Yahoo! to tackle spam with public keys

By Alun Williams

Posted on 9 Dec 2003 at 11:42

With spam now accounting for more than half the emails sent around the world, new and stronger defence measures are obviously required. In this light, Yahoo! is investigating new ways of authenticating email authorship.

As we reported yesterday, the virus-based hijacking of PCs for the relaying of spam is increasingly common. This can pose problems for anti-spam filtering software in that only a limited number of emails is sent from each hijacked IP address. By attempting to guarantee that the sender of an email is who they say they are, Yahoo! is looking to tackle the problem at source.

Reuters reports that the Internet portal is looking to introduce 'Domain Keys' software early in 2004. This is based on the long-established principle of encryption using public and private keys.

It quotes Brad Garlinghouse, vice president for communication products at Yahoo!: 'One of the core problems with spam is we don't know, Yahoo! doesn't know, the user doesn't know ... if it really came from the party who it says it came from. What we're proposing here is to re-engineer the way the Internet works with regard to the authentication of e-mail.'

Effectively, under the scheme, a sending system has a private key to encrypt a message and the Internet's DNS system would be used to check for the public key associated with the sending domain. Only if the message can be decrypted will it be assumed authentic and be delivered.

The DomainKeys software will be released as Open Source and thus be available for incorporation into third-party email software.