Re: CBV

On Fri, May 07, 2004 at 12:29:21PM -0500, Seth Goodman wrote:
| 
| As far as PGP itself goes, the PKI is a fair amount of baggage and the trust
| model is not easy to deal with for average users.  More importantly, I don't
| think it solves the original problem we have set out for ourselves.  That
| is, provide a reasonable amount of accountability for senders of email
| without putting an unreasonable burden on either party, but particularly on
| the recipients.  SPF, SRS and SES all attempt to validate MAIL FROM:.  PGP,
| on the other hand, was meant to verify the RFC2822 headers, protect the
| message body and allow for public key encryption.  It does nothing to
| authenticate MAIL FROM:, which SPF correctly identified as the first
| necessary step in providing accountability to senders.

For the record, folks who haven't seen
http://spf.pobox.com/slides/crossingbeams/ should take a moment to
view the slideshow, which illustrates the above point using pretty
pictures.

I have a feeling the world will see all three methods show up in order
from top to bottom.