Subject: [Asrg] Do we need to do anything?

From: "Clayton, Nik [IT]" <[email-masked]>
Date: Thu, 6 Mar 2003 15:22:38 -0000

Reading some of the discussion here over the past few days, I'm wondering
whether we actually need to do anything.

Many of the suggestions and proposals are acknowledged as taking years
before they're widely deployed.  Talk of new protocols, e-mail 'postage'
charges and the like -- all these things need to displace an incredibly
well entrenched existing protocol.

At the same time, MUAs are getting smarter.  In particular, the presence
of language classifiers (Bayes, et al) in desktop-user (as opposed to
technical-user) MUAs is likely to become much more prevalent over the next
few years.

As soon as these become widely deployed, and the majority of recipients
have filters that are so customised that it's nigh-on-impossible for a
spammer to guarantee that their e-mail will get through, doesn't spamming
then become so uneconomical as to die out?

I realise that this could be seen as being slightly optimistic, ...

N
-- 
1        1         2         3         4         5         6         7    7
         0         0         0         0         0         0         0    5
                                                    -- The 75 column-ometer
Global Messaging,                 A: Top posting
120 Cheapside, x83331             Q: What's the most annoying e-mail habit?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 06 Mar 2003 15:48:53 +0000

> At the same time, MUAs are getting smarter.  In particular, the presence
[...]
> then become so uneconomical as to die out?

Or, if it doesn't, we can go back to writing letters. And then it will.

--
Regards,
Jon Kyme

--------------------------------------------------------------------
Get your free email address at http://www.merseymail.com/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 10:53:22 -0500 (EST)

On Thu, 6 Mar 2003, Clayton, Nik [IT] wrote:

> before they're widely deployed.

Right.  It's a research group, so the view is long-term.  However, I am
pessimistic that the necessary infrastructure changes will take place
within two decades, or indeed ever.

IPv6 has been around for five years.  It hasn't penetrated to any extent.
IPSec has been around for eight years, and is not widely used.  PGP
has been around for ages, and hardly anyone signs or encrypts e-mail.

> technical-user) MUAs is likely to become much more prevalent over the next

By the time spam hits the MUA, you've paid a significant cost of the
spam burden.

> then become so uneconomical as to die out?

Paper-mail advertisers pay money for their campaigns, and are happy with
a very low response rate.  As long as spamming costs the spammer next
to nothing, even a minuscule response rate makes it worthwhile.

And it's pretty easy to defeat filters if you're determined enough,
even Bayesian ones.  Coming up with ways to do this is left as an
exercise for the reader.  Let me rephrase that: Cominge upp withe
wayse too du thiss iz leftt az an xrcize four thuh reeder.
Creative mis-spelling will either pass undetected through Bayesian
filters (the first time) or can be used to grow the Bayesian databases
to unmanageable sizes.  Even smart filters that prune out mis-spelled
words can be attacked by sending random stuff out of /usr/dict/words.

(Not to say that filters are useless; on the contrary, they're very
valuable.  They catch the majority of spam that is unsophisticated.)

--
David.

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 17:07:36 +0100

> then become so uneconomical as to die out?

I don't think so. Reality shows the opposite, at least in my mailbox, 
there's more and more spam.

And I doubt it will becom uneconomical. Maybe you can lower the earnings
(what I also doubt, but just let's assume you could), it doesn't
become uneconomical, because spammer's costs are sinking
dramatically. 

Compare today's costs of having a plain PC connected to a flat rate
leased line with the costs 3 years ago and the estimated costs in
3 years. Do you believe it will be possible to lower the earnings faster
than the costs?

Hadmut

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 10:34:58 -0600

> By the time spam hits the MUA, you've paid a significant cost of the

I strongly disagree with this.

By far the most expensive part of spam is the time spent by the end
user.  Even if the end user only has to spend a few seconds to get rid
of the spam (just hit delete) and they value their time at only
minimum wage, that is still far more than the all other combined costs
used by that spam.

-wayne

---

From: James McIninch <[email-masked]>
Date: Thu, 6 Mar 2003 11:28:59 -0500

> technical-user) MUAs is likely to become much more prevalent over the next

Bayesian Classifiers work fairly well if you have good training sets, but the 
results will get muddy if the person has wild variation in the non-SPAM they 
receive. There is another issue too, however, is that for them to work you 
need to actually download the SPAM in the first place.

I do believe that the reverse MX and such are overkill. It would seem to me 
that a simpler method would be to follow the lead of credit-card companies. 
If you want to buy something online, you go to the creditor and get a 
temporary credit card number and use it. The number lasts for a single 
transaction and acts as an alias to your account.

