Re: [Asrg] Consent Proposal

Hi Markus. I have only dealt with small groups of trusts - between 
cooperating companies.  The idea was to develop a proxy that would sit 
in front of the MTAs and handle the trust.

As for doing it on a broader scale, I don't know. Trust isn't one of 
those transitive things (A trusts B, B trusts C doesn't mean A trusts 
C). If you take a service like Yahoo email I don't know if the system 
would even scale.

Chuck Wegrzyn

Markus Stumpf wrote:

>On Wed, Jul 02, 2003 at 12:46:16PM -0400, C. Wegrzyn wrote:
>  
>
>>I'll just tell you what I designed..your mileage can vary. Trust was 
>>established between two parties, out of band perhaps. Once that trust 
>>was established all that was required was the use of X509 certs. A proxy 
>>in front of the MTAs would do all the rest....
>>    
>>
>
>I /do/ like the idea in principle.
>What do you think would be required to establish a web of trust large
>enough to cover the current email infrastructure.
>I know quite some mailadmins (some personally, some virtually for years)
>good enough to "trust" them. We could exchange the keys and have a
>small web of trust. What is the benefit? I cannot reject all emails from
>mailservers I don't have a key or I won't have any customers in zero time.
>
>Current practise is to trust everyone unless configured otherwise. I don't
>see a chance for a system that works the opposite way in the near future.
>
>What we need is a simple system that says "trust me" and that even
>allows to say "don't trust me" (because I am a workstation and probably
>hacked or virus infected or abused).
>And IMHO the cheapest, simplest and fastest method would be to associate
>TXT records along with PTR records for IP addresses that would contain:
>    "MTA=yes"
>or
>    "MTA=no"
>and an optional abuse contact in form of an URI like
>    "MTA=yes;mailto:abuse@example.com"
>    "MTA=no;http://www.example.com/abuse/contact.html"
>
>If no such record is available it's up to you whether you accept or not.
>
>It wouldn't break any of the existing mechanisms like forwarding, it
>wouldn't have problems with large DNS packets, it uses standard existing
>methods and it's easy to deploy.
>However it would be weaker than RMX or SPF or ...
>
>	\Maex
>
>  
>

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg