tric
Joined 3 years ago
Karma
545
Submissions
57
Member since
Mar 26
Recent submissions
Comment · 3 years ago
Comment · 3 years ago
Your domain may have a policy of reject or quarantine, but does the receiving host correctly act on that policy?
I can understand if free email providers are more permissive with narrow authentication scenarios. Users aren't usually able to contact support.
As someone suggested in this thread, this is a UX problem.
Policies need to appease a large number of users. A gov/corp org receiving these messages can be more strict. Even in these orgs, people complain about not receiving an email that was appropriately rejected.
Comment · 3 years ago
> the DMARC offenders are primarily at the state, county, and local level.
This has been my experience as well. Likely due to their systems being managed by lowest-bidder MSPs.
Someone once shared their own analysis of each state's configuration a few years ago:
https://old.reddit.com/r/sysadmin/comments/cawch1/united_sta...
I wonder how it looks today.
Comment · 3 years ago
The diagram demonstrating the attack shows DMARC fails. All they have shown is that everyone should have DMARC configured properly, and use a reject or quarantine policy. This has been best practice for a long time now.
They use the example of state.gov. That domain's policy is currently set to Reject, which is what all Federal government services have been using for years now.
Here's CISA's requirements: https://www.cisa.gov/news-events/directives/bod-18-01-enhanc...
Microsoft also uses their own auth mechanism in addition to DMARC. It's called composite authentication. In my experience, comp-auth is more strict than DMARC alone.
https://learn.microsoft.com/en-us/microsoft-365/security/off...
What am I missing? Why is this noteworthy?
EDIT:
After reading more of the paper, my conclusion is mentioned in a later reply:
"They are demonstrating a problem with managed providers, and their opinionated configuration. You give up a lot of control as an admin when you use 365 as your front-end. This further proves that. "
Comment · 3 years ago
The problem is with linking the account/activity with your identity.
HN can only use less reliable identifiers (eg GeoIP) to link my account to other data. A phone number (potentially) connects me to more data about me.
Comment · 3 years ago
It's always surprising to see how willing people are to give up their phone number to use an app. It's not just Meta products. Telegram & ChatGPT too.
I'm afraid more services will go in this direction.
Comment · 3 years ago
> I'm surprised there isn't some way for gamers to rent out use of their GPU's when idle.
"The Render Network® Provides Near Unlimited Decentralized GPU Computing Power For Next Generation 3D Content Creation."
"Render Network's system can be broken down into 2 main roles: Creators and Node Operators. Here's a handy guide to figure out where you might fit in on the Render Network:
Maybe you're a hardware enthusiast with GPUs to spare, or maybe you're a cryptocurrency guru with a passing interest in VFX. If you've got GPUs that are sitting idle at any time, you're a potential Node Operator who can use that GPU downtime to earn RNDR."
Comment · 3 years ago
> wouldn't it be a duopoly considering that AMD is also a big player?
I don't think GPUs are commoditized. You can't swap a Nvida GPU with a AMD GPU, and get the same performance/results.
Comment · 3 years ago
> people used to get around without driving
Believe it or not, they still do.
Comment · 3 years ago
> Geez, TikTok (basically) content on HN...
The aggression, quick cuts, single word subtitles...
I don't understand the appeal of this style. I wonder how people will look back at this era of video editing in 10 years.
This is not true. The paper mentions multiple service providers using more relaxed validation.
Table 3, section 5 in the paper shows which policies need to be in place on the domain they are piggy-backing on.
They reference Postfix:
"Additionally, we note that mailing list software such as Listserv and Mailman require a backend MTA. In our experiments we used Postfix with DMARC turned on, a configuration which follows good security practice. However, in practice many organizations might not use this configuration because many MTAs (including Postfix) do not enforce DMARC by default. In these cases, the attacker can spoof email from any target domain, regard- less of its DMARC policy, much like the attack against Gaggle."
I read this to mean that if you actually enable DMARC in Postfix, piggy-backing on another domain's policies results in rejection.
No mention of results for receiving at ProofPoint, Mimecast, Trellix, or Cisco's email appliance.
> This is not a UX problem.
They are demonstrating a problem with managed providers, and their opinionated configuration. You give up a lot of control as an admin when you use 365 as your front-end. This further proves that.