From: "Stephen Sprunk" <ssprunk(_at_)cisco(_dot_)com>
...
The problem I've seen repeatedly, including in an off-list discussion I'm
having about this topic, is people confusing authentication with
authorization.
...
Yes, that's a good way of putting the problem, but only for those able
and willing to see the differences among authorization, authentication,
confidentiality, non-repudiation, and so forth.
It's sad that weak as dishwater authentication as authorization (and
everything else) snake oil sells so well, as witnessed by Verisign's
PKI and Microsoft's ActiveX.
... My fear is the only effective solution may turn out to
be closed lists with permission grants, such as the IM services introduced
to keep spammers out. That will greatly reduce the utility of email.
That has already happened about as much as it is going to happen or
could happen, as witnessed by the IETF lists. The variations in
effectiveness and mechanisms among the IETF lists are minor details.
The notion of limiting submissions to known authors was once very
controversial here, but it's now accepted as necessary and desirable.
I don't see any reduction in utility as a result.
Individual mailboxes differ. Because people value its utility, personal
addresses will continue to accept mail from strangers who might be
sending the same message to 100,000 others. Various technical and
administrative defenses will limit spam.
Except for those few of us who are obsessed with spam, filters that
are sufficent and require little effort will be used. Popular choices
will be what people can do for themselves such as private and DNS white-
and blacklists, SpamAssassin, Brightmail, Postinni, Cloudmark/Razor, and
the DCC. ("Do for themselves" includes hiring a competent ISP.) Filters
that require joint actions by the sender and receiver, including the
computing-cost and authenticating DNS RR proposals, will never be popular.
Because they won't be popular, installations that start to use them will
switch to sufficient equivalents such as simple white-listing. Sufficient
existing protocols are never vulnerable to slightly better replacements.
Joint action is an enormous barrier. It is a cost that is justified
only in special cases. That is why we are not routinely using PGP or
S-MIME for our private mail. That's also why I see many more SMTP-TLS
connections to my SMTP server than I expected (many including from
spammers), and why almost none of them are authenticated. To use
SMTP-TLS you need only install and configure a current SMTP server.
To use authenticated SMTP-TLS, you must use PKI or exchange keys.
Vernon Schryver vjs(_at_)rhyolite(_dot_)com