4 ms·
I think a reasonable compromise is to make the trust/escrow work at the level of domains, rather than users. That way the providers operating an email service
by dane-pgp 5y ago
I think a reasonable compromise is to make the trust/escrow work at the level of domains, rather than users. That way the providers operating an email service have an incentive to stop spammers abusing their accounts.
To get providers to agree to this system, we could say that all domains registered before 2022 are grandfathered in, and only newly registered domains (with an MX record) have to put money into escrow. Domain owners already have to spend money, and hire technically knowledgeable people, so it's not like millions of ordinary email users will have to suddenly start entering their credit card details in order to send messages.
The only problem is how to decide who is allowed to make a claim against the escrow. If I accuse Gmail of sending me spam, can I take Google's money? To avoid some bad incentives, the money in escrow should go to charity rather than the claimant, but that still allows attackers to make false claims and prevent millions of Gmail users being able to send emails.
A naive voting system would break down because of Sybil attacks, so we probably end up having to trust some cabal of big email providers, who maybe become anchor points in a trust graph, or they employ people to review instances of DKIM-signed emails that claimants report to them as being spam. This cabal could perhaps be made slightly more democratic by allowing UN/ITU members to vote on organisations they trust with this power.