On Wed, Oct 27, 2004 at 04:54:32PM -0400, guy wrote:
|
| The "a:SMTP.ISP.net" tells the world to trust SMTP.ISP.net (since the
| default is "+"). But this is not correct. Everyone that has access to the
| SMTP server can forge your email address.
While this may be true today, it is such a vast improvement
over the current state of things that most people are
comfortable doing it anyway.
Besides, many ISPs are moving toward a stricter set of rules
with SMTP AUTH: i fully expect that two years from now,
cross-customer forgery will not be allowed by the majority
of responsible, progressive ISPs.
but moving the customer base in that direction is unusually
challenging because we're going back and changing the
general culture of expectations that have been built up
around email, and that's harder than start out with a new
set of expectations altogether.