On Thu, Mar 01, 2007 at 08:44:21AM -0500, Wietse Venema wrote:
On a friendly internet with only cooperating parties, this might
make sense. But the world has changed. With today's internet it
would be a fundamental mistake to make more distinctions than:
the signature was verified
other
If the verifier gives different treatments to different types of
"other", then the bad guys will exploit the verifier's behavior.
The solution to the problem is not to complicate the protocol, but
to avoid the mistake of giving different treatments to different
types of "other".
+1
--
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | jmacdonald(_at_)e-dialog(_dot_)com
:: 131 Hartwell Ave. | Lexington, MA 02421
:: v: 781-372-1922 | f: 781-863-8118
:: www.e-dialog.com
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html