PayPal Asks E-mail Services to Block Messages 222
roscoetoon writes ""PayPal, the Internet-based money transfer system owned by eBay, is trying to persuade e-mail providers to block messages that lack digital signatures, which are aimed at cutting down on phishing scams, a company attorney said Tuesday.So far, no agreements have been reached,..." "...PayPal is using several technologies to digitally sign its e-mails now, including DomainKeys, Sullivan said. DomainKeys, a technology developed by Yahoo Inc., enables verification of the sender and integrity of the message that's sent." "...An agreement with, for example, Google for its Gmail service could potentially stop spam messages that look legitimate and bypass spam filters.""
Sure would be nice (Score:2)
Re: (Score:2)
Unfortunately, someone needs to trot out the anti-spam checklist now:
Didn't you get my offer? (Score:2, Funny)
This isn't the right solution.... (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
That's like saying "stopping malware would be easy if only Bill and Linus forged and alliance and combined their powers"
Re: (Score:2)
I think you possibly underestimate how big a problem that is.
In the days of snail mail, it was pretty uncommon for you to receive a letter purporting to be from someone it wasn't. Certainly not, say, a letter from your bank saying "We've accidentally gone and deleted all your verification information, please reply within 7 working days to the address above enclosing your full name, account number and signatur
Errrr, this *is* an email signature (Score:4, Insightful)
SPF (Score:5, Informative)
Tries but fails (Score:4, Informative)
Re: (Score:2)
JOhn
Re: (Score:2)
Re: Tries but fails (Score:4, Informative)
DomainKeys doesn't have a problem with that, though. It signs the message body and a select choice of headers (by default, all headers below the DomainKeys header) with a private key (which is only known to the submit servers). The receiving host checks foo.com's DNS for the public key, and verifies the signature. Obviously, this works with mailing lists as well, since it doesn't matter from which mail server the message arrives. All which matters is that the signature can be verified with the public key in the From address' domain's DNS records.
Naturally, it isn't just mailing lists which run into problems. A lot of mail systems rely on forwarding.
Re: (Score:2)
But any so-called legitimate marketeer can create an SPF record for their domains.
If you want to see how badly spf can be abused by regular ISPs, look at the SPF record for panix.com:
panix.com text = "v=spf1 ip4:166.84.0.0/16 ip4:198.7.7.0/24 ?all"
I assume they just added their entire IP blocks to the SPF rec
Even better (Score:5, Insightful)
I've seen lots of spoof Paypal emails and some of them look frighteningly close to the real thing. Even if Paypal's sending legitimate email, what is it? Emailed receipts? Just what I want hopping from mail server to mail server. Emailed promotions? No thanks, does anyone REALLY want those?
If it's that important, do what businesses have been doing for a good century: certified postal mail. If you don't wanna pay the dollar fifty for it, then it must not be very important and, by definition, it makes it non-essential.
Re: (Score:2)
This would be the motivation for Paypal to seek a real fix, the phishing is hitting their bottom line and there's nothing they can directly change; they have to take a global direction.
But of course! (right..) (Score:2)
If you owned a company who's (almost) exclusive way of communicating with customers is by email, would you give it up and tell the millions who depend on Paypal that they'll receive receipts by the mailman? Yes their customer service is shit so I won't even try to sugarcoat that reality. Right let's send an email to customers in Africa, the receipt for a purchase shall come in by Air-Camel straight from UK!
Yes, fake paypal emails do look very similar sometimes to the real thing, but if you fall for i
Re: (Score:2)
Paypal is Deceptive (Score:3, Insightful)
Probably because Paypal is deceptive in their own mails. Here's an excerpt from a recent PayPal mail as rendered by MailScanner [mailscanner.info]:
Re: (Score:2)
Yes. I want emailed receipts. I want to be able to search my payment history with GMail. And you forgot things like email address verification - Paypal needs to send emails for that.
Heck, even if they decide not to send emails anymore, then people will still fall for Paypal phishing emails.
Re: (Score:3, Interesting)
Another is "We have sent you a secure message. Log into your account to see it."
The emails are only text, and they never have a link to the bank's website. The two sentences I have quoted above are pretty much the entire contents of the emails.
