You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2007/03/13 14:25:36 UTC
[Bug 5378] New: add rules to block unsigned eBay/Paypal mail
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
Summary: add rules to block unsigned eBay/Paypal mail
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Platform: Other
OS/Version: other
Status: NEW
Severity: minor
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: jm@jmason.org
through the grapevine, I hear that the CEO of eBay says that unsigned mail from
eBay, Paypal should now be blocked - 'the firms are urging major e-mail and
Internet service providers to allow only those e-mails [from eBay and PayPal
which are signed using Domain Keys] to pass through their systems.'
http://news.com.com/2100-7349_3-6165628.html
There's no sign of this on their website, but... why not ;) let's add a rule
to do this.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|Undefined |3.3.0
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
gfk@logidac.com changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gfk@logidac.com
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
------- Additional Comments From jm@jmason.org 2007-11-21 02:28 -------
this is finally implemented on the Paypal/eBay side, and ready to go:
https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/securitycenter/general/EmailAuthenticationFAQ-outside
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
------- Additional Comments From jm@jmason.org 2008-01-02 14:54 -------
(In reply to comment #2)
> So I think that they should remove the t=y tag before we start scoring
unsigned messages from them.
it seems these are still present:
exit=0 Wed Jan 2 22:27:01 GMT 2008; cd /home/jm/ftp/spamassassin
: jm 315...; host -t txt _domainkey.paypal.com
_domainkey.paypal.com descriptive text "t=y\; o=~"
: exit=0 Wed Jan 2 22:41:16 GMT 2008; cd /home/jm/ftp/spamassassin
: jm 316...; host -t txt dkim._domainkey.paypal.com
dkim._domainkey.paypal.com descriptive text "v=DKIM1\; k=rsa\; t=y\;
p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD3j+gKW1qBM+psRHXAdR7tI9QcKW0Ii723AzyTO4nrVmuJoKWHLoEEQw/Nc4XF7iyhfadorjqZZ9f+qDXQiKPyLJyVXs0qLrnJQ9BWlQP0xIiz7CTcoHwEhJ1XwgUI/2V6bNghMrnK2yiR/Vqt5lV5kx4+n1656EefGuOTuNmIWwIDAQAB"
I guess someone's forgotten to remove them ;)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
------- Additional Comments From gfk@logidac.com 2007-03-29 16:23 -------
While I'm very favorable to rejeting messages from paypal/ebay that aren't signed, they haven't updated
their DNS records to indicate that they're out of the "test mode":
[powerbook:~] gfk% host -t txt _domainkey.paypal.com
_domainkey.paypal.com text "t=y\; o=~"
[powerbook:~] gfk% host -t txt dkim._domainkey.paypal.com
dkim._domainkey.paypal.com text "v=DKIM1\; k=rsa\; t=y\;
p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD3j+gKW1qBM+psRHXAdR7tI9QcKW0Ii723AzyTO
4nrVmuJoKWHLoEEQw/
Nc4XF7iyhfadorjqZZ9f+qDXQiKPyLJyVXs0qLrnJQ9BWlQP0xIiz7CTcoHwEhJ1XwgUI/2V6bNghMrnK2yiR/
Vqt5lV5kx4+n1656EefGuOTuNmIWwIDAQAB"
>From draft-delany-domainkeys-base-02.txt, section 3.2.3:
t = a set of flags that define boolean attributes. Valid
attributes are:
y = testing mode. This domain is testing DomainKeys and
unverified email MUST NOT be treated differently from
verified email. Recipient systems MAY wish to track
testing mode results to assist the sender.)
This tag is optional.
So I think that they should remove the t=y tag before we start scoring unsigned messages from them.
Also, there's already a DomainKeys plugin (Mail::SpamAssassin::Plugin::DomainKeys) so it might not be
too hard to implement.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5378] add rules to block unsigned eBay/Paypal mail
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5378
------- Additional Comments From owenc@hubris.net 2007-03-29 15:45 -------
(In reply to comment #0)
> through the grapevine, I hear that the CEO of eBay says that unsigned mail from
> eBay, Paypal should now be blocked - 'the firms are urging major e-mail and
> Internet service providers to allow only those e-mails [from eBay and PayPal
> which are signed using Domain Keys] to pass through their systems.'
>
> http://news.com.com/2100-7349_3-6165628.html
>
> There's no sign of this on their website, but... why not ;) let's add a rule
> to do this.
It may not be on their website yet but there have been quite a few followups to this story that suggest it
is true:
http://www.networkworld.com/news/2007/032707-paypal-asking-e-mail-services-to.html
I agree this would be an excellent set of rules.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.