At 11:40 PM -0800 3/6/03, Nate W wrote:
> But fundamentally whitelisting fails without authentication.
Fails occasionally, and would be greatly improved without authentication,
It fails occasionally only because whitelisting is not widely used.
Use it widely and the spammers will adapt. I just had to reply to
someone's damn challenge response system on this list. Any spammer
wanting to hit people on this list need only browse the archive,
construct a list of who spoke to whom, and spam away.
but I think it's only a couple good client implementations away from
acceptance by a sizable chunk of the market. As filters go, it works very
well and requires little maintenance.
Given the correct UI I will grant that it requires little maintenance
for individuals who talk to their friends. It requires quite a bit
for individuals who rely on email for their day-to-day business. But
the point is, and I think a large number of people have already made
it on this list, that solutions that require changing the MUA are
less likely to gain acceptance than systems at the MTA level.
How would you propose using strong authentication for the 'reciept from a
merchant' scenario? Or would you?
More interestingly, how do you propose adding authentication to email, in
general?
Of the systems I've seen proposed, I currently lean towards domain
authorization. Is this MTA allowed to send email from this domain?
To that I would add a fallback that says, if not, is this *user*
authorized to send email from this domain? The first is a simple DNS
lookup. The second requires cryptographic tokens. I would combine
that with a public distributed checksum database, fed by the major
ISPs (who must be authorized to join it, and who must meet certain
standards of behavior). I would then argue for a gradual system that
works like this.
1. Initially ISPs only block bulk email that doesn't match the
authorized domain standard.
2. Over time as companies move to protect their domains (and that is
the incentive--protecting yourself from forgery), they can (or
individuals can) block based on domain or personal authentication
even for non-bulk email. Note that at this point there is still no
MUA change required unless you are sending email from a location
other than one authorized by your domain.
I think that meets the necessary requirements of placing changes in
the locations where they are most likely to be made, and providing
for a gradual path to greater and greater security.
What I don't know in that model, is how we deal with malicious ISPs.
At 12:08 AM -0800 3/7/03, Nate W wrote:
If the sender values the message so little that they
won't do something simple to get it through to me, then there's no reason
that I should value it enough to read it.
You missed the point of the original poster. The value of my sending
you a bug report is far greater to you than to me. I can walk away
without losing anything. You lose big.
--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society
I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg