Hacker News Reader

I don't think this rationale is correct. DKIM doesn't authenticate a user, since the user doesn't the private key - DKIM authenticates that the MTA knows the private key on behalf of the domain owner, which isn't necessarily the users using that domain to send email.

What's more dangerous is that a jury wouldn't know the difference.

View on HN

Ha, at least ! Thank you for the comment.

If there is some mail from my addr, with a valid DKIM signature, it proves nothing: - perhaps the mail was sent by somebody else on the same plateform, but in my name (identity usurpation of the user part of the mail) - perhaps somebody got illegal access to my email account, without me knowing - .. ?

In no case it proves that I, as a human, sent this email.

But of course, justice is a fiction that cannot exist: there is no justice, only probabilities (and feelings :( ).

For 20 years Fastmail allowed any customer to spoof From: another

https://news.ycombinator.com/item?id=42536750#42539217

Reply on news.ycombinator.com