Re: Other SMTP verification methods

Alan DeKok wrote:
> Yakov Shafranovich <[email protected]> wrote:
> 
>>>  e.g. an originating MTA "logs in" to a recipient MTA, using
>>>"[email protected]".  The recipient MTA then somehow authenticates
>>>that user ID, using information published by "example.com".
>>
>>Wouldn't that be the same as the various callback systems?
> 
>   I'm not sure.  I've skimmed over the callback documents, but haven't
> read them in detail.
> 

One example is Hector Santos's CBV system. Another example is my CRI 
proposal 
(http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt). There 
is also regular C/R and the use of MSG TRK mentioned by William Leibzon 
(I think). In CBV you do a RCPT TO and if it passes, then the email goes 
through. In my CRI proposal there is a ESMTP extension for C/R and 
special headers for non-compliant MTAs and compliant MUAs. In William's 
proposal is the use of MSG TRK protocol for this.

All of these callback schemes have possible DDOS and privacy problems, 
not to say they should not be done but we must tread carefully.

> 
>>It sounds pretty interesting. I am wondering if we are missing anything 
>>like a spammer hijacking a computer that is part of the trust network or 
>>perhaps a rogue member of the trust network.
> 
>   Trust can change over time.  One element of trust is how much that
> trust has changed over time.  It's better to have a consistent history
> of trust than a spotty one.
> 

Another issue is that trust is not binary like in PGP - it probably have 
many possible values (maybe 1 to 100, in PGP its 1 - 5?).

> 
>>Something like senderbase perhaps? We had a discussion going on the main 
>>list sometime back about a standard for blacklists and reputation 
>>systems, and this sounds like a reputation system except the only factor 
>>it lists is how long the IP has been an MTA. Such standard combined with 
>>a database of existing MTAs might be interesting.
> 
>   The benefit is that the system is simple, easy to manage, and
> doesn't involve the maintainers making political decisions.
> 
>   Once the system is primed, participants could simply register a
> domain name, and the system could do DNS lookups every
> day/week/whatever, and keep the stats from there.
> 

So it would simply keep stats on how long an MTA has been up? Would such 
system be vulnerable to a DDOS attack? Would a spammer simply have a 
bunch of dormant domains?

Yakov