We already have that. It's called an x.509 certificate, and many e-mail clients today support it's use automatically (certainly Outlook Express, Outlook and Thunderbird do). It's completely portable, tied to the person and not the ISP or e-mail address, and not tied to any one vendor's software.

The problem is that users don't bother checking that identity. That means that identities are only as trustworthy as the *least* trustworthy issuing authority (which isn't very trustworthy at all). And as has been proven with the Microsoft signing certificate and Mountain America Bank fiascos, even the more trustworthy issuers can be fooled into issuing false certificates.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/404/33663#33663