{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:2BG7QYSZP5IZVSFDQXUPKXVD7V","short_pith_number":"pith:2BG7QYSZ","canonical_record":{"source":{"id":"2302.07287","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-02-14T19:03:55Z","cross_cats_sorted":[],"title_canon_sha256":"cda05efc93081da99def455e73da9ca19b47f8ade977a8dab9a85d952b49105a","abstract_canon_sha256":"db1a03b0e5bab0f9d9d0e8f2c3bdb0a85eb6704b95d201c817ad74f0026c00a3"},"schema_version":"1.0"},"canonical_sha256":"d04df862597f519ac8a385e8f55ea3fd67eba620ea3dc2c1a3fc580c86123288","source":{"kind":"arxiv","id":"2302.07287","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2302.07287","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"arxiv_version","alias_value":"2302.07287v2","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2302.07287","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_12","alias_value":"2BG7QYSZP5IZ","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_16","alias_value":"2BG7QYSZP5IZVSFD","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_8","alias_value":"2BG7QYSZ","created_at":"2026-07-05T06:02:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:2BG7QYSZP5IZVSFDQXUPKXVD7V","target":"record","payload":{"canonical_record":{"source":{"id":"2302.07287","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-02-14T19:03:55Z","cross_cats_sorted":[],"title_canon_sha256":"cda05efc93081da99def455e73da9ca19b47f8ade977a8dab9a85d952b49105a","abstract_canon_sha256":"db1a03b0e5bab0f9d9d0e8f2c3bdb0a85eb6704b95d201c817ad74f0026c00a3"},"schema_version":"1.0"},"canonical_sha256":"d04df862597f519ac8a385e8f55ea3fd67eba620ea3dc2c1a3fc580c86123288","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T06:02:49.701795Z","signature_b64":"ucFByhOg/0KkVhmlIwn++p3XmCrvzUA2j6vXhLmDMqTCZgZxaQSSTnICgGaJne8Qc0TduNhTcPzte2SyWo1SBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d04df862597f519ac8a385e8f55ea3fd67eba620ea3dc2c1a3fc580c86123288","last_reissued_at":"2026-07-05T06:02:49.701416Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T06:02:49.701416Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2302.07287","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:02:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"acOm9YnkUftdaDuaj1NX+6npm/HPc0hm8XPvnPbK9vCZLf0hWVSzPolH4Pz0UNa7WNqNfHIE89URv9XpPZT/AQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T02:19:30.308962Z"},"content_sha256":"9bd381da4e81e791ebf3949f636ff3315b93f759cedbcbdf88c7ba64c70a12c3","schema_version":"1.0","event_id":"sha256:9bd381da4e81e791ebf3949f636ff3315b93f759cedbcbdf88c7ba64c70a12c3"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:2BG7QYSZP5IZVSFDQXUPKXVD7V","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ariana Mirian, Enze Liu, Gautam Akiwate, Geoffrey M. Voelker, Grant Ho, Mattijs Jonker, Stefan Savage","submitted_at":"2023-02-14T19:03:55Z","abstract_excerpt":"The critical role played by email has led to a range of extension protocols (e.g., SPF, DKIM, DMARC) designed to protect against the spoofing of email sender domains. These protocols are complex as is, but are further complicated by automated email forwarding -- used by individual users to manage multiple accounts and by mailing lists to redistribute messages. In this paper, we explore how such email forwarding and its implementations can break the implicit assumptions in widely deployed anti-spoofing protocols. Using large-scale empirical measurements of 20 email forwarding services (16 leadi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2302.07287","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2302.07287/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T06:02:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QLgKvdmGKDbxMxqg27owBZ/AaA+FqcHZtUqojWIR1O2JhhX6ryVYVGjxSbMuHIzvTusNdmJju6I23kFC++iJAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T02:19:30.309947Z"},"content_sha256":"45dae6f0296c18ef1bd401f6b850172088a8f2876bc7a434c46266bc63de0607","schema_version":"1.0","event_id":"sha256:45dae6f0296c18ef1bd401f6b850172088a8f2876bc7a434c46266bc63de0607"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/bundle.json","state_url":"https://