On Thursday 19 April 2007 23:42, Adrian de los Santos wrote:
After 4 days of my original question (how to prevent phising that
uses fake From information) and reading all the answers and doing my
own research, i can say that:
- There is no working tool that prevents or authenticates internet
mail (domain keys, spf, sender-id, etc.)
This is true. SPF is a piece of the puzzle. DK/DKIM has potential to be
another significant piece, but until their (I'm part of the DKIM WG) policy
protocol work is done and the reliability of the cryptographic protocol is
established in Internet scale use, it's premature to say. Sender-ID does an
excellent job of protecting the resent-sender header. If that's important to
anyone, they should do Sender-ID.
- There is nothing useful commercial or open source that prevents
phishing
No, but I think we are getting close. I think that Stuart's discussion about
combinging reputation with SPF is a strong point in the correct direction.
I've been involved in some other, similar research work that is promising
(just research at this point, no product yet).
- The problem it's not in the tools, the protocol itself SMTP was
never designed to prevent this from happening and the protocol itself
needs to be redone, it was good 10+ years ago, now it just look silly
that anyone can forge an email message and there is no real way to
prevent it. Instead of wasting time and effort trying to solve
problems created by the protocol why not redesign the protocol ???
who is doing that ???
That has been proposed. In my opionion there is too much momentum behind SMTP
to stop and redesign it. If this does happen it's going to be some other
non-email protocol that just eats smtp's lunch. Maybe some kind of
RSS/Jabber something. I don't know.
Scott K
-------------------------------------------
-----------------------------------------------------------------------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735
Powered by Listbox: http://www.listbox.com