It's time to presume the web is guilty

Whitelists, authentication

The snag with whitelists is that they assume you know who you want to be in contact with, whether it is for email, P2P or anything else. Of course, that is typically not the case. The whole point of the Internet for most users is the freedom to communicate with any other user, regardless of their location and whether or not you know them.

The idea of authentication mechanisms run by government bodies might appeal to the governments themselves but probably not to many of their citizens. Didn't the last UK government have some idea of organising everyone's keys for email authentication and encryption? I seem to remember this idea was about as popular as a fart in a spacesuit.

A step (or more) backwards)

There are some vital points missing from the above article. The approach suggested - of having centrally managed white-lists, approval procedures and overseeing bodies is nothing new. It is actually how society has pretty much been organised for hundreds of years. One would need approval from several regulatory bodies to start a business, a radio, to get married, to buy a house, to build a house and so on. The whole point of the Internet was its revolutionary approach, it's lack of red tape, the ease with which, with low resources, one could get done almost anything, - is fragmented structure - which resulted in great freedom to innovate, but also amazing efficiency at extremely low costs. Turning back the pages of history and modeling the Internet on the patterns of real world might just reduce the security threats, but it will also remove the main advantages of Internet - it will effectively eliminate what the Internet has become to all of us.

When suggesting things such as dns white-lists, email domains white-lists, peer-to-peer white-lists which cover the Internet globally (otherwise it wouldn't make much sense), it is worth taking back one step and glancing at the scale of it all. The bureaucracy and organisational complexity of such a system would be overwhelming. What about all the departments involved, including disputes resolution, legal departments? Somebody will have to carefully analyse the case for each domain that is bumped off - otherwise justice will not be served. Somebody will have to investigate each claim and counter-claim. What about complying with laws? In some countries the activity of certain domains would be legal, while in others it would be illegal. Would that imply separate white-lists for each country? Then, which countries are going to be allowed at the discussion table - there will be the need for another department and committee to decide who are the friendly and unfriendly nations. Then you will need another department on top of that, to deal with the necessary PR effort, when you will get attacked from all directions by lobby groups, for various industries, for human rights, for animal rights etc. Any domain that is banned can potentially attract public and corporate pressure.

Well, you can see how it could all go on an on. And somebody would have to fund it. The reason why the Internet foundations have to a certain extent very little security built into them is to a great extent also what made the Internet so successful all the way since it went public - it's focus on utility, simplicity and efficiency. An extremely resilient, amazingly flexible and cheap (compared to most other options) environment for connecting people and resources.

Nice idea

But there are also major problems inherent with this setup

Lets say i have a company that relies on Email 100%

The only way for a spammer to get spam out is to use a domain on said whitelist

They steal the domain or attack the computers in offices. now they have also been comprimised and the hackers/spammers would also try and appropriate any email lists of legitimate company

Then legitimate company is knocked off whitelist for spamming and now cannot do business and looses X amount of money.

Scenario 2

Get newsletter from Comapny A

click spam cause i cant be fucked to go throug their unsubscribe option (normally hidden) and said company gets blacklisted because people are lazy.

off his rocker

There is nobody fit to certify who is real, trustworthy or likely to leave their credentials lying about for abuse.

His central control would give only the illusion of safety.

http://www.freedom-to-tinker.com/blog/felten/mozilla-debates-whether-trust-chinese-ca

http://yro.slashdot.org/story/10/08/14/0012254/EFF-Asks-Verizon-Whether-Etisalat-Deserves-CA-Trust?from=rss

Right now these sorts of decisions don't need to be delegated to government, but we can each choose. I can accept mozilla's set of CA's (or not) as I choose.

The guy complains at the failure of non-governments to mitigate the threats - nonsense; they have been. He is really stating that the threats have not been mitigated to an arbitrary non-specified level - but thats a claim that can always be made and can't be used to demand any specific degree of intervention.

