Alun
Thu Nov 04 10:20:14 CST 2004
"Lionel Fourquaux" <use-reply-to@no-spam.invalid> wrote in message
news:uoaM6OfwEHA.356@TK2MSFTNGP10.phx.gbl...
> Presently, the sender of an e-mail is whatever you tell your e-mail
> program to use for this field. You cannot rely on it.
My favourite analogy is to note that the "From" header is as reliable as the
"From" address on a physical envelope in postal mail. Anyone could have
written anything there, even if it looks like a genuine sticky label from a
real company. There is almost nothing in the contents that couldn't have
been put there by anyone. The only thing you can rely on is the first
"Received" header, if you open up all of the headers to look. Everything
else was sent to your mail server from another system that is not under your
ISP's control, and is therefore less trustworthy than anything provided by
your ISP.
Particularly untrustworthy are sentences/headers such as "Scanned for
viruses".
As suggested, if you want to ensure that noone else trusts fake mail from
you, make sure you sign all your emails, and that the recipients know how to
verify your signature. If you want to ensure that you aren't trusting fake
email from others, insist on a signature, or some other proof. Take a look
at
http://www.microsoft.com/athome/security/default.mspx for some more
articles on email fraud protection.
Alun.
~~~~