On Tue, 5 Oct 2004, Jim Fenton wrote:
Again it goes back to the semantics of the signature. If I have to
prove who I am, in addition to showing that I'm authorized to send the
message, perhaps by way of a signed certificate, I think that works
against anonymity, and IMO isn't really necessary for the job we're
trying to do.
There's little difference between per-user and per-domain keys from an
anonymity point of view[1]: in either case a warrant can be served on the
domain's admins to get hold of information about the person behind the
email address. The degree to which you are anonymous is the degree to
which it is guaranteed by your service provider, so I don't think we need
to worry about it very much at a technical level.
[1] I'm assuming that keys are issued by the domain rather than by a
trusted third party -- TTPs are too heavy-weight for what we are trying
to achieve.
Tony.
--
f.a.n.finch <dot(_at_)dotat(_dot_)at> http://dotat.at/
THE MULL OF GALLOWAY TO MULL OF KINTYRE INCLUDING THE FIRTH OF CLYDE AND THE
NORTH CHANNEL: WEST VEERING NORTHWEST 5 TO 7, DECREASING 4 DURING THURSDAY.
SHOWERS. MAINLY GOOD. MODERATE OR ROUGH, BECOMING SLIGHT OR MODERATE IN THE
FIRTH OF CLYDE.