Authentication by Email Reception

In this paper, I describe the use of email reception as an authentication mechanism for public access servers, such as emailand Web-based servers in untrusted and low-risk environments [DoD]. Even the simplest implementation provides security that is significantly better than trust and requires significant power to crack. Despite its security limitations, this type of authentication should be attractive for a large percentage of servers that are now currently trust-based. In particular, the system administration cost is near zero because initial and subsequent reregistrations (e.g., dealing with forgotten passwords) is totally automated. Problem detection and resolution is also automated to a high degree. It is this high degree of automation and corresponding low cost that is the motivating factor for this work.