News for hackers. Stuff that matters.

A comment on Why is no one signing their emails?. Parent comment

Re:Why is no one signing their emails? by BeetleB on Wednesday March 13, 2019 @11:03AM (#19379319)
Do you need to understand any of that for SSL on the Web? What the person is proposing is comparable (albeit only in one direction).

The user doesn't need to understand any of this. The user does not need to sign his emails. He just needs a mail software that can handle signatures from well known organizations, and can warn you when the signature doesn't match. Just like my browser puts a green or red symbol when there's a problem with the certificate.

Everything you list is mostly orthogonal to the submission.

[ Parent | on HN ]
Re:Why is no one signing their emails? by freeone3000 on Wednesday March 13, 2019 @01:01PM (#19380773)
SSL on the web verifies that the sender is who they've verified to a third party that they are. It does not verify that they're trustworthy in any way, shape, or form.

What makes an organization "well-known" enough to be on this list? What happens if an organization is not on this list? What if I'm a completely-legitimate (S-Corp paperwork filed!) organization called amazorn.com?

And what problem does this solve that the current DMARC system does not?

[ Parent | on HN ]