In the world of e-mail, we could leave SMTP and the MTAs entirely untouched 
and provide a simple service that handles account aliasing (mail forwarding). 
It would work like this -- I'm going to give an e-mail address out, perhaps 
to someone I don't trust. My MUA asks a forwarding service for a randomly 
generated address to be mapped to my true e-mail address for either 1.) a 
specific time period, or 2.) until I ask for it to be revoked. I then give 
the temporary forwarding address to the untrusted party. Once the forwarding 
address ages out or is revoked, the forwarder simply rejects emails to that 
id.

Using this scheme, the filtering is simply done on the randomly generated 
token that's used as an abstraction for your e-mail address. Implementation 
ought to be simple, the protocol very easily speced and efficient. You could 
have the Post Office provide the service for $2/month publicly and let 
companies provide it to their employees, if they choose - or the ISPs to 
their customers. It would take little work to implement, could be rapidly 
coded up to be used by MUAs or MTAs themselves, etc.

What use would spamming be if you had to guess whether the 6-25 character 
alphanumeric string represents a valid e-mail address or not? And, if so, how 
long. Just set up the forwarding hosts to pause 1 sec on a connection that 
attempts to send to an invalid ID. If 1 out of 1000 addresses in your list is 
valid, the cost of the spam increases by 999 seconds for each one that got 
through.

This would work nicely too in that it would apply to other cases of trust, and 
could even support the notion of temporary vanity e-mail names (i.e., your 
service could let the client a sting to be contained in the address)...

Just a thought. I'm going to look into putting together a proof of concept and 
integrating it with kmail...

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 12:06:14 -0500 (EST)

On Thu, 6 Mar 2003, wayne wrote:

> I strongly disagree with this.

You don't run a busy mail server.

> user.

In many cases: Yes.
In many other cases: No.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 13:24:32 -0500

> You don't run a busy mail server.

I do.  In the vast majority of cases[*], spam volumes are within the 
"breathing room" you should engineer into your mail system.  Yes, it 
forces you to upgrade earlier, but in the scheme of things it's swamped 
by the end-user issues.

For budgeting of anti-spam, we completely disregard the cost savings in 
the infrastructure due to reduced volume, because of this factor, and 
instead come up with a productivity loss cost.

As a benchmark, we use an average of one minute per spam that hits the 
end-user.  That seems absurdly high[+], but once you factor in the 
unusual events (Corporate Security investigations, management chain 
uproars, people unable to cope with being bombarded with _extremely_ 
offensive spam and being unable to focus on work for a day or two, 
popups, mailer freezeups, and even the occasional reconstruction of a 
box), it's stood the test of time.

That works out to (after fudging and rounding of numbers, without 
revealing our LLR) a buck each in rough numbers.

$50,000 worth of productivity saved per day buys a lot more hardware and 
bandwidth than is needed to carry the spam.

[*] Of course there are exceptions.  Striker for example.  Or, if we 
were still trying to conduct business with our spamtrap domains.  Your 
bandwidth would be 80% or higher (99.9999% in the case of striker) for 
spam alone.  This may also be true of places like AOL (one billion spams 
in a day.  Yow!)

[+] Some anti-spam vendors are using a figure of 10-15 seconds each.

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 6 Mar 2003 18:33:42 +0000

> address ages out or is revoked, the forwarder simply rejects emails to 

Tagged addresses, temporary addresses, etc. All work well for a bit. 
Until your real email address gets out there.

And then you're history.

Look at it this way - you give your mum your real email address, 
because you know she's not a spammer. She forwards you a joke, and CC's 
a whole bunch of co-workers. One of those co-workers forwards that 
email to somewhere that gets archived on the web. And her MUA includes 
all those people's email addresses. BAM.

Matt.

---

From: Jim Youll <[email-masked]>
Date: Thu, 6 Mar 2003 13:59:44 -0500

At 18:33 +0000 3/6/03, Matt Sergeant wrote:
>because you know she's not a spammer. She forwards you a joke, and 
>CC's a whole bunch of co-workers. One of those co-workers forwards 
>that email to somewhere that gets archived on the web. And her MUA 
>includes all those people's email addresses. BAM.

But if you had a proper client that hid all the work, you could 
"give" a different e-mail address to every correspondent, and if it 
leaked out, you need only cancel that one and give that particular 
correspondent a freshly-generated address, no?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 14:04:46 -0500 (EST)

> Until your real email address gets out there.

Not necessarily.  People on this forum complain about spammers
not using real e-mail addresses because it's so easy to use fake ones.

Well, maybe *nobody* should have a "real" e-mail address.  We only
ever give out ephemeral addresses, that could be locked to a particular
sender, time-limited, etc.

