Anti-spam Specification from IETF
Implicit trust is a problem with a number of Internet protocols. By exploiting that trust, spammers and phishers have had their way with spoofed emails. The pending adoption of DomainKey Identified Mail looks more likely with the Internet Engineering Task Force's specification release yesterday.
This raises the bar on spammers and phishers who have had it easy because we currently identify message senders by IP addresses. Getting your hands on someone's private key and creating a valid digital signature is a lot more challenging than spoofing an IP address.
Adoption won't be impeded by dependence on new protocols. As New Antiphishing, Antispam Specifications Unveiled points out:
The DomainKeys project was particularly innovative because it specified the use of domain names rather than IP addresses to authenticate senders, Crocker said. DomainKeys also used the existing Domain Name System (DNS) to transmit the public keys needed for encryption, rather than adding yet another infrastructure layer.
This may be the case where a relatively small change can have a big impact. Of course, spammers and phishers will adapt. Perhaps they'll find ways to compromise white lists so spam will be accepted as legitimate or some other way to break the system. That kind of back and forth of attack-countermeasure-new attack is a constant in security.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
