On Nov 17, 2005, at 1:12 PM, Hector Santos wrote:
Doug,
It will be helpful to be distinctive and to distinguish which
policies in
DKIM/SSP you are concern about:
All but Never and None. : )
Please don't misunderstand, DKIM offers a tremendous advantage, but
reliance upon a domain being visually unique may have been considered
okay a decade ago. The naive user requires greater assistance.
Don't expect them to discern when they are seeing the pretty-name,
various character set(s) declared from a RFC2047 format, a particular
character-set derived from puny-code RFC3492, or perhaps worse, the
puny-code itself. : 0
So it would be extremely helpful if you can describe the threats
and impact
per SSP in itemized format, without injecting a grandiose thesis
alternative
solution and preferably in the format described by Jim Fenton and
Stephen
Farrell.
Do you understand the concern just expressed?
Here is some highlights for an alternative approach that does not
expect the recipient to have such keen insight into the display
mechanism employed by their application. Please note that with the
DKIM base mechanism in place, these protections could be added
immediately.
http://www.sonic.net/~dougotis/id/draft-otis-dkim-
threats-01.html#anchor32
11.3 Opportunistic Protection without Domain-wide Policy Assertions
http://www.sonic.net/~dougotis/id/draft-otis-mass-
reputation-03.html#anchor9
9. Binding Identifiers
-Doug
_______________________________________________
ietf-dkim mailing list
http://dkim.org