Sender authentication (was: CAPTCHA over smtp...)

Brian Candler wrote:
> On Sun, Nov 12, 2006 at 01:10:29AM +0100, R. Armiento wrote:
>> Well, if you are prepared to live with this solution you can already use 
>> a simple white list on the [unauthenticated] sender address.
> 
> [...] the MAIL FROM:<...> envelope you see does not necessarily bear a
> direct relationship to the address on your whitelist.

I would suggest to do this filtering on the From-header in the email 
rather than the envelope from. This solution would likely give you a few 
years of peace before spammers catch on. After that, if you are lucky, 
email signatures will be more common than they are today.

>> What I do not understand at all is why you would think making your 
>> friends send their emails using a BBS system or a new "passport-like 
>> service for identity brokers" will be any easier than getting them to 
>> install a simple MUA extension that just signs their outgoing emails.
> 
> 1. The process is different for every MUAs. [...]
> 2. Many/most webmail services don't support this. [...] 
> 3. People don't understand (or want to understand) the key management
> lifecycle. [...]

I still don't understand how you could create an "identity broker" 
system that wouldn't require just as big cooperation from your friends 
MUAs as signing outgoing emails.

For the BBS example; to ask your friends to email you through a BBS user 
interface is just as intrusive as asking them to use a specific MUA when 
sending you emails.

But I do agree to this concern:
> When [your friends] replace their PC, they must remember to copy their
> keying material across, otherwise they end up with new and untrusted keys.
> When they work on multiple PCs, they must copy their keys onto every
> machine, or generate new keys on each one and cross-certify them all. And so
> on.

However, I am not sure I agree that the "right" solution to this problem 
is to introduce a third party system (the "identity broker") and force 
me to send all my email through it...

Best regards,
Rickard