Gmail uses DomainKeys to lock out eBay phishing attacks

Promises 'dramatic reduction' in scam emails

By John Leyden, 10th July 2008

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

eBay and PayPal have linked up with Gmail to roll out technology designed to block fraudulent emails and phishing attacks.

DomainKeys and DomainKeys Identified Mail (DKIM) email authentication technology is being used to prevent the delivery of bogus messages posing as emails from eBay and PayPal into Gmail users' inboxes.

DomainKeys technology is designed to verify both the DNS domain of an email sender and the integrity of a message. DKIM is an enhanced protocol that also adds aspects of Identified Internet Mail to the mix.

Both approaches are geared to uncover spoofing of source addresses in emails, a tactic commonly used by phishers.

However, there are limitations. If an email messages comes from an eBay or PayPal domain and fails to include a proper signature, then the message will not be delivered. Additionally, PayPal scams that claim to come from other domains may fall though the net.

In a blog posting, PayPal acknowledges the approach is far from perfect but promises Gmail users that it will result in a "dramatic reduction" in the amount of emails which purport to come from PayPal and eBay.

While the use of DomainKeys promises to limit irksome eBay phishing emails, at least for Gmail users, it also has the drawback of creating an additional computational overhead in email delivery. The technology requires the creation of cryptographic checksums for each message processed by an email server.

Yahoo!, which developed the technology, began using it in its webmail service four years ago. Gmail began support around the same time. But integration with third-party services has come more slowly.

Gmail's use of DomainKeys technology to thwart phishing emails, announced this week, comes nine months after a similar agreement between Yahoo!, eBay and PayPal in October 2007. ®

Agentless Backup is Not a Myth

COMMENTS

House Rules Send Corrections

All Reader Comments (25)

Latest Comments

Posted Friday 11th July 2008 20:17 GMT

Olivier

@Kilgaard

> Anything that makes it harder for SPAMMERS to SEND email looks good to me.

Unfortunately DKIM makes it much harder for legitimate senders than for spammers. If hitting spammers means killing email, what is the point? If you follow your point, then we should move from email to proprietary, secured protocols. Exactly the dream Bill had for many years. The challenge against spam is to make it hard for spammers but let legitimate email thru.

>Of course, somebody will probably point out that the CPU costs for bot-spammers > is almost zero anyway because they are just using their zombie hosts CPUs.

Exactly. Cost for spammers is 0. Sending emails via gmail accounts created by hijacked zombie PCs costs 0. And the emails are DKIM / DomainKeys signed from gmail.com! You want to block all emails with a valid DKIM signature for gmail.com domain? It will certainly make it harder for spammers.

Bill because if he had it his way, smtp would not be used anymore.

Posted Friday 11th July 2008 09:55 GMT

David Wiernicki

Nigeria

I've gotten some impressive 419s lately, which instructed me to stop contact with the people in Nigeria who are ripping me off, and only communicate with THEM... gotta give 'em credit for chutzpa!

Posted Friday 11th July 2008 09:55 GMT

Kilgaard

@@ spf (by Olivier)

> The big issue ( imho ) with them are:

> a) implementation costs for sender.

> b) cpu costs for the sender. If you send many emails, it is very expensive in terms of ressource to compute these signatures

Anything that makes it harder for SPAMMERS to SEND email looks good to me. The major cause of spam is that it is just too easy/cheap to send spam. If the protocol causes additional cost (even in terms of cpu load) to the sender of emails then this will greatly impact the profitability of spam sending.

That this cost would have to be carried by legitimate email senders also is unfortunate, but a necessary price to pay.

Of course, somebody will probably point out that the CPU costs for bot-spammers is almost zero anyway because they are just using their zombie hosts CPUs.