BLOG

Authentication and phishing

Yahoo announced today that they are releasing the Yahoo! Mail Anti-Phishing Platform (YMAP) that will help protect their users from phishing. They have a similar project in place for eBay and PayPal mail, but this will extend to a broader range of companies.

[W]e’re beefing up Yahoo! Mail’s SpamGuard by adding more security measures that make it much harder for phishers to get to your mailbox. We’ve teamed up with email authentication partners—namely, Authentication Metrics, eCert, Return Path, and Truedomain—to gain significant coverage to protect the prime targets of phishing attacks.

Phishing is a huge problem. I have an unprotected mailbox and get tens of dozens of phishing emails a day. But until there was a way to validate the sender of an email, rather than just the source IP, there wasn’t a good way to say that a particular email didn’t count.

SPF was one of the first attempts to solve this problem, but it didn’t do it very well. There were a number of very common uses of email that SPF didn’t accommodate.

Despite what the SPF crowd desperately wants to belive, there’s no simple way to tell what mail can legitimately be sent from what IPs. In some cases you can get pretty close, e.g., ESP spam cannon stuff, but even there plenty of people forward other accounts to gmail, which SPF doesn’t handle. — John Levine

Then there came Domain Keys and Identified Mail. Those two specs were close enough to one another that they merged into a single spec, DKIM. For the last few years significant numbers of people have been working to get DKIM stabilized and deployed.  That adoption and deployment lets companies build out products like YAMP and protect users from phishing.

Comment:

Your email address will not be published. Required fields are marked *

  • Vague reports of Yahoo problems

    A number of people, on different forums, have been asking if anyone is seeing a higher bounce rate than usual with Yahoo. Not sure exactly what's going on here. As I understand it, folks are talking with Yahoo about it. If I hear anything more, I'll share. For now, though, if you're seeing a small increase in Yahoo bounces (or other weirdnesses) others are seeing something odd, too.No Comments


  • Responsive design just got easier at Gmail

    Today Gmail announced they are supporting media queries in Gmail and Google Inbox. This should simplify the creation of emails for multiple platforms. The full list of supported rules can be found on the Google Developer Site.No Comments


  • Brief blogging break

    Sorry about the unexpected hiatus. I picked up a cold that really made me feel fuzzy and writing was an exercise in futility. I'll be back Monday. Meanwhile, Oracle bought another ESP (Bronto) when they bought NetSuite.  No Comments


Archives