Re: CAPTCHA over smtp (yet another spam solution to discuss)

On Fri, Nov 17, 2006 at 02:32:43AM -0600, Seth Goodman wrote:
> Perhaps you mean that the authentication for a message in a system like
> IM2000 does not have to survive beyond the particular session?  That is
> indeed true.  For the purposes of ordinary email, it is _not_ necessary
> for signatures to be verifiable later.  If your MTA validates the
> sender's identity assertion during the session, and you trust your MTA,
> that is good enough.

If you were to fetch the message from the sender's message store using
IM2000 over TLS, that would give you that level of confidence.

The message store's certificate proves that you are talking to the correct
message store for the sender's domain. To tie this down to an individual, we
rely on the message store itself being trustworthy - e.g. it doesn't give
out the wrong message when presented with the message retrieval key.

Regards,

Brian.