> From: "Stephen Sprunk" <[EMAIL PROTECTED]> > ... > The problem I've seen repeatedly, including in an off-list discussion I'm > having about this topic, is people confusing authentication with > authorization. > ...
Yes, that's a good way of putting the problem, but only for those able and willing to see the differences among authorization, authentication, confidentiality, non-repudiation, and so forth. It's sad that weak as dishwater authentication as authorization (and everything else) snake oil sells so well, as witnessed by Verisign's PKI and Microsoft's ActiveX. > ... My fear is the only effective solution may turn out to > be closed lists with permission grants, such as the IM services introduced > to keep spammers out. That will greatly reduce the utility of email. That has already happened about as much as it is going to happen or could happen, as witnessed by the IETF lists. The variations in effectiveness and mechanisms among the IETF lists are minor details. The notion of limiting submissions to known authors was once very controversial here, but it's now accepted as necessary and desirable. I don't see any reduction in utility as a result. Individual mailboxes differ. Because people value its utility, personal addresses will continue to accept mail from strangers who might be sending the same message to 100,000 others. Various technical and administrative defenses will limit spam. Except for those few of us who are obsessed with spam, filters that are sufficent and require little effort will be used. Popular choices will be what people can do for themselves such as private and DNS white- and blacklists, SpamAssassin, Brightmail, Postinni, Cloudmark/Razor, and the DCC. ("Do for themselves" includes hiring a competent ISP.) Filters that require joint actions by the sender and receiver, including the computing-cost and authenticating DNS RR proposals, will never be popular. Because they won't be popular, installations that start to use them will switch to sufficient equivalents such as simple white-listing. Sufficient existing protocols are never vulnerable to slightly better replacements. Joint action is an enormous barrier. It is a cost that is justified only in special cases. That is why we are not routinely using PGP or S-MIME for our private mail. That's also why I see many more SMTP-TLS connections to my SMTP server than I expected (many including from spammers), and why almost none of them are authenticated. To use SMTP-TLS you need only install and configure a current SMTP server. To use authenticated SMTP-TLS, you must use PKI or exchange keys. Vernon Schryver [EMAIL PROTECTED]