E-mail authentication gaining steam

E-mail authentication gaining steam
Robert Lemos, SecurityFocus 2006-04-20

A host of software companies, security firms and Internet service providers met in Chicago on Wednesday to urge corporations and bulk message senders to adopt e-mail authentication technologies.

Colapse all | Post comment

E-mail authentication gaining steam 2006-04-20
Todd Knarr (2 replies)

There's one real problem with the authentication frameworks as a solution to spam. That's the botnets. Few spammers originate their spam from their own machines, they originate it from malware-infected Windows boxes and compromised servers. In those cases, the spam will be coming from a completely a...

[ more ] [ reply ]

Re: E-mail authentication gaining steam 2006-04-20
Anonymous (4 replies)

Good Point!

But also notice that this effort (if successfull) may deter spoof emails which are of more serious concern.

Alok Tilavat...

[ more ] [ reply ]

Re: Re: E-mail authentication gaining steam 2006-04-21
Anonymous (1 replies)

But could this not also create problems for legitimate email as well?

For example, you use a high speed ISP that does not provide hosting services. That same ISP blocks remote port 25 access.

So, your domain name is hosted elsewhere, and you try to send email using your domain name...

and....

[ more ] [ reply ]

Re: Re: Re: E-mail authentication gaining steam 2006-04-29
Anonymous

If your isp blocks outbound port 25 it will be rejected anyway.

I guess you mean your forced to send via your isp's outbound mailservers, in which case you need to add those mailservers to your spf record.

This does mean that other people using your isp's outbound mailservers can send email cl...

[ more ] [ reply ]

Re: Re: E-mail authentication gaining steam 2006-04-21
Anonymous

Positive,

Also atleast with the domain key, people feel comfertable that the email is legitimate.

Muhammad Islam...

[ more ] [ reply ]

Re: Re: E-mail authentication gaining steam 2006-04-22
Anonymous

lol botnets are less concern then spoofed emails? wow you are crazy bro...

[ more ] [ reply ]

Re: Re: E-mail authentication gaining steam 2006-04-25
Todd Knarr

Perhaps. But with bot-nets, why would the phishers NEED to spoof addresses? Just send those fake e-mails from a compromised machine within the company you want them to appear to be from. That's just a logical extension of something we've already seen happen: the old advice about "don't open e-mail f...

[ more ] [ reply ]

Re: E-mail authentication gaining steam 2006-04-29
Anonymous

Your slightly missing the point - at the moment we ONLY have ip addresses to go on when tracing spammer.

At the moment spammers can choose ANY domain name to claim to send there spam from, but when email authentication is wide spread they will have to choose a domain that they can configure to al...

[ more ] [ reply ]

Incorrect statement 2006-04-21
Dotzero (1 replies)

From the article:

"authenticates e-mail by checking the address of the sending server against a record added to domain name servers. "

This is factually incorrect. SID absolutely does not validate the sending server.

SPF1 records make an assertion that is in the RFC2821 (Transport) space fo...

[ more ] [ reply ]

Re: Incorrect statement 2006-05-01
cenk kaan ornek

Another problem with SID's is that. SID is a number set by microsoft....

[ more ] [ reply ]

Targeted Distributed Proxy Spam Mailbombing 2006-04-21
An Observer

Unfortunately, authenticating the sender only solves part of the problem of junk mail.

Many commercial enterprises have web sites where interested customers can expressly request information by phone, e-mail, or US mail.

Unfortunately, these sites are easily exploited to generate spam by proxy...

[ more ] [ reply ]

E-mail authentication gaining steam 2006-04-21
Kellstr

I have been asked several times by my organizations director why an e-mail he didn't send was received by another user. When I look at the headers it obviously did not come from our netwrok. If authentication worked that would be one less headache I would have to face (until one of our machines got ...

[ more ] [ reply ]

E-mail authentication gaining steam 2006-04-24
Anonymous

postfix.org is what we (www.sjobeck.com) use as the internet-facing point in ingress for all, and all our client's, email, and it works like a dream. I highly advise more organizations get someone who knows Linux or *BSD to throw postfix on to, and put it in front of your Exchange/GroupWise/etc/etc/...

[ more ] [ reply ]

E-mail authentication gaining steam 2006-04-24
Anonymous

SPF is pretty dang easy to do. There is almost no excuse not to do it.

...

[ more ] [ reply ]

Spam Solved Tomorrow 2006-05-12
Anonymous

Spam could be extinct tomorrow if everyone adopted a proof of work system like Hashcash. Hashcash requires that email consume some amount of processor time (say a tenth of a second) that can be transparent to a legitimate user but devastating to spammers. It's decentralized: it works without a centr...

[ more ] [ reply ]