Re: Scope of SMTP Verify

Yakov Shafranovich wrote:

> Jeff Silverman wrote:
>
>> Yakov Shafranovich wrote:
>>
>>> Jeff Silverman wrote:
>>>
>>>>>
>>>>> Well that's the problem. So far we haven't gotten good answers. 
>>>>> Besides "web of trust" and "reputation systems", are the other 
>>>>> possibilities that can be used with identity to reduce spam?
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Kerberos?  You'd have to figure out a way to put a kerberos ticket 
>>>> into a mail message, and the kerberos ticket would have to have a 
>>>> very long life span.
>>>>
>>>> Kerberos is an authentication system, and if you have a valid 
>>>> kerberos ticket, then somebody can prove that a given instant in 
>>>> time, the sender authenticated himself/herself against an 
>>>> authentication server.
>>>>
>>>
>>> My question here is once you know the identity, what do you do with 
>>> it? Kerberos authenticates the identity and may or may not be used 
>>> for that, but the question is why you have the identity what do you do?
>>>
>>> Yakov
>>
>>
>>
>> Yakov,
>>
>>    Did you mean "once you have the identity, what do you do?".
>>
>
> Yep.
>
>>    Once I have the identity, then I submit that identity to a 
>> whitelist/blacklist, which I guess I have to maintain myself in the 
>> UTA.  If I maintain the whitelist/blacklist in the MTA then I have to 
>> extend POP and IMAP (or else create a list maintenance protocol) to 
>> maintain those lists, right?   Which means that the MTA is stilll 
>> vulnerable to a DDOS.
>>
>
> So we are not talking about external third parties reputation systems, 
> but your own internal white/black/gray lists?
>
> Yakov

Yakov,

    That's the direction I am leaning in favor of.   My thinking is that 
the I have to trust whoever does the whitelist/blacklist.  It would be 
nice if I could delegate it, but it seems to me that one persons SPAM is 
another person's valuable communication.  So, for example, I am a 
sysadmin, and I might decide that anything from the Nazis is spam.  But 
one of my customers might be a Nazi.    Should my customer trust me to 
run his SPAM filter for him?

    Now, perhaps you could have a hierarchy of whitelists and blacklists 
and so some filtering at the UTA and some at the MTA.  This idea isn't 
"cooked" enough, I'm sorry.  What I would like to see is the lists 
maintained at the UTA and executed at the MTA, but that would require 
the creation of a new way for UTAs and MTAs to communicate, and I just 
don't see that happening.  Several people on this list have mentioned 
backwards compatibility as a design goal and I hear them load and clear.


Jeff