CAcert Code Development list.

[Mario Lipinski <mario AT cacert.org>]

Hi developers,

working on the above mentioned arbitration I came about the topic how to
handle abuse of the CAcert systems in regard of adding domain/email
addresses. This means a user adding a domain or email address he is not
authorized to add and the ping test is subject to fail.

Questions about current status: The support team only has access to
information about domains/email addresses for which the period to answer
the ping has not expired. Are these kept for a longer time in the
database? When are they deleted? What is deleted?

During the arbitration I drew up the following:

Thinking about this more generally, from arbitration point of view, the
process of adding domains (and email addresses) has to be more
auditable. Software team is encouraged to provide input on current
implementation or development efforts to rethink the procedure described
here. Each automatic mail sent out has to contain an unique identifier
by subject and sender/return address. So if a mail is returned CAcert
itself can identify: what domain/email, what account, when a possible
abuse was tried to be commited. Depending on the volume this handling
can be done by support or has to be automated. This also requires a log
of the ping mail actions to be kept to identify abuse. The domain/email
address additions/verifications for me require auditing functionality to
identify abuse and so to protect CAcert from abuse in the long term.


Another thought: When sending this mail out it should contain more
information about reporting abuse (for recipients who do not have added
the domain themselves). Also the web page which opens when the link is
clicked should be more explaining.

-- 
Mit freundlichen Grüßen / Best regards

Mario Lipinski
Board member,                       E-Mail: 
mario AT cacert.org
Organisation Assurer (Germany),     Internet: http://www.cacert.org
Wiki/Issue admin
CAcert

Support CAcert: http://www.cacert.org/index.php?id=13
                http://wiki.cacert.org/wiki/HelpingCAcert

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature