I must say that I have been somewhat quiet in my journal over the last month - This is because, as some in the Perl community know, I have started a new position. The position is as technical manager with a company called
Bluebottle - The main focus of this company is the development of an enterprise level challenge-response type mail verification system. I started this full-time position just over two weeks ago, prior to which I was finishing up my commitments to my previous employer, and performing some preliminary code review and roll-out management for Bluebottle.
One particularly good thing about this position is that my employer has embraced the concept of open-source for this development and indeed is intending upon releasing much of what we develop back into the open source community.
This is going to be fun ...
Challenge Response (Score:1)
I've been outspoken on my concerns about challenge-response systems. Do you have a way to address spoofing? I don't want to receive any more challenges because a spammer or a virus used my address in the
Fromheader. Can your product deal with this?Re:Challenge Response (Score:1)
Fromaddress during the lifetime of the original verification request (currently set at seven days), no further verification requests are sent. Furthermore, the verification requestRe:Challenge Response (Score:1)
Good on you for not sending the full-body. That's a big plus.
Yes, spoofing is outside the scope of challenge response. I'm quite pleased with the ideas behind SPF [pobox.com], but that renders a lot of justifications for challenge response invalid, as far as I can see.
Re:Challenge Response (Score:1)
The big issue with SMTP+SPF which I see (albeit based upon my limited reading on SMTP+SPF to date) however is that SPF is not backwards-compatible and requires a high-level of adoption by proponents to be truly effective. I will however investigate this technical option further and have a thorough read through the SMTP+SPF documentation