I don't think verification of sender is the problem (see PGP), it's that email was built such that anyone can contact anyone without setup ahead of time. I can give my address to some guy I meet at a conference and he can email me later with no issues, we don't need to agree ahead of time that we know who each other are. If he uses PGP, I need to accept the first communication is him, which means anyone can send me anything claiming to be anyone. Unfortunately, as soon as you solve this part of the issue with technology, I think you've just reinvented social media.

He said "adopted". Not "invented". PGP is not main-stream and probably never will be.

Such technologies have to be done behind the scenes and presented seamlessly, or they will probably never take off.

I wasn't trying to discuss whether or not PGP is a good or widely used technology. My point was that even if something like it were widely adopted and made seamless, it would not be able to solve the problem of bootstrapping the verification connections without eventually become social media itself.

> Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble.

Tell me more about how DKIM and SPF and TLS with client certificates don't verify senders.

I didn't say they didn't, I said we haven't adopted a way of verifying senders. If DKIM, SPF, and TLS were universal, it would be a solved issue, but they aren't for a whole lot of reasons.

P.S.: However, come to think of it, they don't. You can receive a perfectly legit and verified email from [email protected] with the name displayed as "Mr. Your CEO".