Only your server knows your "real" address.  And it bounces mail sent
to that address; it only accepts mail for ephemeral addresses.

Web pages for contact info generate ephemeral addresses when they're
rendered.

When you print business cards, the printer uses a different ephemeral
address on each card.  (OK, this last is a hassle, but not insurmountable.)

There are a lot of silly implementation and book-keeping details, but
no fundamental reasons why this wouldn't work.

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 13:35:46 -0600

In <[email-masked]> James McIninch <[email-masked]> writes:

> specific time period, or 2.) until I ask for it to be revoked.

This sounds a heck of a lot like http://sneakemail.com/

There are other similar systems out there.  People use them and they
seem to work.

However, I don't think this kind of thing is a good solution.
Enough spammers continue to spam long after an account has been
deactivated that systems like sneakemail will experiences an ever
increasing ratio of spam to valid email.  People will also still have
to deal with switching email addresses.

-wayne

---

From: [email-masked] (Justin Mason)
Date: Thu, 06 Mar 2003 19:42:57 +0000

Jim Youll said:
> >And then you're history. ...
> 

The issue I've had with tagged addresses (which I use BTW in some cases)
is a usability one -- if I subscribe to a list with [email-masked],
I have to maintain a mapping between "posting to the foo list" means
"use [email-masked] for the From address" (since most sensible lists
impose From-addr filtering to avoid spam).

Giving a different e-mail addr to each correspondent breaks down in this
case, since I may be replying to Jim Youll, ccing Matt Sergeant, and the
ARSG list.  Which from addr do I use in this case?  If only the Asrg
list had so far had a tagged address mapping, that would be doable.  But
if all 3 had, it's more difficult; I'd have to tell my software that
Asrg takes priority, use its address, etc.

--j.

---

From: Jim Youll <[email-masked]>
Date: Thu, 6 Mar 2003 15:28:33 -0500

>Asrg takes priority, use its address, etc.

Right. So the obvious "correct" answer in this case, where one address (asrg)
contains the others (jim,matt) the most all-inclusive address is the one
to use.

Your software doesn't know that. However, if the list were putting a
Reply-To on the message (I think it should) then your software would. Absent
that, since joining a confirmed mailing list is a "big" event compared to most
e-mail activity, an enlightened e-mail client/server that could 
generate and maintain
these many addresses would also presumably have the smarts to figure 
out what's up.

>to deal with switching email addresses.

Sure, that's a concern. However with spammers now trying to cruise the
entire name-space of domains, it doesn't even matter so much....
from the logs this week, of a domain (name elided) that I host...
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here
	Mar  2 16:10:47 new sendmail[15206]: h22LAlW15206: 
<[email-masked]>... No such user here

This is not a perfect nor all-encompassing solution. I see it as a 
potentially useful tool for these reasons:
1. Self-help. It does not require a wholesale change to anything 
outside the user's local environment. It can be handled in a client 
with a little help on the server side.
2. Load-reduction... when a user learns that an address has been 
compromised and cancels the old address, the incoming server can kick 
messages at <rcpt to> rather than handling all of it.

The very thought of dealing with unsubs and resubs and updates... not 
pleasant at all, but it's the user's choice, really, and it doesn't 
demand cooperation of anything beyond the local circle of the user 
and his mail server.

IBM did some work on this several years ago, and covered the entire 
subject pretty thoroughly.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 13:09:15 -0800 (PST)

On Thu, 6 Mar 2003, Clayton, Nik [IT] wrote:

> As soon as these [Bayes, et al] become widely deployed, and the
> majority of recipients have filters that are so customised that it's
> nigh-on-impossible for a spammer to guarantee that their e-mail will
> get through, doesn't spamming then become so uneconomical as to die
> out?
> 

Long-term, you may be right... I just don't want to wait that long.  

I suspect that spam is already uneconomical, unless you're a professional
spamming services provider (SSP).  The SSP's revenue does not depend on
the ability of spam to get through, it depends on the SSP's ability to
make greedy scam artists *think* that spam gets through.  

As long as spam makes up, say, 1% of the messages that people see, the
SSPs will tell their clients that they can get *their* messages through.
The latter are eager to believe that they can get rich quick, so they
probably won't be difficult to convince.

I think it will be a very long time before the filtering arms race alone
results in spam levels low enough to make con artists believe that their
messages won't get through.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 6 Mar 2003 21:20:42 +0000 (GMT)

> no fundamental reasons why this wouldn't work.

What about address books? And people who give other people your address?

I see *lots* of fundamental reasons why this wouldn't work.

