How will DMARC stop phishing?

sspade

It's not often that Facebook, Microsoft, Yahoo, Google, et. al team up to do anything together, but apparently they are going to turn their collective attention to stopping phishing. I just looked at my spam folder, and there were dozen of phishing attempts in there, which is a testament to Gmail's spam filter. Domain-based Message Authentication, Reporting and Conformance, or DMARC is intended to stop phishing to point that attempts never even reach the spam folder, which would be a very good thing. Let's face it, while most of the folks here wouldn't fall for it, there are people every day that open up that message that looks like it is from Paypal or whoever, and gladly send off their account information to criminals. How is DMARC going to stop this, and will the "phishermen" find a way around it anyway?

Topic: Security
Answer this Question

Answers

2 total
jimlynch
Vote Up (20)

I think the jury will be out on this for a while. Hopefully it will help, but spammers are quite clever and might find some way around it. Also, let's face it. Some people are just stupid or careless, so I suspect we'll have till have problems even with this new system. You can't really get rid of this altogether given that a lot of it depends on human judgement and some people have very poor judgement indeed.

Here's more info about DMARC:

http://dmarc.org/

"DMARC - What is it?

DMARC, which stands for "Domain-based Message Authentication, Reporting & Conformance", is a technical specification created by a group of organizations that want to help reduce the potential for email-based abuse by solving a couple of long-standing operational, deployment, and reporting issues related to email authentication protocols.

DMARC standardizes how email receivers perform email authentication using the well-known SPF and DKIM mechanisms. This means that senders will experience consistent authentication results for their messages at AOL, Gmail, Hotmail, Yahoo! and any other email receiver implementing DMARC. We hope this will encourage senders to more broadly authenticate their outbound email which can make email a more reliable way to communicate.

Why is DMARC Important?

With the rise of the social internet and the ubiquity of e-commerce, spammers and phishers have a tremendous financial incentive to compromise user accounts, enabling theft of passwords, bank accounts, credit cards, and more. Email is easy to spoof and criminals have found spoofing to be a proven way to exploit user trust of well-known brands. Simply inserting the logo of a well known brand into an email gives it instant legitimacy with many users.

Users can't tell a real message from a fake one, and large mailbox providers have to make very difficult (and frequently incorrect) choices about which messages to deliver and which ones might harm users. Senders remain largely unaware of problems with their authentication practices because there's no scalable way for them to indicate they want feedback and where it should be sent. Those attempting new SPF and DKIM deployment proceed very slowly and cautiously because the lack of feedback also means they have no good way to monitor progress and debug problems.

DMARC addresses these issues, helping email senders and receivers work together to better secure emails, protecting users and brands from painfully costly abuse.

How Does DMARC Work?

A DMARC policy allows a sender to indicate that their emails are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes - such as junk or reject the message. DMARC removes guesswork from the receiver's handling of these failed messages, limiting or eliminating the user's exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report back to the sender about messages that pass and/or fail DMARC evaluation.

Who Can Use DMARC?

DMARC policies are published in the public Domain Name System (DNS), and available to everyone. It is the goal of DMARC.org to submit the draft specification to the IETF so that it may begin the process of becoming an official Internet Standard RFC - available to everyone for reference, implementation, and improvement."

gusmiles
Vote Up (17)

DMARC has good intentions, but it is human behavior that needs to be addressed and protected against. In today's business world, IT admins need to be more proactive, than reactive. Though DMARC has a lot of proactive traits, more is needed, including proper training and especially, ongoing monitoring.

 

A great company I ran across not too long ago has a very good anti-phishing service; you may want to check out this review and the service: Review of Phishme

 

Gus Miles

Bio / Google+ / LinkedIn

Article: SpyHunter 4 Review

Ask a question

Join Now or Sign In to ask a question.
Ping Identity has picked up another $35 million in venture funding to speed development of the next-generation of its identity and access management technology and expand the company's presence in Europe and Asia-Pacific.
Apple's new passcode-based encryption for the iPhone and iPad can be circumvented and provides only limited protection to data.
Google, Dropbox and the Open Technology Fund are supporting a new organization focused on making open-source security and privacy tools more user-friendly.
Among six major U.S. cities, CSOs are paid the most in San Francisco and New York, but factoring in the cost of living makes Denver and Chicago the best bang-for-the-buck places.
Apple's iOS 8 addresses a serious weakness that could allow attackers to hijack the wireless network authentication of Apple devices and gain access to enterprise networks.
Legislation introduced in the U.S. Senate on Thursday aims to place limits on access by U.S. law enforcement agencies to emails and other communications stored abroad.
Two online advertising networks, Google's DoubleClick and Zedo, have been delivering malicious advertisements that could install malware on a person's computer, according to the security vendor Malwarebytes.
Google is turning on data encryption by default in the next version of Android, a step that mirrors broad moves in the technology industry to ensure better data security.
CloudFlare said it has engineered a novel way to handle sensitive encryption keys that allows organizations such as financial institutions to still use its caching service to fend off cyberattacks.
Samsung on Thursday announced price reductions and updates for its Knox security and management software for IT shops and a free My Knox service that is directly available to professionals using ActiveSync.
randomness