Gary Mills
mills@cc.umanitoba.ca
Mon Jun 20 02:51:24 UTC 2005
We have a serious problem with phishing e-mail that purports to be sent from financial institutions. There's no way for ordinary users to determine that the sender's e-mail address is a forgery. Most people don't know how to examine the headers and identify a funny SMTP peer, or to examine the HTML source and identify a bogus `href' value. I'm wondering if DCC can do some of this work? Specifically, could the real organization's e-mail domain be related to its outgoing SMTP server? Using the current facilities, specifying `ok2' with `substitute mail_host' and with `ip' might work to some extent. However, the two values are not tied to eachother. Is there a better way to do this? I realize that what I'm asking is the subject of several so-called sender authentication proposals, and that there are milters that work for some of them. I also realize that a great deal of dispute and controversy surrounds those proposals. I'm just wondering if any of this could fit into DCC. -- -Gary Mills- -Unix Support- -U of M Academic Computing and Networking-
More information about the DCC
mailing list