Re: Scope of SMTP Verify

Jeff Silverman wrote:

> Yakov Shafranovich wrote:
> 
>> Jeff Silverman wrote:
>>
>>>>
>>>> Well that's the problem. So far we haven't gotten good answers. 
>>>> Besides "web of trust" and "reputation systems", are the other 
>>>> possibilities that can be used with identity to reduce spam?
>>>
>>>
>>>
>>>
>>> Kerberos?  You'd have to figure out a way to put a kerberos ticket 
>>> into a mail message, and the kerberos ticket would have to have a 
>>> very long life span.
>>>
>>> Kerberos is an authentication system, and if you have a valid 
>>> kerberos ticket, then somebody can prove that a given instant in 
>>> time, the sender authenticated himself/herself against an 
>>> authentication server.
>>>
>>
>> My question here is once you know the identity, what do you do with 
>> it? Kerberos authenticates the identity and may or may not be used for 
>> that, but the question is why you have the identity what do you do?
>>
>> Yakov
> 
> 
> Yakov,
> 
>    Did you mean "once you have the identity, what do you do?".
> 

Yep.

>    Once I have the identity, then I submit that identity to a 
> whitelist/blacklist, which I guess I have to maintain myself in the 
> UTA.  If I maintain the whitelist/blacklist in the MTA then I have to 
> extend POP and IMAP (or else create a list maintenance protocol) to 
> maintain those lists, right?   Which means that the MTA is stilll 
> vulnerable to a DDOS.
> 

So we are not talking about external third parties reputation systems, 
but your own internal white/black/gray lists?

Yakov