spf-discuss
[Top] [All Lists]

RE: Agenda for FTC/NIST Email Authentication Summit

2004-10-29 20:44:39
From: guy Sent: October 29, 2004 4:48 PM
 
|It is too late to present anything.  The due date for a
|request to present is long past due (September 30).  I
|think I read that there will be a question/answer period,
|but I can't find any info that confirms that.  And the
|schedule does not show anything like that.  Unless you
|count BREAK and LUNCH!  :)
|
|The web page that has the list of "Requests to Participate"
|does not show anything from Meng.  Based on this, he should
|not be able to speak.

http://www.ftc.gov/os/comments/emailauthentication/index.htm

The page you reference provides copies of the submissions
made in response to the Request For Comments issued by the
FTC and NIST in September.

This page does not contain the list of organizations who
submitted "Requests to Participate."

As a side note, the OECD held the 2nd OECD Workshop on Spam
in Busan, Korea on 8-9 September 2004.

The 3rd Session was on sender authentication and was
chaired by Hugh Stevenson of the Federal Trade Commission.

According to the agenda: 

This session will examine how proposals such as domain
level authentication and other various authentication and
verification procedures under development can help reduce
spam, how best to minimise any negative impact on users and
Internet service providers (ISPs) which may arise from
these procedures, and in particular to ensure that an
unstable environment is not created for legitimate e-mail. 

Particular issues to be highlighted include:

What effect will an authentication standard have on
consumers, e. g., will having authentication delay email
transmission times, burden current computer mechanisms, or
produce other adverse effects?

How will authentication reduce global spam? 

Can authentication on its own reduce spam, or will larger
processes in conjunction with authentication be necessary
to accomplish this reduction? 

Will authentication prevent “phishing”?

Broad overview of authentication proposals, including an
explanation of domain level authentication vs. sender
authentication and a summary of the authentication
proposals currently underway (e.g., Sender ID and Domain
Keys).

What criteria should be used to evaluate authentication
standards? 

What are the costs of implementing these authentication
proposals and who would bear those costs? 

What types of challenges will those ISPs that do not
participate in an authentication standard face?

Presenters were Carl Hutzler of AOL, Dave Crocker of the
Brandenburg Institute, Allan Packer of Microsoft and Helmut
Haag of Allaboutit

The workshop produced a final report dated Oct 22 which can
be found at:

http://www.oecd.org/dataoecd/12/42/33800116.pdf

The final report takes into consideration the closing of
MARID, even though this event occurred after the Workshop.

Of relevance are paragraphs 30 to 45 of the report.

You can find more details at:

http://www.oecd.org/document/39/0,2340,en_2649_22555297_33680935_
1_1_1_1,00.html

In essence, one can look at this as a run up to the FTC and
NIST Email Authentication Summit.

John

John Glube
Toronto, Canada

The FTC Calls For Sender Authentication
http://www.learnsteps4profit.com/dne.html
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.784 / Virus Database: 530 - Release Date: 27/10/2004