This statement is meaningless:

"Basic protocols such as email don’t inherently contain a way to verify that the sender is legitimate. "

The legitimacy of a sender is subjective to the recipient; this guy is just disappointed because the system doesn't do what he thought it did all these years (because it's impossible) and so now wants all pharoah's magicians (I mean government technology advisers) to make it work ho he thought it did.

The guy just pushes back the problem further from the people who need the solution:

"The day has come to start building confidence ranking into the DNS system itself. "

We need to start building confidence rankings of the confidence rankers - but wait - we already have that! I can use blacklists - or not - as I see fit. I can use different DNS roots if I see fit. I don't need someone to publish their measure of my confidence.

However signed identities with whitelists is a good idea

http://www.liddicott.com/~sam/120494/

but it can't be forced.

But ....

splendid though the ideals represented in your article are, I can't help feeling, (being an eternal pessimist), that such "Whitelists" would eventually become subject to abuse themselves and start to turn grey, as it were. You might be able to clean all the bad apples out of the barrel, but then some of the good apples that are left could turn bad. The White List idea could have considerable value attached to it and that in it's self will be enough to attract the attention of some bad apples looking for a new home.

It's all comes down to trust and human nature I guess.

Whitelisting is all well and good

but all that will happen is the miscreants will make compromising them their highest priority, and then we're back to square one

@SImon Hobson

> other anti-spam suggestions like SPF

SPF is *NOT* an anti-spam measure. It is an anti-forgery measure.

The correlation of forged emails to spam means that there is usually a coincidental reduction in spam when SPF filtering is intrioduced - but that is not the purpose of the technology, and making claims about how effective SPF is at stopping spam merely demonstrates a lack of understanding.

> If I register my one outbound mail server for mail from my domain, then what about mail I send via mailing lists

If you - as the domain owner - make a positive statement that any mail not sent from your server is a forgery, then any recipient receiving mail allegedly from your domain but not from your server can only go by the statement you have made - that it is a forgery.

There are many ways to permit sending mail through other servers, but you can hardly blame recipients for taking you at your word. If you don't mean it - don't say it.

I begin to wonder how many folks finish articles before commenting.

I’m guilty of it myself sometimes: jumping straight into the comments section without really being thorough on the reading part. There are a couple of things I’d like to point out to all the folks who are Heap Big Angry at the ideas in the article.

The first is that I in no way believed that whitelists should be /mandatory/. I think that they should be something that folks have the choice of opting into or not, as they see fit.

The second is that in some situations whitelists really do make sense. A great example being business internet usage. Businesses have very little reason to communicate with a lot of the dangerous, offensive or even borderline offensive sites out there. A global whitelist or five, run by companies who take the time to hunt down and verify the businesses behind the websites would go a long way towards separating the signal from the noise.

The third thing I’d like to bring to everyone’s attention is that this is not a suggestion as “the ultimate solution,” but rather as a replacement for the blacklists of domains currently used as part of any proper defense in depth. Yes, whitelisted sites can be compromised, (see Apple,) but that is where the other elements of your defense in depth are (hopefully) going to save you.

The goal is to minimize your exposure to compromised sites by only dealing with websites that meet whatever arbitrary standard defines the whitelist to which you are subscribing. In my perfect world, there would be several whitelist providers, all with different standards in order to meet the differing needs of the corporations and individuals who would like to subscribe to them.

Lastly, I’d like to talk about the censorship bit. Properly run, with very stringent standards set outright at the creation of the whitelist, and rigidly adhered to, it should be possible for anyone who feels they have been improperly left off of a whitelist to add themselves. If the whitelist explicitly states that they will not be adding porn sites to the list, then I am sure Bob’s BDSM website isn’t going to get on the list. That new toilet paper cleaning company trying to make a name for itself probably could get verified and added to the list.

