26 ms·
I don't think federation is the core issue with e-mail. I see the core problem as terrible MUAs don't use nearly enough signals to interpret identity of sender
by giantrobot 6y ago
I don't think federation is the core issue with e-mail. I see the core problem as terrible MUAs don't use nearly enough signals to interpret identity of senders.
SMTP has means to identify servers and domain ownership, web browsers have infrastructure to identify and verify arbitrary websites, and S/MIME exists. Most MUAs ignore basically all of this and instead trust whatever address is in a message's From header.
- networkimprov 6y agoMost phishing attacks originate on webmail accounts, which implement DMARC.
- giantrobot 6y agoDMARC is only as effective as the domain's suggested policy and the receiving server doing the right thing. It also doesn't have much if anything to do with the MUAs as they don't see any of the SPF/DKIM operations happening. DMARC doesn't do and isn't intended to do anything to verify the content or validity of an individual message.