spf-discuss
[Top] [All Lists]

Re: SPF-compliant phishing?

2004-09-15 08:55:34
Stuart D. Gathman wrote:
On Wed, 15 Sep 2004, David Woodhouse wrote:


In the second example. The first example is very different, but I'll
come back to that. But OK, we accept that SPF doesn't actually let you
validate the user reliably.


It does with exists.  It even lets you validate an SES signature via
exists.

The perspective issue.

Sender or repient? Who is SPF really for?
Mr. Woodhouse's examples are from the recipient's perspective.
The exists mechanism is only reliable from the sender's perspective.

--
Daniel Taylor          VP Operations            Vocal Laboratories, Inc.
dtaylor(_at_)vocalabs(_dot_)com   http://www.vocalabs.com/        
(952)941-6580x203


<Prev in Thread] Current Thread [Next in Thread>