Re: [ietf-dkim] Notes from DKIM jabber meeting on 20 April 2006

(Thanks to you, John, Hector, and the others for helping.  I think I 
understand a little better where you are going, now.  I'll let you know 
when I know everything and have solved all the world's problems.)
Eliot Lear wrote:
> Sandy Wills wrote:
>
> I love analogies, so let's extend this one a bit.  If her daughter
> received thousands upon thousands of pieces of junk mail, some of which
> used fake postmarks to gain attention, others of which use her
> grandmothers' name, how would her daughter even know that the letter was
> real or worth her time?  If someone thought she would open it, then
> they'd mimic that behavior as best they could so that their junk could
> get read.
Well, yeah, that's the reason that the WG was formed - to build one of 
the links in a chain of verifiability.  65 years ago, a letter cost too 
much for undirected mass mailings.  I'm willing to pay a penny a post 
for email, (maybe it could pay for IETF meetings?), if it means that 
spam is no longer economically viable.  Again, what you guys are trying 
to do is a necessary step in _that_ direction, too.  Something to think 
about, if you have religious problems with making all people pay for email.
> On the other hand, I think only experience is going to dictate good
> practice here.  I doubt I would want to yank my keys for a message only
> seven days after transit.  I suspect I'd want people to be able to
> verify my messages for several months, if possible.
   That makes sense.  If you post a message today, it should be 
verifiable for several months, at least.  Years would be nice, if key 
storage isn't a problem (Don't think so, as data storage costs seem 
determined to keep going down.  If that trend is linear, the HD 
companies will be paying me to take their drives, in a couple of years).
   At the same time, the key should also expire such that _new_ mail 
should not use it after [some as-yet-undetermined time].  The "Best if 
used by" milk carton analogy (credit to whoever that was, sorry!) seems 
to fit very well, to me, although it's more like "We put a time-release 
poison in this stuff.  REALLY don't drink it after this date."  Which 
way it goes depends upon how painful key generation and propagation are, 
I guess.
--
Unable to locate coffee.
Operator halted.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html