pith.science/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-11T02:19:30Z","links":{"resolver":"https://pith.science/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V","bundle":"https://pith.science/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/bundle.json","state":"https://pith.science/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2BG7QYSZP5IZVSFDQXUPKXVD7V/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:2BG7QYSZP5IZVSFDQXUPKXVD7V","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"db1a03b0e5bab0f9d9d0e8f2c3bdb0a85eb6704b95d201c817ad74f0026c00a3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-02-14T19:03:55Z","title_canon_sha256":"cda05efc93081da99def455e73da9ca19b47f8ade977a8dab9a85d952b49105a"},"schema_version":"1.0","source":{"id":"2302.07287","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2302.07287","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"arxiv_version","alias_value":"2302.07287v2","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2302.07287","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_12","alias_value":"2BG7QYSZP5IZ","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_16","alias_value":"2BG7QYSZP5IZVSFD","created_at":"2026-07-05T06:02:49Z"},{"alias_kind":"pith_short_8","alias_value":"2BG7QYSZ","created_at":"2026-07-05T06:02:49Z"}],"graph_snapshots":[{"event_id":"sha256:45dae6f0296c18ef1bd401f6b850172088a8f2876bc7a434c46266bc63de0607","target":"graph","created_at":"2026-07-05T06:02:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2302.07287/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The critical role played by email has led to a range of extension protocols (e.g., SPF, DKIM, DMARC) designed to protect against the spoofing of email sender domains. These protocols are complex as is, but are further complicated by automated email forwarding -- used by individual users to manage multiple accounts and by mailing lists to redistribute messages. In this paper, we explore how such email forwarding and its implementations can break the implicit assumptions in widely deployed anti-spoofing protocols. Using large-scale empirical measurements of 20 email forwarding services (16 leadi","authors_text":"Ariana Mirian, Enze Liu, Gautam Akiwate, Geoffrey M. Voelker, Grant Ho, Mattijs Jonker, Stefan Savage","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-02-14T19:03:55Z","title":"Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2302.07287","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9bd381da4e81e791ebf3949f636ff3315b93f759cedbcbdf88c7ba64c70a12c3","target":"record","created_at":"2026-07-05T06:02:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"db1a03b0e5bab0f9d9d0e8f2c3bdb0a85eb6704b95d201c817ad74f0026c00a3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-02-14T19:03:55Z","title_canon_sha256":"cda05efc93081da99def455e73da9ca19b47f8ade977a8dab9a85d952b49105a"},"schema_version":"1.0","source":{"id":"2302.07287","kind":"arxiv","version":2}},"canonical_sha256":"d04df862597f519ac8a385e8f55ea3fd67eba620ea3dc2c1a3fc580c86123288","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d04df862597f519ac8a385e8f55ea3fd67eba620ea3dc2c1a3fc580c86123288","first_computed_at":"2026-07-05T06:02:49.701416Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T06:02:49.701416Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ucFByhOg/0KkVhmlIwn++p3XmCrvzUA2j6vXhLmDMqTCZgZxaQSSTnICgGaJne8Qc0TduNhTcPzte2SyWo1SBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T06:02:49.701795Z","signed_message":"canonical_sha256_bytes"},"source_id":"2302.07287","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9bd381da4e81e791ebf3949f636ff3315b93f759cedbcbdf88c7ba64c70a12c3","sha256:45dae6f0296c18ef1bd401f6b850172088a8f2876bc7a434c46266bc63de0607"],"state_sha256":"968645ea809004bdd3e912733d7e7166a5ab78545da697392a7e4c696c913b7a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FPS0OkAWWObGeKQTNpxRmsb+Aat2FZ9Fbn1kevca09BzoB4vfE5ZnqB+aAcSaLGwi2Oia8mxKnNhT01I0MLRDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-11T02:19:30.323233Z","bundle_sha256":"d9918b7bc63739a9ef4c95454c21bc0004328eaee5ff23641cb8f674dcd30b86"}}