Re: Summary of Issues Raised to date

On Mar 16 2004, Philip Miller wrote:

> I don't like the idea of having the MUA have to contact whatever upstream
> server in more ways than it takes to download the message.

I don't either. For one thing, the filtering might take place years
after the fact, or at least without reasonable expectation of access
to the server, or the internet generally. Think formail used on email
archives, maybe older archives carried around from a previous job.

> I think a better way to verify the authenticity of a filtering header would
> be a simple signature calculated on a deterministic checksum of the rest of
> the header and included in the header. We need some way to inform the MUA of
> the public complement to the signing key, but that's a fairly simple matter.
> (Hell, we could even throw it in the DNS! :-)

That's still a lot of work. I'm hoping we can come up with a simple
protocol where filters/MUAs can decide everything on their own,
provided everyone uses the protocol.

For example: suppose there was a single slot for a spam decision in an
email (ie an official X-Is-Spam: yes/no field). Every successive
filter simply puts their own decision in that field, overwriting
previous filter results. 

You lose information, but you also solve the spoofing problem, because
the MUA is guaranteed to see a legitimate filter result (I'm assuming
there is at least one filter upstream, so the MUA knows it can trust
the spam field. If there's no filter upstream, then the MUA would know
that there is *no* filter upstream, which is equally valuable as the
spam field is always spoofed in that case).

I'm not suggesting this is the answer, but I am suggesting that a 
behavioural protocol can be simpler and just as effective as a complex
authentication system.

-- 
Laird Breyer.