ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] DKIM SSP: Security vulnerability when SSP record does not exist?

2005-08-20 09:53:11
Dave Crocker wrote:
On 19 Aug 2005 16:14:06 -0000, John Levine wrote:

A third-party signature is a lot weaker assertion than an OA signature,
unless you know something about the third party.

Seems to me that no signature is useful unless you know something about the
signing party.


That nicely summarizes the problem I have with the fixation of *requiring* a tie-in to the origination domain.

Oddly enough I haven't noticed anyone suggesting that the signing entity must be required to be tied to the orgination domain.

What I have seen is a number of people suggesting that the marginal utility of having a mechanism to *allow* a tie-in to the origination domain is quite substantial, relatively easy to achieve, and a big boost to incentives for domain owners to deploy DKIM.

I'm sure it won't surprise anyone that I find the resistance to this simple concept extremely surprising and difficult to fathom.

Scott Kitterman
_______________________________________________
ietf-dkim mailing list
http://dkim.org

<Prev in Thread] Current Thread [Next in Thread>