On August 13, 2005 at 15:20, Keith Moore wrote:
If then only bad actors we were concerned about were phishers then I'd
agree. When we include spammers in the set of bad actors then the
situation becomes less clear. Making it slightly more difficult for
current bad actors to spam might well make spam considerably more
attractive for a much larger group of bad actors who don't mind
authenticating their spam.
When you state, "Making it slightly more difficult for current bad
actors to spam," I think it should be qualified further to state,
"making it more difficult for bad actors to spam in a certain way."
Forgery is just one method spammers use.
Yes, an authentication scheme does not prevent spammers from
authenticating there own messages. However, does formal authentication
provide spammers with extra value? They can send out messages now
without attempting to hide their identities. Therefore, a specific
question is, "If strong authentication systems are deployed to address
forgery, will this lead to an increase in spam?"
For this to be yes, the existence of an authentication system must
somehow increase the value in spamming. I'm not sure if a definitive
answer can be given without analyzing the proposals provided.
One possible way an authentication system may be a benefit to
spammers is if valid authentication status is given positive weight in
determining if a message is spam or not. Authentication itself can
serve to validate the identity of the sender, but it cannot be used
(by itself) to determine if a message is undesirable.
I think there will be a natural tendency for adopters of an
authentication system to give an initial positive weight to (valid)
signed message. Therefore, spammers will have motivation to sign
their messages to take advantage of this.
I don't think reputation services will help
much for several reasons.
It may help to note that authentication and reputation (and
accreditation) are different things. Authentication does have some
value, but by itself, it should not imply any form of reputation
(positive or negative).
--ewh
_______________________________________________
ietf-dkim mailing list
ietf-dkim(_at_)mipassoc(_dot_)org
http://mipassoc.org/mailman/listinfo/ietf-dkim