As I see it the messaging infrastructure is here to stay. The uphill battle trying to change this will be near impossible and the opportunity for abuse by patent holders and such with a new system is too great.

There are two issues with e-mail. E-mail is not secure and there is no standard widespread way of authenticating the sending party. The security can be dealt with using encryption and there are quite a few good solutions already in place for this.

This leaves the final big issue that allows for spamming and phishing. I am going to take a leap here and move to the topic of social security numbers as identifiers. This is also a failing system or a sinking ship to use the stories metaphore. Why not come up with a real identification system that can also be used for application authentication such as e-mail. If the e-mail is not authenticated then it is not passed. This would be kind of like a certificate issued by a world authority at birth that can then also be used for application authentication, OS authentication, credit card authentication, and so on. This would be combined with another authentication factor to ensure security.

I do not know what a good solution to this really is as I would be wary of any government certificate program but I am sure that ultimately we will be forced to move in this direction world wide. This concept makes too much sense.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/404/33652#33652