The bank has trained me that if they have something to tell me, I should go to the site on my own and log into my account like I would for anything else. No
That reminds me.. (Score:3, Insightful)
I know, you're thinking "why don't you just do something about your open front door?" But dammit, I've based my entire security model around having my front door open at all times, and I really can't be bothered to dream up a more secure system than a wide open front door. I'd much rather make it everyone else's problem instead.
Re: (Score:2)
There is no law involved here. They are -asking- ISPs to do this and help both PayPal and the ISP's customers. There is no law. There is no old woman nagging 'Now don't you do that!'
A better analogy: I'm sick of airports letting people carry knives onto airplanes. I want them to scan and prevent people from carrying them onboard.
Re:That reminds me.. (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
That, and the fact that your analogy in no way what so ever fits what they are talking about. It's not a poos analogy, it is a wrong analogy.
Re: (Score:3, Informative)
I'm not sure how this analogy is relevant. Isn't Paypal asking service providers to block Paypal messages that lack signatures? Wouldn't it be more like: if there were fake police officers going through people's houses and stealing things, and in response then the police department asked citizens not to let police officers into their houses unless those police carried some kind of official ID.
It doesn't sound unreasonable to me.
Re: (Score:3, Insightful)
Well, the problem with this, is unless they can get every service provider to block such messages, it's a worthless system.
See, going to all of the ISPs and saying "help us come up with a secure solution that applies only to us" doesn't solve the general problem or phishing and the like. And, any system which is (mostly) a widespread fix for Paypal doesn't cover all of the other ve
Re: (Score:3, Insightful)
My point was, and still is, doing verification on an ISP-level on a one-service-at-a-time basis is a completely worthless system
It's not completely worthless if it stops PayPal phishing. A large percentage of phishing that goes on is pretending to be PayPal or Ebay.
Or you're going to have a whole bunch of individual services all trying to get all of the ISPs to provide authentication for their crap
Not "provide authentication". They're not asking ISPs to devise an authentication service. The service ex
Already is illlegal (Score:3, Insightful)
Time to move past SMTP? (Score:2, Insightful)
Re:Time to move past SMTP? (Score:4, Insightful)
Wait, that can't be possible! (Score:2)
Nobody ever meets the design requirements!
Next you're going to tell me they were on schedule too!
Re: (Score:3, Informative)
From the RFC #2821 (which defiens modern SMTP):
SMTP mail is inherently insecure in that it is feasible for even fairly casual users to negotiate directly with receiving and relaying SMTP servers and create messages that will trick a naive recipient into believing that they came from somewhere else. Constructing such a message so that the "spoofed" behavior cannot be detected by an expert is somewhat more difficult, but not sufficiently so as to be a deterrent to someone who is deter
Nope. SMTP works fine. (Score:2)
Rather than re-working an existing system so it is more "effective" in handling a specific case, why not look at how best to handle that specific case?
We've been over this before with regular banks. You need two different channels to confirm a transaction to make it "safe" enough for the average person. Web and phone is good combination.
Re: (Score:2)
yes, it's going to be very hard to completely replace SMTP, but the longer we wait the harde
#1. Define your requirements. (Score:2)
Not really. It's "fraud". That's all.
Correction: It would not stop the phishing attempts. It could stop the fraud from occurring. And that is the goal, is it not?
Let me give you an example of how to end the f
Re: (Score:2, Insightful)
For every one of these problems, a solution has had to be cobbled together, usually using a large amount of gum, duct tape, and string.
And how long have people been discussing a replacement to SMTP? I remember posts on this sub
I don't get it. (Score:4, Insightful)
Re:I don't get it. (Score:4, Insightful)
Re: (Score:2)
Perhaps, but your average spoofer isn't going to show that URL in the link; it would probably look more like http://security.paypal.com/ [paypal.com] and the average user isn't going to be aware that the source URL for that link is not the same as what's being displayed.
Re: (Score:2)
Re: (Score:2)
This is a hard problem, and requires people to acquire skills that they should already have to begin with. I blame Microsoft for making it 'too easy' for people, and people for letting MS lead them by the hand.
Re:I don't get it. (Score:4, Funny)
(My karma's gonna burn for this...)