Part of the puzzle, yes. "The" solution, no.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 6 Mar 2003 15:50:21 -0500

>correspondent a freshly-generated address, no?

Read the thread on striker's spam problem.  Hundreds of thousands of 
messages a day, all bouncing due to a dictionary attack gone wrong.

Now consider what happens if everyone has hundreds of temporary 
addresses that can get into spammers hands.  Sure, you cancel it, but 
that doesn't mean the spammer stops sending.  You've made your life 
more complicated, and you've made your ISPs life hell.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 16:51:22 -0500

>> But if you had a proper client that hid all the work, you could "give" 
>> a different e-mail address to every correspondent, and if it leaked 
>> out, you need only cancel that one and give that particular 

> messages a day, all bouncing due to a dictionary attack gone wrong.

We think.

> that doesn't mean the spammer stops sending.  You've made your life more 
> complicated, and you've made your ISPs life hell.

Yeah - to reiterate a comment that may have been lost: even tho Allan is 
on "high speed", he can no longer afford to even just reject connections 
at the TCP/IP layer. IIRC, he quoted something like 330Mb of NACKs per 
_day_.  Yow.

We can afford to handle a spamtrap like that because we're on a mondo 
humunguous pipe.  But if the cron job deleting the email stalls for more 
than an hour, the 9Gb disk fills up and the machine falls over...  I 
can't even imagine AOL's 3 orders of magnitude larger spam catch must be 
like...  ~5Tb of data per hour.  That's more than the total US backbone 
flow of only a few years ago.

---

From: [email-masked]
Date: Thu, 6 Mar 2003 12:05:56 -0800 (PST)

From the point of ISP, email addresses that are just wrong and where you 
can tell the MTA to be off immediatly almost after the start of SMTP 
tranmission, are not a big deal. Yes, it does consume some processing time 
on the server, but its marginally very small compared to actually 
receiving entire message, storing it on the serer, sending it through 
filters, delivering it to mailbox, etc (logs do grow, unfortunetly, but 
hard drive space is now inexpensive and cdburners and blank cds too).
Now the above is generally applicable to small ISP, large ISPs with 
many 100,000 of email accounts may not see it this way...

But from "make spammer suffer" view - if spammer has to do 100 failed 
attempts to get 1 successfull one and even there he does not know if 
email will ever reach a recepient or if it may just go through alarm 
making it harder for him to send even more messages, then its all working 
in our favor.

---

From: Jim Youll <[email-masked]>
Date: Thu, 6 Mar 2003 17:18:48 -0500

At 15:50 -0500 3/6/03, Kee Hinckley wrote:
>addresses that can get into spammers hands.  Sure, you cancel it, 
>but that doesn't mean the spammer stops sending.  You've made your 
>life more complicated, and you've made your ISPs life hell.
>-

Did you happen to see the rest of my note with the snip from our log?
Spammers are basically doing dictionary attacks on domains now, 
desperation, yes, but nonetheless...

As a server operator for several domains, I don't know that life 
would be made "hell" by it. Spammers can send a finite number of 
messages, there IS a point of economic breakdown. As things stand now 
it seems to matter little whether the addresses exist or not.

Finally, if the same care is taken with these addresses as with the 
addresses we use now (I think I must be reachable by at least 15-30 
addresses right now), then the rate of turnover need not be 
excruciatingly high... further, a 1:1 mapping that allows tracking of 
a leaked address to its source introduces the possibility of 
enforcement of all manner of penalties against the transgressor... so 
I don't think this approach would lead to an explosion of inbound 
spam, not at all.

I also did not say  that it should be the only, or preferred, or even 
utilized-by-everyone approach, simply that the matter of self-help in 
the face of unhelpful global protocols and practices, should be given 
its due... and I attempted to answer a couple of points that 
discussed problems with the approach that seem from this perspective 
not to be problems.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chris Fedde <[email-masked]>
Date: Thu, 06 Mar 2003 15:49:08 -0700

On Thu, 6 Mar 2003 21:20:42 +0000 (GMT)  Matt Sergeant wrote:
 +------------------
 | What about address books? And people who give other people your address?
 | 
 | I see *lots* of fundamental reasons why this wouldn't work.
 | 
 | Part of the puzzle, yes. "The" solution, no.
 +------------------

A modification to this technique is to just use a new ephemeral
address for each message you send.  If you keep an outgoing folder
then you have all the data needed to derive a provenience for the
spam.

---

From: Matt Sergeant <[email-masked]>
Date: Fri, 7 Mar 2003 00:30:43 +0000 (GMT)

> correspondent a freshly-generated address, no?

