>> With a fully authenticated protocol we could limit the valid source >>addresses of the spam to the one associated with the compromised user.
That reduces it to a trust decision, right? We've had this option for years with DKIM, at least at the domain level, and it doesn't seem to have changed things much. Would authenticating down to the sender level really improve things? (I hate it when I talk defeatist, but that's how I feel about this issue.) Larry Seltzer Contributing Editor, PC Magazine larry_selt...@ziffdavis.com http://blogs.pcmag.com/securitywatch/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.