On Thursday 20 March 2003 22:03, Hallam-Baker, Phillip wrote:
None was big help at this point and
none (except
verisign, though presentation was still one-sided towards
S/MIME) tried to
see what else similar is available that may not be commercial
and may do
the same.
Actually if I had had a little more time it would probably have been
rather clearer that I was proposing a range of authentication
options, starting with the free ones albiet with certain possible
counter-strategies.
S/MIME is clearly an authentication option and the most flexible for
this particular application (PGP is a close second but there is a
conflict in that the PGP security model is strictly endpoint based
and hence does not immediately map to a service MTA gateway
deployment unless a validation service like XKMS is interjected).
However S/MIME is also the most expensive to deploy - whether you
issue your own certificates or pay a CA since you need a cert for
every end user which is expensive to manage, far more expensive than
an SSL cert.
No, you don't. All you need is a promise from the "sumitting" MTA (the
MTA that speaks to the senders MUA) that it has used SOME form of
authentication to verif the user is who he says he is.
This has been the crux of the problem all along, and one of the reasons
why I am completely unsympathetic to the cries of the large ISPs that
they are being inundated by spam. The spam problem is caused by ISPs
who allow mail to enter the network without sender authentication. If
all ISPs required sender authentication, we wouldn't have this problem.
So here's the simplified version: the submitting MTA "signs" the message
in some way verifying that it can and will, at the very least, disable
the end user account associated with the sender if that sender abuses
the network. This signature is verifiable and has an abuse coordinator
associated with it.
The final MTA (the MTA that communicates with the recipients MUA)
decides if the recipient will receive mail from the verified sender.
The only "authentication" strategy I think is bogus is using the
reverse DNS.
Agreed, it's not strong enough to be useful.
--
"Where am I, and what am I doing in this handbasket?"
Wes Peters Sr. Software Engineer
wpeters(_at_)stbernard(_dot_)com St. Bernard
Software
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg