Re: Thinking outside the box

On 18/03/2013 20:38, Martijn Grooten wrote:
>> But - and I apologise for repeating myself - why not use the sender's email address as a unique password-like identifier? And put that in a header. Call it 'From'. Works rather well.
>>
Because I don't know you, but I do know '[email protected]'. I gave 
[email protected] my 'password', but I didn't give you it. But, I 
would have received that message from you, because it came via the asrg 
mailing list which would have added my password as it sent the message 
to me. If I had checked the 'From' address, then my spam filter would 
have been suspicious of your message, because it doesn't recognise your 
email address.

Also, if I set up my filters to allow mail from '[email protected]' 
through, then it would be trivial for you to start spamming me now 
pretending to be from '[email protected]'. But, if I'd given a 
password to the list server, you wouldn't have any easy way of finding 
that password, so your little trick wouldn't work.

Also, I can't safely whitelist "[email protected]" for obvious reasons.

As I mentioned before, for individual -> individual mail, the 'From' 
address is helpful, and many spam filters will automatically handle 
'known people'. But, there are cases when I receive messages from places 
which appears to be 'from' someone else, and that's fine.

Eg:

Mail forwarding works OK now, because I can tell the forwarder my 
password, so rather than gmail blocking all the mail my office MTA 
forwards to me because it looks like forged mail (failing SPF or 
whatever), it now works because my office MTA has my password.

Mailing lists work because the mailing list knows my password.

Mail from Paypal gets through because they know my password, but I can 
aggressively filter mail purporting to be from Paypal which doesn't have 
my password.

etc

-

Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53