Re: (Score:2)
It's not hard, but the fact is, the average user doesn't understand that the path in a link may not go to the place they think it will. The truly web-savvy are knowledgeable but in the minority. What is needed is for email clients to have an option similar to what you see here on Slashdot, where the domain of the link is displayed, although it would need to be expanded to accommodate the intricate URLs spoofer sometimes use. If the average user could see a visual representation of the link, they might be mo
Re: (Score:2, Informative)
Re: (Score:2)
I like this idea (Score:3, Insightful)
All that mail hosts would need to do is verify that the mail was signed by a valid certificate that was issued by the coalition. One certificate to verify against. The coalition can then issue revocation lists as necessary if a member's certificate is ever comprimised.
Seems like an ideal solution to reduce phishing. It could also be used by other organizations who could have their email signed in a similar way, which might allow these messages to bypass spam filters which would benefit the mail hosts.
I think of it as a way to implement a pseudo whitelist, which is by far the best way to ensure that you don't get spam.
KIE2ES: Keep it End-to-End Stupid (Score:2)
I guess I am just old-fashioned eh?
We need "Email 2.0" (Score:2)
But somehow we need to answer the need and perhaps under the premise of protecting financials, there might be some potential for movement. I'm thinking that if a consortium of financial groups got together and decided that from here
Re: (Score:2, Flamebait)
The huge investment in SMTP is irrelevant compared to the huge loss due to fraud. I believe a group of those most concerned should come together to create a solution.
The whole "multiple response" thing intended to illustrate how redundant people's ideas are is really unwelcome and truly reflects on your arrogant personality. Oddly enough, the snottiest of people are generally pretty unhappy with themselves... hope that works out for you eventually.
Re: (Score:2)
How about the client? Are we going to do some base authentication? Who will hold those servers, and why are they trustworthy? How much will it cost to maintain or buy a license (ie, SSL certificates cost mone
Re: (Score:2)
Ultimately, a secure email system that is resistant to spam would have the security built into the open structure, not through obscurity or propriety. There would be means by which sender and servers could be authenticated. Under such a scheme, the receiving server would be able to query the sending authority of
Digital signature is the correct approach (Score:2)
The barrier to acceptance of any signature approach (and there are several) is getting everybody on board, or at least a large enough segment of the user population to make a compelling case for others to follow. Paypal might be that segment, bec
Re: (Score:2)
And once you've defined that, the digital signature becomes nearly moot. If it's in the "looks like Paypal" category but links to something other than paypa
Re: (Score:3, Interesting)
Signed email does, however, eliminate the presently very common and significant type of scam that depends on forging emails from legitimate domains.
Signed email also provides an effective basis for spam control, so I have to disagr
PayPal? What about the parent company, eBay? (Score:2, Informative)
The spam and phishing from PayPal is insignificant compared to the crap I get through eBay should I try to auction or sell off an old computer system. (Next to charity donation, it's the best recycling system I have available) The last 3 auctions I did - it took me 6 weeks to get rid of a Tablet PC because the first auction was terminated by a Nigerian trying to defraud me, the 2nd derailed because of the first's premature termination, a
The funny part (Score:3, Interesting)
Problem is, they are taking advantage of the fact that people like me make up 10% of the total population, the rest fall for it because they don't take the time to be careful.
Good news! (Score:5, Insightful)
I run my own domain, and while I haven't found a good API for checking domain keys yet, one thing I do is check to see if a domain key signature is present in domains that are known to use them -- for example, if a message claims to be from gmail.com or yahoo.com, I just make sure there is a domain key signature header in the message... no need to validate it. Sure a spammer could put a fake signature in, but then it would be block by the major mail providers.
Granted, this is only a short term solution -- I'm hoping that good support for domain keys appears for Exim before too much longer.
I am also using Sender Policy Framework, as one poster suggested, however it does have two significant limitations. The first limitation is that it doesn't work for forwarded account... for example, I use an @acm.org forwarder for some traffic, which means that the host connecting to my mail server is from acm.org, which won't be listed in the SPF entry for iwanttohireyou.com. There have been some proposed methods for re-writing From lines, but it's really not workable. In my case, I know what servers are allowed to forward mail to my domain, and I simply bypass the SPF check in those cases.
The other problem with SPF, that I see more and more, is that most spammers have stopped putting well known domains in their from lines and are instead using garbage domains, which of course do not have SPF entries. If SPF was universal, then the absence of an SPF entry would tell you something, but it isn't, so it doesn't.
Still, between SPF, domain keys, and well monitored RBLs, you can keep spam to a minimum, and I applaud PayPal for trying to get other ISPs to implement these sorts of controls.
