Re: Spoofing as the postmaster

On Sat, 29 Dec 2007 12:45:26 +0100
Magnus Hagander <magnus@hagander.net> wrote:
> That is exactly my point. The server can never know if the client has
> actually verified anything. It can provide the client with the *means*
> to verify things, but it can't enforce it.

I know this is probably obvious to most people in this discussion and I
don't mean to impugn Magnus just because I am latching onto his message
to make this point but I suspect that this discussion would go a lot
smoother if it branches into two completely different discussions about
two completely different issues;
- 1:  How does the client assure that the postmaster is legit- 2:  How does the postmaster assure that the client is
legit

Does anyone think that there is one answer to both?

-- 
D'Arcy J.M. Cain <darcy@druid.net>         |  Democracy is three wolves
http://www.druid.net/darcy/                |  and a sheep voting on
+1 416 425 1212     (DoD#0082)    (eNTP)   |  what's for dinner.