RE: CBV

On Fri, 7 May 2004, Seth Goodman wrote:

> > The CBV would work with the recipient sending the recipient as MAIL FROM
> > and the sender as RCPT TO.
> 
> This particular one hasn't been brought up before, and it's very clever.
> The only difficulty is that recipient addresses change when they go through
> forwarding hops and the sender has no way of knowing what those new
> addresses are.  I can't think of a way around this particular limitation,
> but if you can, it would be a much better way to avoid replay attacks.

This is no different than forwarders that don't do SRS with SPF.  The
solution is to just whitelist the forwarder.  If the forwarder does do
SRS, then there is no problem.  The forwarder would do the CBV (or not)
in the case of a bounce.

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.