Margaret,
Any reasonable authentication scheme would have shown either where the
message actually came from or who actually authored.
Either type of information would have made pretty clear that this did
not come from the purported author.
MO> I have a somewhat stricter definition of a reasonable authentication scheme:
I did not define 'reasonable authentication scheme". I pointed out
that anything qualifying as one would cover the particular spoof that
was demonstrated.
In fact, some pretty weak schemes will cover this particular spoof.
And therein lies an important point we need to keep in mind, in these
discussions: We should be careful how heavyweight and cumbersome the
mechanisms are.
We are only needing to protect against transit spoofing.
d/
--
Dave Crocker <mailto:dcrocker(_at_)brandenburg(_dot_)com>
Brandenburg InternetWorking <http://www.brandenburg.com>
Sunnyvale, CA USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>