-brian
Mail readers need to improve (Score:2)
Date: March 28, 2007 9:36:46 AM EDT
From: admin@paypal.com
Subject: Your PayPal account access is limited.
To:
Reply-To: paypal@paypal.com
Return-Path:
Received: from 10.0.0.2 (ont-static-216.70.173.8.mpowercom.net [216.70.173.8] (may be forged)) by localhost.localdomain (8.12.11.20060308/8.12.11) with SMTP id l2SDfRsJ001136 for ; Wed, 28 Mar 2007 08:41:29 -0500
Received: from by ; Wed, 28 Mar 2007 17:30:46 +0400
Message-Id: >
X-Mailer: Inter
*PGP/GnuPG, anyone? (Score:2)
Email is Stupid (Score:3, Insightful)
I rely on forums and chats for 99% of my useful communications on the internet.
The whole concept of email needs to be redesigned, as others have pointed out.
Paypal should communicate with users through it's site, NOT through email.
Keys are not the answer.. (Score:2, Insightful)
Compounding this problem is the fact that there is NOTHING in place to stop spammers from setting up a SPF record or perhap
Re: (Score:2)
I've been curious as to why providers like gmail and hotmail don't check to see if a message being sent to some threshold n
So why is paypal still *testing*?? (Score:2)
GNUPG (Score:2)
Sounds fair to me (Score:2)
It's always worth checking out when you get a notification that a possibly-fraudulant purchase has been made. In my case I just go directly to paypal in my browser (without using the link in the email) and check my account, but I'd bet a lot of people might get suckered by this one.
Is there a way to enable signatur
they need to 'hard fail all' in their SPF record (Score:3, Informative)
The first thing they should do is change the "~all" to "-all" at the end of their SPF [openspf.org] records.
paypal.com. 3600 IN TXT "spf2.0/pra mx include:s._sid.ebay.com include:m._sid.ebay.com include:p._sid.ebay.com include:c._sid.ebay.com include:spf-2._sid.paypal.com ~all"
paypal.com. 3600 IN TXT "v=spf1 mx include:s._spf.ebay.com include:m._spf.ebay.com include:p._spf.ebay.com include:c._spf.ebay.com include:spf-1.paypal.com ~all"
DomainKeys my A** (Score:2)
DomainKeys (Score:3, Interesting)
Re:How about just block emails from paypal? (Score:5, Funny)
I mean why on earth would a third party have the right to request that I stop recieving my emails.
Re: (Score:3, Interesting)
I run a script that loads their page mercilessly and attempts to log in through their proxy/spoof with random credentials.
It's a practice that's gotten me DOS'd more than once.
But your average joe sixpack is susceptible to these scams, and as such I like what ebay corp. is attempting to do.
-nB
Re:How about just block emails from paypal? (Score:5, Insightful)
Joe Sixpack needs to get off his ass, and actually learn something about the tool (yes its a TOOL, not a toy) he is using to send/receive REAL money to/from other people. If he is too lazy/ignorant/unmotivated to do that, then he will get ripped off, and its not ebay, paypal, or the government's job to protect him from his own stupidity.
Re: (Score:2)
If we consider the shabby level of education received by Joe-6-pack in the American school system, it's doubtful that the poor bastard is familiar with the most basic methods of research. If it ain't on television, he probably hasn't got a clue about it.
Over the decades our socio-economic system has moved in a direction that requires people to be increasingly dependent upon that system for nearly everything --- food, information, health care, appliance and automobile mainten
Re:How about just block emails from paypal? (Score:5, Funny)
They're willing to try. That's why the Dremel tools come with a warning, "This is not a dental tool."
Re: (Score:2)
PBS has some very educational shows out there, but I would postulate that Joe goes "ewwww educational crap" and changes the channel faster than the speed of light. Any research Joe puts forth is likely how to delete the educational channel(s) from the TV's autoscan list (in a fit of irony).
-nB
Re: (Score:3, Insightful)
Re:How about just block emails from paypal? (Score:4, Insightful)
I'm in a position to criticize this education system, having spent 12 years attempting to teach mathematics (including remedial mathematics) to its graduates. I've spoken with the students and their previous instructors, and determined that their public school teachers don't understand the material they "teach". My colleagues who teach history, art, biology, political science, and English say the students do little better in those areas. So yeah, the schools suck --- except when it comes to sports, of course.
