<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 11/04/2008 03:41 PM, Ben Laurie:<br>
<blockquote
cite="mid:1b587cab0811040541s23926a37nf071d82e78d5d51@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">
No, email validation hardly says anything about you - it only proves control
over the email account, but not that you are Ben Laurie nor that you are a
Google employee. One might assume, that if you've got a google.com email
address, then well, you might be an employee at Google. But it's somewhat
vague...
</pre>
</blockquote>
<pre wrap=""><!---->
Well, make your mind up - it was you that brought up email validation
in the first place.
</pre>
</blockquote>
<br>
Did I? I don't think so :-)<br>
<br>
The thread started about anti-phishing measures IIRC. It was here where
I jumped in:
<a class="moz-txt-link-freetext" href="http://openid.net/pipermail/general/2008-November/006322.html">http://openid.net/pipermail/general/2008-November/006322.html</a> ,
specially your statement: "But wouldn't it be nice if browsers just
automatically supported a phishing resistant password scheme?"<br>
<br>
I answered with: "You mean something like client certificate
authentication?"<br>
<br>
There is nothing about email validation in my response...client
certificates can also be email validated if they are used for S/MIME,
they don't have to - authentication alone is sufficient. Neither does
an OP have to validate the email address (He can optionally do so of
course, but that's not the issue we were talking about, it was about
phishing resistance).<br>
<br>
<blockquote
cite="mid:1b587cab0811040541s23926a37nf071d82e78d5d51@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">Reminds me about some Google employee contacting me the other day with some
inquiry or job offer ...and I thought it was a phishing attempt. The email
wasn't signed nor any other indication which would let me clearly know, that
this is somebody really working at Google. :S
</pre>
</blockquote>
<pre wrap=""><!---->
What would they sign it with, or indicate with, that would convince you?
</pre>
</blockquote>
Validated S/MIME certificate. I really didn't except to receive from a
Google employee an email inquiry without proper identification -
neither from other high-profile brand companies out there. Instead I
called the guy by phone to validate that indeed he sent a mail and is
an employee of Google (using some other sources on my behalf). But
under usual circumstances I'd discharge the mail as spam and phish
without thinking twice....something to take up to your management
perhaps ;-)<br>
<br>
</body>
</html>