I just don't see how that can work in the business world where you have 
corporate directories. Is the directory also supposed to dish out fresh 
addresses each time? Your proposal then requires changes to all MUAs, some 
MTAs, and now all LDAP and directory services and address book software.

Major headache.

---

From: Jim Youll <[email-masked]>
Date: Thu, 6 Mar 2003 19:33:17 -0500

>MTAs, and now all LDAP and directory services and address book software.

I see this as one of many techniques that can be used separately to help with
the problem. If I were to switch to this technique only for addresses that
are deliberately shown to the public (web pages, chats, 
fundamentally), I believe
the bulk of my spam problems could be kept under control.

Of course this does not work for every situation! For my grandmother and niece
and nephew, it would work quite well in many circumstances, 
especially if the details were taken
care of behind the scenes.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 19:48:23 -0500 (EST)

> What about address books? And people who give other people your address?

Well, you have one more-or-less permanent address that issues a challenge
to the sender, and if the sender responds correctly, it creates a
usable ephemeral address for that sender.

> I see *lots* of fundamental reasons why this wouldn't work.

No fundamental reasons.  Just implementation details.

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 21:11:16 -0500 (EST)

> What about address books? And people who give other people your address?

Ah.  This is solved by having different classes of addresses.

Consider a Domain-locked address.  The address
"[email-masked]" only accepts mail from the
roaringpenguin.com domain.  That's the address that gets published
in the internal company directory.  (For that matter, for the internal
company directory, you might as well use "[email-masked]").

Domain-locked addresses are also good if you're communicating with
several people at another organization.  Yes, if one of those people
tries to email you from a Yahoo account, it will bounce.  Well, too bad.

Sender-locked addresses are more restricted.  The address
"[email-masked]" only accepts mail from
"[email-masked]", period.  She can keep that address
in her address book, and it will work just fine.

Time-locked addresses are what you post in newsgroups.  They accept mail
from anyone, but only for a very limited time.

Challenge-locked addresses are what you use for your permanent point
of contact for strangers.  Challenge-locked addresses send a challenge
back to senders; if the challenge is met successfully, the sender is
given a sender-locked address to use.  Later on, you might
magnanimously hand out a domain-locked address, if you choose.
Depending on your policy, you might have sender-locked addresses issue
a challenge if the wrong sender tries to use them; this covers the
innocent case of someone giving out your address to a friend.

There's a terrific side-benefit from sender-locked addresses: If your
correspondent is silly enough to use M$ LookOUT!, and gets hit by a
virus, a nice thing happens: Most viruses nowadays pick two random
addresses from the address book.  They use one as the sender and the
other as the recipient.

Well, mail (supposedly) NOT from rose@... to ephem-dkn... will bounce.
Furthermore, by looking at the destination address, you can phone up
rose@ and say "I think you might have a virus; please check", whereas
currently, you have few clues as to who the real infected party is.

Locked-addresses require no MUA changes.  All of the magic can be
implemented on the server.

To get back to the broader picture mandated by the charter: Rather
than looking hard for ways to tie down an address to an identity, so
that we can track persistent spammers, it might be much easier and
just as productive to look for ways to dissociate e-mail addresses
from any kind of permanent identity, ensuring that spammers' lists are
rendered useless, and amplifying the effectiveness of the
measure-bounce-percentage proposal I made earlier.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 06 Mar 2003 18:04:47 -0500

> By far the most expensive part of spam is the time spent by the end

  While that may be true, I've been telling people for years "If you
do ANYTHING other than drop the TCP SYN from a spammer, you've lost".

  Actually *delivering* that mail results in huge additional cost.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 00:59:53 -0500

>Ah.  This is solved by having different classes of addresses.

You then describe an incredibly complex scheme whereby I am unable to 
send anyone email unless I have with me a piece of software which 
knows where I am, how I am currently able to communicate with 
everyone, and which address is appropriate to use under the current 
circumstances.  It requires that I upgrade every single MUA in the 
world that I might possibly use, whether it be my PDA, my computer at 
home, my computer at work, the kiosk in a shopping mall or the phone 
on the airplane.  It makes it virtually impossible to even manage 
addresses on *paper*, let alone in my head.

>tries to email you from a Yahoo account, it will bounce.  Well, too bad.

Explain that last sentence to the guy in customer support at your 
company who has to deal with the complaints.

>in her address book, and it will work just fine.

And when she's at my house sending email from the Audrey in my kitchen?

>from anyone, but only for a very limited time.

Which negates one of the great things about newsgroups--they are 
archived.  Last month I got email from someone asking about a piece 
of software I wrote ten years ago.

>implemented on the server.

