to generate a keypair and put the public one in your domain record.
Re: (Score:3, Insightful)
Yes, but no.
Only the mail server operators that want to prevent phishing scams targeting PayPal would have to implement "some third-party authentication."
I understand what you are saying, and coming up with a solution that only solves a very specific problem (or subset or a problem) isn't very efficient. But if the big players like google, yahoo, microsoft all did
Re: (Score:2)
This is not a customer-side solution, so they aren't trusting users with anything.
Do I think it's a good idea or even that it'll happen? Not really. But it's a nice gesture from a company who is usually just c