🚀 go-pugleaf

In <1992Aug14.195017.7009@decuac.dec.com> mjr@hussar.dco.dec.com (Marcus
J. Ranum) writes:

>	A good metric to use to determine if you have "authentication"
>is to ask yourself if a bank would let you make withdrawals based on
>it.

By this reasoning neither fingerprints nor digital signatures are
authentication -- unless you know of a bank that allows withdrawals based
on these.  The only authentication method accepted by banks today is a
signature on paper.  All other mechanisms are used for provisional
authentication, with the signature on paper being the final authority in
case of a dispute.

Let's be realistic.  Banks don't do email withdrawals.  But one can
hypothesize a bank on the Internet.  Suppose it has name service set
up such that host names can't be forged.  (This may actually turn out
to be a bigger problem than username authentication.)  Then the bank
might well allow withdrawals based on email messages, provided the
message came from (a) a host that made a direct connection with the bank,
(b) was running rfc931, and (c) whose sysadmin had a contract with the
bank that in the case of rfc931-authenticated email from any of a
specific list of users, the sysadmin would guarantee the validity of the
rfc931-authenticated username.

Between any two hosts both on the Internet, a message transfer generates
only a single Received: header.  You get multiple headers only when (a) a
site is not directly on the Internet, or (b) when mail routing is done by
a host other than the originating host.  And you have one initial
Received: header generated on the originating host.  In the case of (b),
if mail routing remains within the same organization, the Received:
headers can be made reliable if the organization properly controls all
machines involved.  The only possible doubt arises when somebody is not
on the Internet.

So with appropriate controls, the information in the Received: headers
*can* be made reliable.  I see no reason why we won't have email banking
in the future, quite possibly using username authentication with rfc931,
the only condition being that message transfer be done by a chain of
hosts each of which is under proper administrative control.

Host name authentication may prove to be more difficult than username
authentication.
-- 
Rahul Dhesi <dhesi@cirrus.com>
also: dhesi@rahul.net