I don’t see the point of sending through Gmail with another email address as the From: header. If you have another email address, why not send from there? (You can still forward incoming mail to Gmail or elsewhere so you don’t have to check regularly everywhere.) OK, if you regularly use Gmail, OK, but if you still have some contact with the institute with the other email address, you can log in and send the email from there.

Another point is that while the From: header is easy to spoof, sending email to it will get it to the rightful owner, assuming a) such an owner exists and b) the account has not been hijacked. So, if I get email from Sean.Carroll@caltech.edu, I can send an email there and if I get a response, I can be sure it is THE Sean Carroll (and confirm that he sent the recommendation). However, if I get an email from Sean.Carroll344@hotmail.com or whatever, the same procedure gets me a response from the owner of that address, who might not be THE Sean Carroll.

There are legitimate reasons for “spoofing” the From: header (I think “spoofing” is too strong here, since it implies something illegitimate). This in itself (e.g. sending with an academic From: via Gmail) shouldn’t be frowned upon. I can understand someone wanting to see an academic address in the From: header though. (Again, the fact that it is easy to spoof is not the point, since I can reply to it and confirm anything I need confirmed.)

And I actually find it useful to keep the gmail and university addresses separate. One for private life, one for work, both accessible anywhere.

Gmail: it is not water. You can live without it.

Sean, who is doing this? I’m on the market and I’ve been sending applications from my Gmail account.

eleusis at 8 is a victim of reformatting; a straightforward copy and paste will fail to verify his message.

If you have an academic appointment, you undoubtedly have an academic email address and enough smarts to figure out how to use it. So do it.

Like somebody else above, I have about 5 or 6 email addresses that are all forwarded to my gmail account anyways. The reason I finally settled on gmail is partly what you say, that it saves me the effort of having to change my address every time I move. The maybe more important reason is that my gmail account has proved to be the most reliable one.

BUT I have one person applying for a postdoc where only paper references are allowed – Huh??

If you don’t configure Gmail to send email through your university’s mailserver, then it’ll send email “from” your university email address, but add “on behalf of” headers which show your gmail address.

As long as your University (or other email provider) has a generally-accessible SMTP server, you can send using your university email address without any indication of your gmail account being added.

- Will.

Unfortunately, there have been at least a few cases where this does not work. That is, people see the mail as coming from my gmail account instead of my other e-mail account. This is a problem, because I hate having to use the university mail interface, and I’m also trying to keep my main address secret.

While I applaud your intent, I find that in reality nearly all security systems generate problems. Sometimes big ones. That includes PGP.

In fact I think that is a big reason why PGP hasn’t become an overwhelming success. Truth is it could be called a modest success. Not much more.

The average person needs systems that are easy to use, reliable, and low cost. They need systems that can recover even if you suffer a loss of that private key. Systems fail, people forget, jobs change, technology updates.

Most authentication systems are based upon passwords yet the weaknesses of passwords are well known to anyone who cares to know. Biometrics has promise but the technologies are neither standardized nor ubiquitous. RSA keys are pretty good but they expire, they cost money on an ongoing basis, and if you have a low computer skills person, they can be hard to use correctly. RSA keys just aren’t meant for occasional use by the casual computer user.

For example, I just signed this message. If you had my public key, you could verify not only that it’s me, but that not one character was changed from what I originally wrote, since the gobbledy gook below acts as a cryptographic fingerprint of the content of this message (generated by my private key), and would look completely different if someone used a different key to write it or if they changed a single character. So, as long as no one steals my private key (which is the point of keeping it private , they can’t spoof me or change my messages.

It’s a system that really should be used more in this digital age.

- —–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJNB+yvAAoJEO3aTpdPX4OpQX0H/irPDtjupHp0FTcfjl739uhd
80OhaUwQS58qqr1XMFJU7zcx+MuV0vtFkVfxDQjkchs5urX2dIqNtIotoO/dZJvv
XBp9yiNOnXKjj8wVGP5NE/oHeqOUKOMuk4fYg/GbJV7Nc179JPdFv8QTaYBSh5WT
F94Yr/Tg424QPGbpgmtjj/7Ixa8vJmLvu081qdzjydjpF2XUPq6RakQ2V1wnQtK9
LfueL69bn8OG3sYdwrz90YRuxIlhx+R5eHDdh8ZDat9zPZBTfEBC+/MzeTAnhqY2
3nR0n7Ve34MhFID5TFPf2HQ5yGIVOilia9DHVK/dxlOdxFot7xlQgg8VV+BOLSc=
=xjFV

http://en.wikipedia.org/wiki/Web_of_trust

mmmmm… perhaps the phone? Then again, never would a profligate student use a professor’s .edu email address to send a recommendation under the assumed name?