<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Have you thought about how you would manage the logos at scale? It seems like an attacker could substitute a legitimate brand's logo for their own, and still impersonate them, unless the logos themselves were under some sort of review or control, or there
was a trust system being leveraged to determine what brands qualified.</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Olga Gavrylyako <<a href="mailto:olgag@google.com">olgag@google.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, March 27, 2013 2:59 PM<br>
<span style="font-weight:bold">To: </span>"J. Trent Adams" <<a href="mailto:jtrentadams@gmail.com">jtrentadams@gmail.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:display-names@trusteddomain.org">display-names@trusteddomain.org</a>" <<a href="mailto:display-names@trusteddomain.org">display-names@trusteddomain.org</a>>, "<a href="mailto:dcrocker@bbiw.net">dcrocker@bbiw.net</a>"
<<a href="mailto:dcrocker@bbiw.net">dcrocker@bbiw.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [display-names] Initial Thoughts on Display Name Defenses<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">The cases we mostly see in Gmail are
<div><br>
<div><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; ">From: "</span>Legitimate Brand<span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; ">" <</span><a href="mailto:attacker@spoofer.com">attacker@spoofer.com</a><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; ">> </span><br>
</div>
</div>
<div><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; "><br>
</span></div>
<div style=""><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; ">or even worse:</span></div>
<div style=""><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; "><br>
</span></div>
<div style=""><span style="font-size: 12.727272033691406px; font-family: arial, sans-serif; ">From: "</span>Legitimate Brand<span style="font-size: 12.727272033691406px; font-family: arial, sans-serif; ">" <support</span><a href="mailto:attacker@spoofer.com">@looks-like-legitimate-brand.com</a><span style="font-size: 12.727272033691406px; font-family: arial, sans-serif; ">> </span><span style="font-family: arial, sans-serif; font-size: 12.727272033691406px; "><br>
</span></div>
<div style=""><span style="font-size: 12.727272033691406px; font-family: arial, sans-serif; "><br>
</span></div>
<div style=""><span style="font-size: 12.727272033691406px; font-family: arial, sans-serif; ">It is very hard to distinguish automatically and we have tons of rules to filter out these cases.</span></div>
<div style="">If we could have analog of DKIM, but not per domain, but per-brand instead.... And next if the message is signed with brand signature we could surface this in UI adding some Brand logo at the top of the message.</div>
<div style=""><br>
</div>
<div style="">Olga</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Wed, Mar 27, 2013 at 12:22 PM, J. Trent Adams <span dir="ltr">
<<a href="mailto:jtrentadams@gmail.com">jtrentadams@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Dave -<br>
<br>
On 3/27/13 1:17 PM, Dave Crocker wrote:<br>
<div class="im">><br>
> On 3/27/2013 11:18 AM, Michael Adkins wrote:<br>
>> I would rather work on a broader solution than just addresses in the<br>
>> display name.<br>
>><br>
>> Monica suggested something a while back that I think has potential.<br>
>> Basically, don't show the display name unless the From: address is in<br>
>> the<br>
>> user's address book. Prior to DMARC, this wouldn't have been as<br>
>> valuable,<br>
>> but now that we can prevent phishers from using the exact addresses that<br>
>> we legitimately use this becomes a pretty good option to explore.<br>
><br>
</div>
> There are several lines of concern and protection that might be<br>
> considered.<br>
><br>
> The address book heuristic sounds promising, but will cause problems<br>
> for messages from known-but-compromised accounts, for example. This<br>
> just makes "compromised friends" an even more attractive attack vector.<br>
><br>
> Another hack that occurs to me is to define a dmarc-ish enhancement<br>
> that says "our address will never show up in the display name". When<br>
> an email address is in the display name, do a dmarc-ish lookup on it<br>
> and check for this policy...<br>
<br>
Oooo... now that's clever! If it'd be possible to add a flag along<br>
these lines into the DMARC record we're not asking anyone to an<br>
additional lookup, plus it's a sender-side directive vs a global edict.<br>
<br>
Nifty,<br>
Trent<br>
<br>
><br>
> d/<br>
<div class="HOEnZb">
<div class="h5"><br>
--<br>
J. Trent Adams<br>
<br>
Profile: <a href="https://urldefense.proofpoint.com/v1/url?u=http://www.mediaslate.org/jtrentadams/&k=ZVNjlDMF0FElm4dQtryO4A%3D%3D%0A&r=fAk2HhpwqneloqGEFXhAtQ%3D%3D%0A&m=0A4I8r3jiOiOe1QQlLAzMDt4RNtqCBaOc2X2hMcCYzA%3D%0A&s=91488b5a6ee2623e0b65fee7478ddda23a25f3d44caa4792ced512276a58ea23">
http://www.mediaslate.org/jtrentadams/</a><br>
LinkedIN: <a href="https://urldefense.proofpoint.com/v1/url?u=http://www.linkedin.com/in/jtrentadams&k=ZVNjlDMF0FElm4dQtryO4A%3D%3D%0A&r=fAk2HhpwqneloqGEFXhAtQ%3D%3D%0A&m=0A4I8r3jiOiOe1QQlLAzMDt4RNtqCBaOc2X2hMcCYzA%3D%0A&s=404d6fbec92292718468915fa8299e7addd7057fc2ab96b591bcc56f29ed505f">
http://www.linkedin.com/in/jtrentadams</a><br>
Twitter: <a href="https://urldefense.proofpoint.com/v1/url?u=http://twitter.com/jtrentadams&k=ZVNjlDMF0FElm4dQtryO4A%3D%3D%0A&r=fAk2HhpwqneloqGEFXhAtQ%3D%3D%0A&m=0A4I8r3jiOiOe1QQlLAzMDt4RNtqCBaOc2X2hMcCYzA%3D%0A&s=02c843b66d01b98855ae9f78879899a831d5a564fca8e5921f25dd529fed8b02">
http://twitter.com/jtrentadams</a><br>
<br>
_______________________________________________<br>
display-names mailing list<br>
<a href="mailto:display-names@trusteddomain.org">display-names@trusteddomain.org</a><br>
<a href="https://urldefense.proofpoint.com/v1/url?u=http://www.trusteddomain.org/mailman/listinfo/display-names&k=ZVNjlDMF0FElm4dQtryO4A%3D%3D%0A&r=fAk2HhpwqneloqGEFXhAtQ%3D%3D%0A&m=0A4I8r3jiOiOe1QQlLAzMDt4RNtqCBaOc2X2hMcCYzA%3D%0A&s=bad1e472f74898639f1bf9a71fa5298160417e180836c206aab6909627879931">http://www.trusteddomain.org/mailman/listinfo/display-names</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>