Subject: [Asrg] SMTP AUTH

From: [email-masked]
Date: Sun, 5 Dec 2004 16:50:27 +0000 (GMT)

> I meant SMTP AUTH for Sender only no the target SMTP server. It was
from the user point of view. And yes SPFand other techniques do help in MTA
to MTA transaction.

>>> > Again, you're ignoring things like discussion group/mailing lists,
>> > message digests, and so forth.  Anybody who makes the mistake of
>> > supporting SPF later finds that they can't send mail using their
>> > business E-mail address when they are (say) on a cruise ship
>> > vacation or at an Internet cafe in some other country.
>>

> mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP
  |__________________________________________|

I truly don't understand why the types that keep hawking SMTP AUTH as the 
solution JUST DON'T GET IT... how many times do we have to say this?

THE FACT IS THAT IF YOU ARE ON A CRUISE SHIP AT THEIR INTERNET CAFE, OR AT AN 
AIRPORT WAITING LOUNGE INTERNET ACCESS KIOSK, (and many other public-access 
situations) YOU MOST LIKELY HAVE *NO* CONTROL ABOUT WHAT SMTP MAIL SERVER IS 
GOING TO BE SENDING YOUR OUTGOING E-MAIL MESSAGE.  That notwithstanding, 
OBVIOUSLY you would STILL want to use "your" own E-mail address as the sender!

SMTP AUTH does NOT help, and generally IS NOT (currently, at least) POSSIBLE, 
for such situations!

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Sun, 5 Dec 2004 22:38:19 +0530

On 05/12/04 16:50 +0000, [email-masked] wrote:
<snip>
> > mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP

Ouch. CAPS!
Let me see, you have an IP conection, presumably connected to the
Internet. You should be able to access the submission port to send your
mail via your mail server. You just might not be able to use port 25/tcp
there.

SMTP AUTH solves the problem of being able to uniquely identify the
spamming user and allowing the ISP to terminate those accounts without
having to try and fiugre out which user had that IP at that time from
the DHCP logs.

Devdas Bhagat

---

From: M Z R <[email-masked]>
Date: Mon, 6 Dec 2004 02:21:20 +0800

> On 05/12/04 16:50 +0000, [email-masked] wrote:
[snip]
> mail via your mail server. You just might not be able to use port 25/tcp

Actually, there are some cases where submission port (587) also cannot
be used. For example, my personal experience in McDonalds Free WiFi in
Singapore. I tried using my SMTP AUTH server, but they 'hijack' all
SMTP related traffic and send it through their own gateway.

Regards,

MZR

---

From: "Tripp Cox" <[email-masked]>
Date: Sun, 5 Dec 2004 14:40:51 -0500

Ah, the Internet's promise of global interconnectivity in all its glory.
This kind of SMTP breakage is widespread (and not limited to SMTP) due to
the (ab)use of NAT as a means of firewalling and/or quarantine.  The only
thing you can (generally) count on is that port 443 will be open and
unproxied.

The more we talk about SMTP submission, the more I like web-based MUAs.
SMTP should probably just be replaced with an XML-based web service.  Absent
that, all we can do is try to impose some accountability for the identities
used in an SMTP submission.  Among the mechanisms for doing just that are
SMTP authentication, SPF, DomainKeys, and their ilk.

After that, it's a matter of content filtering (if one considers the
accountable sending party a contextual factor).  In most cases, I think
content filtering will have to become more personalized to the individual
recipient.  That is to say that one could greatly improve the end user
experience by infusing the communal notions of desirability (e.g. RBLs,
Brightmail) with unique personal knowledge (e.g. to whom have I already sent
email?).

Tripp