I wrote a paper on how we can make email a bit more trustworthy using existing technologies and relatively few changes to the overall system (even though it would be a systemwide change). The basic idea is that all email accounts have associated public and private keypairs, and messages are automatically signed by the outgoing authenticated SMTP server. The receiving end looks up the public key for the sender address, and verifies the signature. This would essentially ensure that the sender address on every delivered email is indeed coming from the account it claims to be from. It would make lives much more difficult for spammers, and it would also make it possible to actually trace back virus and worms.
Secure Sender Verification through Automated Asymmetric-Cryptographic Message Signing at the SMTP Level
This is only a draft for now, but I'll eventually be submitting it to Slashdot and/or Kuro5hin (or any other site that'll take it), so leave comments if you read it!
Posted Tue, January 6, 2004 19:04 by
Is sentence correct: "It also makes it easier for messages to be sent from rogue SMTP servers (e.g. a worm running on a vulnerable PC), and for recipients to effectively filter out such messages."?
[moderate]