Let's see.  They destroy my ability to filter incoming email based on 
the address (mail to webmaster@xxx goes here, mail to postmaster at 
xxx goes there).  They destroy my ability to reply to email on a 
laptop from different locations.  And (here's a fun one), when I move 
to a new company, I can no longer reply to any of the messages in my 
inbox!

Please keep in mind, when making proposals, that the average user has 
absolutely no idea how the email system works.  It's magic.  They 
don't understand even something as simple as what a bounce means (let 
alone how to read it).  If you work very hard you can try and make 
analogies with the post office and they will begin to get it.  When 
you start talking about transient addresses and throw-away identities 
you might as well be talking in Martian.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 00:22:16 -0500

(multiple replies)

>making it harder for him to send even more messages, then its all working

I seriously doubt that spammers reach 1 in 100 even now.  As you say, 
disk space and processing time are cheap.  And since the spammer is 
leveraging thousands of machines, they are cheaper for him than the 
recipient.  1 in 100, 1 in 1000, 1 in 10,000.  What does he care?  If 
you win that war, it will only be because you destroyed the network.

Our goal here is not to "make the spammer suffer".  This isn't about 
retribution.  It's about creating an environment in which we can 
sanely communicate.

At 4:51 PM -0500 3/6/03, Chris Lewis wrote:
>Yeah - to reiterate a comment that may have been lost: even tho 
>Allan is on "high speed", he can no longer afford to even just 
>reject connections at the TCP/IP layer. IIRC, he quoted something 
>like 330Mb of NACKs per _day_.  Yow.

Absolutely.  At the current rate of spam increase I'll have to move 
my server off of DSL sometime next year just to deal with the bounces.

At 5:18 PM -0500 3/6/03, Jim Youll wrote:
>As a server operator for several domains, I don't know that life would be made

I said ISP.  Not domain operator.  For some ISPs bounces are already 
such a big problem that they are interfering with normal email 
processing.

>"hell" by it. Spammers can send a finite number of messages, there 
>IS a point of economic breakdown. As things stand now it seems to 
>matter little whether

What is that point?  I know the necessary numbers were presented at 
the MIT Spam Conference but I didn't note them.  Anyone care to 
estimate at what point the return becomes so small that spammers lose 
money?  Obviously it depends on what you're selling.  The Nigerian 
schemes can afford to send messages for a very long time, given that 
their return is sometimes in the millions of dollars.

>excruciatingly high... further, a

You talk about turnover as though it were acceptable.  Do you move 
your house every year?  Do you change your name?  What is the 
acceptable rate of turnover for the address "[email-masked]"?  How 
about "[email-masked]"?  Do you want every user to have to go 
the website of every company they do business with every time in 
order to find out what the current support address is?  What about 
this mailing list?

>1:1 mapping that allows tracking of a leaked address to its source 
>introduces the possibility of enforcement of all manner of penalties 
>against the transgressor... so I don't think this approach would 
>lead to an explosion of inbound spam, not at all.

And how do you determine the transgressor for the address you posted 
to the web or put on your business card or that was forwarded from 
your mother's address book by a virus?  We're back to authentication 
again.  And if you have authentication, you don't need disposal email 
addresses.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Jim Youll <[email-masked]>
Date: Fri, 7 Mar 2003 08:58:48 -0500

At 0:22 -0500 3/7/03, Kee Hinckley wrote:
>>would be made

I've also run an ISP. Same. Our life as an ISP would not be made hell 
by addition of additional e-mail addresses that we halt at TO:... if 
anything, if we could shift the traffic from procmail to that early 
step, the servers would be happier.

Beyond that I'm not going to debate it with you. These techniques are 
in use at various places already, I've requested statistics and hope 
to get some soon... It is an effective technique for some people in 
some settings.

These need not be used everywhere to create a noticeable effect on 
inbound spam for normal people like my grandmothers and niece and 
nephew, who are more like "typical" internet users than anyone 
reading this message is.

A diversity of techniques is appropriate. This is one of them.

>estimate at what point the return becomes so small that spammers 
>lose money?  Obviously it depends on what you're selling.  The 
>Nigerian schemes can afford to send messages for a very long time, 
>given that their return is sometimes in the millions of dollars.

The numbers for the Nigerians were estimated in the last few weeks at 
about one million dollars, total, for all instances of the scam 
worldwide, ever. If they could afford to send continuously, they 
would, but they cannot. There is a cost, however small, first a 
matter of efficiency, second a simple matter that if too much mail is 
bouncing from somewhere, we next cut off that somewhere and that's 
the end of it.