You want to accuse "Joe-6-pack" of being stupid then go right ahead, but it's a result of his own choices. Anybody who wants to learn in an American school can still do fairly well.
Here's the rub --- in order to make an informed, rational, intelligent choice you have to be educated. It's a vicious circle: bad decisions lead to
Re:How about just block emails from paypal? (Score:5, Insightful)
I'll tell you a little story. Once I was operating a cash register, and got conned by a change-raising artist. How humiliating. I guess I shouldn't handle cash.
Re: (Score:2, Insightful)
Plus many of the phishing scams are actually becoming rather complex. Many are now linking images directly from the targets website so that they look fairly legitimate and then use tricks like obfuscated javascript for the link to the phishing site itself so that a cursory "put mouse over link and see where it goes" isn't going to be a clear tipoff to joe sixpack.
We've been through this before (Score:3, Interesting)
Today email is being forged for criminal gain. The anti-forgery technology already exists. Paypal is negotiating with their business partners to get it deployed.
We all benefit from closing off easy opportunities for crime. Blaming the victim doesn't work very well in the case of a pharming attack anyway.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Except if you check closely, the messages probably didn't use paypal.com in the envelope sender; they probably only used it in the From header. This means that if the service blocked those messages then anybody agregating multiple email addresses in to one mailbox would see their messages fail at the forwarder.
Re: (Score:2)
My understanding of the article is that using SPF might be considered a valid protection. DomainKeys is the only thing specifically mentioned but the article does say "several technologies". While SPF isn't digital signing, I wouldn't be surprised if it is included in that list. Basically asking providers to use one or more of a variety of technologies to help with the problem.
Except
Re: (Score:2)
Just to make sure I'm
Re: (Score:3, Insightful)
Correct. Its a relatively common occurance: you have everything going to me@myisp.com but you start using me@gmail.com instead so you have your ISP forward everything that goes to me@myisp.com to me@gmail.com.
If that's the case I'm guessing that Ebay/Paypal are just betting on there being a minim
Re: (Score:2)
Re: (Score:2)
"hobbiest" (Score:2)
Re: (Score:3, Informative)
That means every mail server operator, even the home hobbiest, has to subscribe to some third-party authentication service like domain keys.
I'm just a hobbier, not a hobbiest. Of course, public key stuff means you just have to generate a keypair and put the public one in your domain record.
Re: (Score:3, Insightful)
Yes, but no.
Only the mail server operators that want to prevent phishing scams targeting PayPal would have to implement "some third-party authentication."
I understand what you are saying, and coming up with a solution that only solves a very specific problem (or subset or a problem) isn't very efficient. But if the big players like google, yahoo, microsoft all did
Re: (Score:2)
If there was a way to "know" that an email purported to be from paypal, most of these services would already block it due to Paypal's SPF records.
Not true - paypal.com and ebay.com both end their SPF record with "~all" (i.e., "softfail any address not listed"), which won't be bounced by most SPF implementations. Until they change it to "-all" (which they probably do because they're not really sure they've covered all machines that could send legitimate mail for paypal.com), you can not safely bounce imp
Re: (Score:2)
Re: (Score:2)
Paypal only sees anti-fraud benefits if all email uses a third-party authentication service like Domain Keys. Then once the phishing is discovered you can go to the third party and find out who the key belongs to. Phishing theoretically becomes like robbing a bank without a mask: its relativel
Re: (Score:2)
This is not a customer-side solution, so they aren't trusting users with anything.
Do I think it's a good idea or even that it'll happen? Not really. But it's a nice gesture from a company who is usually just c
Re: (Score:2)
Domainkeys don't need support in the MUA -- the MTA can discard messages failing a domainkey check before it even gets to the user.
If Paypal is officially saying "drop all mail from an address @paypal.com that doesn't have a domainkey", I'll be happy to oblige. I'll bet you a stack of gold bars (smuggled out of Nigeria of course) that they have third-party marketers that don'
Re: (Score:2)
You seem to be under the impression that MTA == SMTP server. Their job is to transfer messages: policy regarding transfer (including whether it's transferred at all) is part of the package, and RFC2822 headers have been the province of the MTA from day 1 (Received headers for instance). Some MTAs even speak other protocols.
I do this stuff