These add-ons eventually created opportunities for malicious abusers to mask their identities and use the infrastructure to deliver rogue code to unsuspecting computer users. Once this kind of abuse became widespread, criminals soon learned to use sophisticated social-engineering techniques to steal money from innocent victims unaware of the dangers of identity theft.

Today, the norm is for spam e-mail to serve the cause of criminal schemes. In response to these kinds of threats, many Internet security experts have called for an e-mail authentication system that they believe would significantly reduce e-mail-related crime. Supporters of such tactics believe e-mail authentication strategies will immediately put a dent in e-mail-based fraud.

A recent New York City gathering of leading Internet security companies and software developers led to a consensus that, while not a perfect solution, e-mail authentication represents a significant step forward for the entire Internet community. Still, detractors dismiss e-mail authentication and say it will have little affect, if any at all, on the ongoing problem.

Two Plans for a Cure

Developers have proposed two methods to beef up the e-mail system. Both methods do not require individual or business users to do anything different in processing their e-mail. Instead, they will only need users to make more educated decisions when determining "good" mail from "bad." So far, Internet service providers (ISPs) and e-mail gateway services are using both methods.

Yahoo and a group of its supporters are pushing the "domain keys" method. This strategy requires e-mail senders to complete a two-part verification process. The ISP or e-mail gateway service must first authenticate the message sender. Then the message sender must pass a second phase called the "reputation score."

The second most popular authentication method is called the Sender ID Framework (SIDF), which is a merger of two earlier e-mail security proposals, one from Microsoft and another from e-mail provider Pobox. The Sender ID technology requires two levels of authentication before an e-mail message is delivered. The message originator registers for inclusion on a list that confirms the Internet Protocol (IP) address of the sender. The mail server also must confirm that the mail originator is approved to enter the traffic stream for delivery to the recipient. (continued...)

1  |  2  |  3  |  4  |  Next Page >