>order to find out what the current support address is?  What about 

Please, don't be so fast to jump. I've already said several times 
that this does not work for all users in all circumstances. But 
nothing really does at this point. Nope, support@ and help@ and 
sales@ are going to be screwed for a long time, and they need other 
solutions.

There are many times that I use an e-mail address that can very well 
be transient, and in those cases, it is preferable to use a throwaway 
rather than my main address. For example, posting an online 
classified ad, posting to a newsgroup... i definitely should use an 
only-for-there transient address when joining a mailing list such as 
this due to the wide dissemination, and I'd use it just for this 
list. So, there are many instances of communications that are 
_expected_ to be short-lived and i see nothing wrong with using a 
short-lived e-mail address for them. In fact I already do that. If 
all the parties behave themselves, no future communication will ever 
come toward me just to be bounced back. If they don't, then there is 
a pretty good chance the offender will remove me (because it's not 
spam but a badly behaved merchant), and finally, sometimes, but not 
always, the address may have been leaked, and in that case I don't 
receive spam.

I've also said that this process would have to be automated to be 
really useful. If someone writes to me out of band and we begin 
talking at length, yeah, that person needs a separate address to 
write me with since the other may go away someday. So clearly, the 
best use of these is 1:whatever messaging where the scope of the 
messaging does not change. I can think of many cases that fit this 
rule. Not all. Many.

The technique could be used to immunize certain settings, in 
particular public forums that permit out-of-band member-to-member 
communications, from address harvesting.

I have asked for some stats from the people who run craigslist.org, 
which places an anonymous, transient, FORWARDED (talk about 
"expensive") e-mail address on every posting. I have never received a 
spam due to an address that was harvested from there. Why? Because 
nobody harvests addresses from there, since they are all for the most 
part invalid from one to thirty days afterward. No value.

>>introduces the possibility of enforcement of all manner of 
>>penalties against the transgressor... so I don't think this 
>>approach would lead to an explosion of inbound spam, not at all.
>
>again.  And if you have authentication, you don't need disposal 
>email addresses.

Obviously it was my mother or her computer. I give her a new address 
for writing to me, I turn off the old one, and we continue to 
correspond. I note that this is not necessary until a problem occurs. 
Most instances of mail-forwarding-viruses do not lead to spamming so 
it is certainly not a given that the turnover rate would be high at 
all.

- jim

---

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 09:22:34 -0500 (EST)

On Fri, 7 Mar 2003, Kee Hinckley wrote:

> circumstances.

It is not incredibly complex; many people have already implemented bits of it.

As I stated, it requires *NO* MUA changes.  All of the work can be done on
the server.  It does require that you relay outgoing mail through the same
server all of the time; that's why we have STARTTLS and SMTP AUTH.

> It requires that I upgrade every single MUA in the
> world that I might possibly use,

Not at all; see above.

> It makes it virtually impossible to even manage

Your server keeps track of everything.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 12:47:43 -0500

At 8:58 AM -0500 3/7/03, Jim Youll wrote:
>The numbers for the Nigerians were estimated in the last few weeks 
>at about one million dollars, total, for all instances of the scam 
>worldwide, ever. If

Maybe that's the numbers for Nigeria proper, but certainly it seems 
to be earning *somebody* money:

http://www.wired.com/news/business/0,1367,55329,00.html
>According to court records, from February to August 2002, Poet moved 
>$2.1 million, in amounts ranging from $9,400 to $360,000 per wire 
>transfer, from the accounts of Olsman Mueller & James -- a Berkley, 
>Michigan, law firm where she was employed -- to various bank 
>accounts in South Africa and Taiwan.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 12:52:00 -0500

>It is not incredibly complex; many people have already implemented bits of it.

That sounds more like support of my claim than a rebuttal.  :-)

>server all of the time; that's why we have STARTTLS and SMTP AUTH.

You didn't address any of my examples.

Again.  My mother is standing at the email kiosk in an airport.  She 
wants to send email to you.  You've authorized one of her temporary 
email messages to send email to one of your temporary email messages. 
Now what?

>Your server keeps track of everything.

Address book.  Somebody needs to keep track of what email address can 
send to what email address.  This is typically an address book.  How 
does this get implemented without the use of MUA changes?  Even 
assuming that I always use the same computer, I don't see it.

Feel free to take this offlist if you think I'm being incredible obtuse.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 13:10:58 -0500 (EST)

> email messages to send email to one of your temporary email messages.

She logs on to her ISP's Webmail system, where all of her locked
addresses are stored.  Using her "normal" (to her) e-mail address, she
sends you a message over the Webmail.  The ISP's server looks up the
originator address and the destination address, modifies
appropriately, and shoots it off.

Piece of cake.

> send to what email address.

