On Fri, 2005-02-11 at 10:00 -0500, Andrew Newton wrote:
On Feb 11, 2005, at 9:03 AM, Michael Thomas wrote:
One has to remember that MASS is primarily a mechanism to prevent
forgery, and secondarily a way to enable reputation.
That's makes what you said a lot clearer to me. And it is a good point.
Unless the domain signing mail is succinctly associated with a
mailbox-domain, there is little value a domain-wide signature would have
with respect to forgery. Forgery abuse is not much different than
signature "replay" abuse, without a specific association between the
signing domain and a mailbox-domain.
Although a secondary aspect, any reputation value associated with the
signature would be protected when forgery and "replay" abuses are
addressed. It seems where signatures offer the greatest value, is also
where they are most likely abused.
-Doug