Re: Scope of SMTP Verify

Yakov Shafranovich wrote:

> Jeff Silverman wrote:
>
>>>
>>> Well that's the problem. So far we haven't gotten good answers. 
>>> Besides "web of trust" and "reputation systems", are the other 
>>> possibilities that can be used with identity to reduce spam?
>>
>>
>>
>> Kerberos?  You'd have to figure out a way to put a kerberos ticket 
>> into a mail message, and the kerberos ticket would have to have a 
>> very long life span.
>>
>> Kerberos is an authentication system, and if you have a valid 
>> kerberos ticket, then somebody can prove that a given instant in 
>> time, the sender authenticated himself/herself against an 
>> authentication server.
>>
>
> My question here is once you know the identity, what do you do with 
> it? Kerberos authenticates the identity and may or may not be used for 
> that, but the question is why you have the identity what do you do?
>
> Yakov

Yakov,

    Did you mean "once you have the identity, what do you do?".

    Once I have the identity, then I submit that identity to a 
whitelist/blacklist, which I guess I have to maintain myself in the 
UTA.  If I maintain the whitelist/blacklist in the MTA then I have to 
extend POP and IMAP (or else create a list maintenance protocol) to 
maintain those lists, right?   Which means that the MTA is stilll 
vulnerable to a DDOS.


Jeff