On Fri, Apr 22, 2016 at 6:31 PM, John R Levine <johnl(_at_)taugh(_dot_)com>
wrote:
It's hard to say because the entire idea of defining a general
"canonicalization" operation for email address as a solution for various
problems is, as I have previously pointed out, nonsensical. ...
Perhaps a way of thinking about this is whether identity equivalence rules
of a domain can specified and then communicated to a third party so that
the third party can make its own judgement about identity of the purported
sender of some email. At a high level can a specification be made
assuming
that the domain makes it suitable to do so?
Probably not, for all the reasons discussed before.
Moreover, I don't understand what problem this is solving. If it's my
S/MIME key and my MUA, why wouldn't I put the same address in the key that
my MUA puts in the From: line?
Imagine you run a large mailbox provider (e.g. Gmail, Hotmail, Yahoo
mail, Fastmail, etc) and you want to create managed keys and
certificates for every user. Most of your users exclusively use
webmail, so they don't have a traditional MUA. You also support local
part canonicalization using an algorithm (e.g. remove all periods and
downcase).
Now you want to enable people to discover the right certificate when
sending mail to your users and validate certificates when receiving
mail from your users. What do you do?
Thanks,
Peter
_______________________________________________
ietf-smtp mailing list
ietf-smtp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf-smtp