Re: Reputation

Jeff Silverman (Remove the NOSPAM) wrote:
> 
> At the risk of sounding facetious or naive, is there some way we could 
> implement a "reputation server"?
> 
...
> First of all, a reputation servers potential client has to find the 
> reputation server.  Then, the reputation server has to somehow convince 
> the client that it (the server) itself has a high reputation.  
> Otherwise, a sleezy bank might create a sleezy reputation server.  Also, 
> the reputation server has to authenticate itself to the client, or else 
> a sleezy bank could hijack a reputation server somehow.
> 

What has been proposed so far is that senders of email indicate the 
reputation services that they use via DNS or inside the email headers, 
or in a digital certificate attached to the message. The receiver has a 
list of reputation services that he trusts, and then he uses the results 
accordingly.

The authentication is all done via digital certificates and 
cryptography, so you can be sure that a specific reputation service is 
the same one you have been talking to before.

> Finally, when the client gets a referral to the bank, it seems only 
> fitting and proper that the bank would want to check the reputation of 
> the client.  That, to me, sounds like a credit bureau.
> A credit bureau is a fantastically complicated undertaking.   So maybe a 
> reputation server is not a good idea.
> 

Aha, that's the question. Most of the time running reputation services 
costs money, and that money is usually recovered by charging users of 
the service. Do we really want to make email more cumbersome and 
expensive by requiring everyone to have an account with a reputation 
service? What about new services, how can they hope to enter the 
reputation market and establish themselves against existing competitors?

On the other hand a crude version of reputation services does exist 
today - IP blacklists such as SPEWS. They do have major problems, most 
human in nature and none of which are going away easily.

The bottom line in these things is that people must be willing to take 
reponsibility for their systems. The whole point of reputation services 
is to force people to take care of their systems in order not to lose 
their reputations. However, the problem is what about the people running 
the reputation services themselves, who watches them?

This is also the point of SMTP verification in general - providing some 
kind of identity that can be used to force the originators to take 
responsibility for their systems. The question of course is what kind of 
identity is sufficient for this purpose and how do we go about 
implementing it? LMAP proposals is one step in that direction which 
provide a domain identity. That might be all that is needed or might 
not, only time will tell.

Yakov