5 ms·

Require emails to be signed by the sender cryptographically.

dijit 5y ago
We have DKIM and you can safely drop non-DKIM mail. This tells you the MTA is actually sending the mail. The problem is that these MTAs get hacked or people just hijack domains. Heck, the barrier to buying a domain is so low that this is a legit way of spamming too.
- dane-pgp 5y ago
  > the barrier to buying a domain is so low This suggests that one way of making spam unprofitable would be to require any domain which sends email to put up a bond of $100 which is forfeited if any of the big four email providers decide that the domain is sending spam. To make this acceptable to public opinion, the forfeited bonds would to go directly to popular charities, and all existing domains would be automatically grandfathered in, so there would be no extra cost for any current business or user.
- pteraspidomorph 5y ago
  > safely drop non-DKIM mail Yes, but the customer will blame you when e-mail from a misconfigured MTA doesn't arrive (from my experience running one). If only we'd had DKIM from the start, preventing thousands of broken servers from being set up in the last twenty five years...
jart 5y ago
It's the 1960's. There's no RSA or AES or even DES.
- wantsanagent 5y ago
  Sure but it's a small community that hung out in person a lot. Tokens, pass phrases or one-time-pads could have been physically swapped. There's really just a difference in thinking, "private by default for email" vs "public by default." Or "untrusted network" vs "trusted network." However you want to think about it.
  - jart 5y ago
    ARPANET had a link between Stanford and UCLA in the 1960's. That's a five hour drive. One time pads can only be used one time. Otherwise XOR is a pretty bad cipher.
jeroenhd 5y ago
PGP with good UX could've been great. Too bad it missed the mark. S/MIME seems to work pretty well, but the paid certificates pretty much doomed its uptake. I think I still have a Startcom certificate from back in the day that has long since expired.

We have DKIM and you can safely drop non-DKIM mail. This tells you the MTA is actually sending the mail. The problem is that these MTAs get hacked or people just hijack domains. Heck, the barrier to buying a domain is so low that this is a legit way of spamming too.

dane-pgp 5y ago
> the barrier to buying a domain is so low This suggests that one way of making spam unprofitable would be to require any domain which sends email to put up a bond of $100 which is forfeited if any of the big four email providers decide that the domain is sending spam. To make this acceptable to public opinion, the forfeited bonds would to go directly to popular charities, and all existing domains would be automatically grandfathered in, so there would be no extra cost for any current business or user.
pteraspidomorph 5y ago
> safely drop non-DKIM mail Yes, but the customer will blame you when e-mail from a misconfigured MTA doesn't arrive (from my experience running one). If only we'd had DKIM from the start, preventing thousands of broken servers from being set up in the last twenty five years...

jart 5y ago

It's the 1960's. There's no RSA or AES or even DES.

wantsanagent 5y ago
Sure but it's a small community that hung out in person a lot. Tokens, pass phrases or one-time-pads could have been physically swapped. There's really just a difference in thinking, "private by default for email" vs "public by default." Or "untrusted network" vs "trusted network." However you want to think about it.
- jart 5y ago
  ARPANET had a link between Stanford and UCLA in the 1960's. That's a five hour drive. One time pads can only be used one time. Otherwise XOR is a pretty bad cipher.

jeroenhd 5y ago

PGP with good UX could've been great. Too bad it missed the mark. S/MIME seems to work pretty well, but the paid certificates pretty much doomed its uptake. I think I still have a Startcom certificate from back in the day that has long since expired.