Despite the anger, the beginnings of this process already exist. There are initiatives out there to certify websites, from various categories of /very/ thoroughly checked SSL certificates to “site seals” provided by various organizations who do the hard work of verifying the legal existence of the individuals or corporations behind the registration and operation of a domain.

Where this falls down is that firstly, no big push has been made to increase the number of websites participating in these ventures; very few sites are part of such programmers today.

Secondly, there is no way (currently) through either a browser plugin or firewall addition to limit yourself to viewing only websites which have passed muster at one of these verification organizations.

What I would like to see corporately is exactly that: if your website has passed muster with selected “site seal” checking organizations, we’ll let our users view it. If not, we’ll dump the user on a landing page that says “the website you want to view has not been certified and is potentially malicious.” It would then allow the user to click through, but would by default disable all scripts etc. from that domain.

Easy, pain-free browsing whereby we generally “trust” certified websites, and many warnings and default total distrust of websites that haven’t been checked out. Think of it sort of like noscript meets web of trust meets malwaredomains.com implemented as an opt-in right from the corporate firewall.

I am sure that looks like censorship to some, but don’t forget that censorship is something forced on people. What I am suggesting is not

Freedom through guilt?

I don't agree with lumping corporate interests in with mine. It also looks to me like the author is using a completely different internet than I've come to know.

"The security defenses available to us are clumsy and inadequate."

What are you talking about? I've been using the client side of the internet since the beginning and I'm not having any problems with security. You must be doing something wrong and assuming that other people are too. Email works just fine. I have several different mail services and the amount of spam I get is almost unmeasurable - and thanks to the professional server management which we've come to expect nowadays, I get all my mail too. I can only assume that someone who has a problem with spam either runs their own amateur server or made a particularly bad choice of service provider. Yes spam is a huge percentage of e-mail traffic, but it is not a huge amount of bandwidth. It is just not a problem any more. As for security; one does not have to be a professional to run a secure computer nowadays, even with MS-Windows, but if you're having a problem, why not find an easier to manage OS while you still have the freedom.

"If we, as corporations and individuals, want the internet to remain free and open as it is today, then we have to solve these problems before the governments of the world try to do it for us."

I agree that it would be bad to have too much government interference, but you make a mistake in lumping together corporations and individuals. Corporate and government interests are similar, and both counter the freedom of the individual. There are not a lot of problems that need to be solved as far as internet freedom for the individual is concerned. However, I agree that there is indeed a threat of governments and corporations from taking away the freedom that the individual has now.

"It could be that the only to preserve the freedom of the internet is to do away with the presumption of innocence."

No it couldn't be. That way of thinking has been tried many times by governments in the past. It has always ended in disaster. Let's not go there.

Until someone hacks your whitelists.

Whatever idea you come up with, someone comes up with a counter plan, that will foil it completely.

Maybe we should stop trying to control the uncontrollable. Internet is like the weather, it follows chaos theory. My guess is that at any point a process becomes so complex it crosses the threshold and becomes a chaos system. Internet has long passed that threshold.

Unworkable and dangerous

Ok, so the worldwide top 500 companies decide to fork out $1m each, and establish a list that they maintain and make available for all to use.

Maybe. Far stretched but why not.... The upside is that it is a private list and private list maintainers don't have to justify themselves to anyone.

That's the only way I could see this taking off.

Any public (aka government) or commercial (aka Norton & co) list would be open to errors, complaints, appeals, suits, etc, so that wouldn't work.

Even this hypothesis is open to abuse: why are www.bhopaltruths.org and www.thebigpetroleumcon.net not accessible? or: yes Mr Bush, we'll see that www.iraqtruths.org is taken care of.

The biggest threat however is of course goverment taking over the idea (for everyone's good obviously, ask the aussies) and censoring away. If something can go wrong, it will, and this is decuply likelier with any technology that has a big-brother potential.

We have whitelists now

They are built into browsers now, and the entries are called certificate authorities and certificates.

Hands up - how many have looked at the list recently? How is that working out?