ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] DKIM SSP: Security vulnerability when SSP record does not exist?

2005-08-22 08:36:08
I really don't have an opinion on your revocation identifier idea. I thought we were discussing scope of the WG effort rather than the design of the product.

I also think that we are pretty much going in circles at this point.

To summarize, you think that SSP is dangerous, won't do what it's proponents claim, and can't be fixed. Thus SSP and it's ilk shouldn't be dealt with by the working group. You believe that there are other, better ways to solve whatever problem it is that you are trying to solve.

I, and I believe others, think that SSP is essential and that while DKIM signatures alone may have some value, the marginal utility for DKIM absent some expression of sender policy is low.

Personally, I don't think we want to build a base spec that requires the SSP work to finish concurrently. I don't think it's necessary. What I think we absolutely need to avoid is a charter that just does that base and defers SSP to some future effort. The charter needs to include both.

Scott Kitterman
_______________________________________________
ietf-dkim mailing list
http://dkim.org

<Prev in Thread] Current Thread [Next in Thread>