Forgery Woes Force Move to Private Conferences

Dave Andrews

Hurdles in implementing universal digital-signature verification for Internet newsgroup-style message conferences may lead to an increasing use of privately hosted discussion groups on the Internet. The problem today is that it's easy to forge your identity, including your e-mail address, when posting to an Internet newsgroup. By changing options in Netscape Navigator, for example, you can post a message to a newsgroup that appears to be from someone else.

This problem recently affected the newsgroup-search service Dejanews. Dejanews stores about 90 GB of newsgroup messages and lets you search for newsgroup articles from a Web browser by author name, subject, and other parameters. The service ( http://www.dejanews.com ) at one time also allowed you to post to newsgroups from the Web, but after complaints that people were abusing the service by posting wacky messages to newsgroups under forged identities, the company temporarily disabled Dejanews' ability to let you post.

Officials at Dejanews say that implementing a solution, such as PGP or some other encryption technique, would be difficult. First, the solution would have to be scalable enough to handle the thousands of articles that are posted on a daily basis. It would also have to be intuitive, easy to manage, and universal.

"For any of this to work on public newsgroups, the thousands of servers that carry news would have to implement the same security mechanisms," says Gregory Smirin, product-line manager for Digital ID services at Verisign, a p rovider of authentication products and services. It would also need to happen gradually, as security could be perceived as censorship and meet strong resistance.

All of this means that privately hosted, nonreplicating Internet conferences will become increasingly popular. Managing the encryption keys for a smaller population is easier than for a larger one. Plus, in a private conference, it's easy to delete inappropriate messages.