Only thing is, as far as I can tell everything you want already exists and doesn't require any replacement of SMTP. SMTP, after all, is just a protocol for moving messages from point A to point B. What you're asking for is security on the contents of messages, which SMTP doesn't even look at. I can, right now, obtain an electronic identity, plug it into my e-mail client and have that client sign and/or encrypt my e-mail messages automatically in such a way that the recipient can decrypt the message and verify that it came from me. So why, exactly, do we need a whole new system to do what the existing system already does?

What we need, unfortunately, isn't in the software. What we need are users who bother to check who the message came from. No level of security will help a recipient who doesn't bother to look at the signature of a letter.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/404/33643#33643