The server.  Your server keeps track of who can send to all of your
ephemeral addresses, and my server keeps track of who can send to mine.

Do you recall the e-mail "anonymizers" of the early 1990's?  You could
sign up for anonymous addresses, and the anonymizing-service would
keep track of who is who.  This is a similar system.

> This is typically an address book.  How
> does this get implemented without the use of MUA changes?

Easy.  In your address book, I am
"[email-masked]".  That's my address.  No problem.
Any mail you send to that address, from your own address, will work.
If you also have ephemeral addresses, then you need to send it out via
your server.  Your server obscures your address, but that's OK,
because my server knows *you* as "[email-masked]",
which is all it sees.

I am planning on implementing this, by the way; we'll see how it goes.

---

From: Jim Youll <[email-masked]>
Date: Fri, 7 Mar 2003 13:14:51 -0500

At 12:47 -0500 3/7/03, Kee Hinckley wrote:
>>According to court records, from February to August 2002, Poet 
>>moved $2.1 million, in amounts ranging from $9,400 to $360,000 per 
>>wire transfer, from the accounts of Olsman Mueller & James -- a 
>>Berkley, Michigan, law firm where she was employed -- to various 
>>bank accounts in South Africa and Taiwan.

I didn't see that particular story, but ...

a) there's enforcement happening at the other end now, and against 
scams generally, so... the economic disincentive for large-scale 
high-profit scams (on and off the net) comes from law and criminal 
punishment, not the mechanisms in any case.

b) I intuit that the volume of messages sent does not really 
correlate to the response rate (as it would for the sale of miracle 
products and herbal remedies and so on). Greed-driven scams are a 
different business

c) this doesn't go to the main points about why disposable or 
scope-bounded addresses can be useful at times.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Gary Feldman" <[email-masked]>
Date: Fri, 7 Mar 2003 13:42:56 -0500

> wants to send email to you.  

You mean father.  Mother's call.  Technologically adept mothers
use instant messaging.  Email is way too slow to satisfy
motherhood cravings.

TGIF  :-)

Gary

---

From: "Mark Delany" <[email-masked]>
Date: 7 Mar 2003 18:52:07 +0000

> Piece of cake.

[ Discussion of ephemeral/disposable addresses removed ]

> I am planning on implementing this, by the way; we'll see how it goes.

There are easier ways to "see how it goes". Why not pay ten bucks to
one of the numerous commercial offerings, such as spamex.com? Some
of these guys have been doing this stuff for years.

Regards.

---

From: Hadmut Danisch <[email-masked]>
Date: Fri, 7 Mar 2003 20:23:59 +0100

> wants to send email to you. 

I can't remember to ever have seen someone using an "email kiosk". 
All people I saw sending mail from airports, hotels, internet cafes
were using web browsers to log into some web/mail gateway like
hotmail, yahoo,...

Hadmut

---

From: [email-masked] (Justin Mason)
Date: Fri, 07 Mar 2003 19:46:19 +0000

> were using web browsers to log into some web/mail gateway like

FWIW, I used to work for a company that made these kiosks, and that's
exactly the case.

--j.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 15:12:01 -0500

>appropriately, and shoots it off.

I see.  You're saying that she sends email via her mail server (using 
some authentication mechanism to be specified by the server).  And 
that mail server retains an N-factorial list of possible email 
address combinations.  Your email client uses your "real" address 
sending to the MTA.  The sending MTA transforms that based on who you 
are sending email to.  And the receiving MTA receives it based on who 
it was sent to AND from.

So now not only am I tied to my ISPs whim for an email address 
(mediaone last year, attbi last month, comcast today), I'm also tied 
to them because if I go to another ISP I'm unable to send email to 
any of my contacts.  Not only will they reject the mail if I send it 
from a new address, I don't even know what their email address is!

Of course you can quarantine all of your email that someone sends to 
an address from the wrong address, and look at it.  And you can bet 
all your spam is going to have subjects like: "My email address just 
changed" in order to get you to open that mail.

You could also fix much of the problem by having a consistent concept 
of "identity" that could be checked by looking up an address (and 
vice versa).  But then we are talking about cryptographic 
authentication systems for individuals--again.

>because my server knows *you* as "[email-masked]",

You've got an interesting protocol problem for initial contacts 
between two people.  It involves quarantines, special server 
protocols for mapping addresses, and then remapping addresses once 
the recipient has decided on an ephemeral address to use.  I think it 
looks something like this:

0. You give me [email-masked], I put it in my address book.
1. I send email to [email-masked]
2. My server sets my from to [email-masked]
3. Your server quarantines my message until you can okay it.
4. Your server sends back a confirmation to my server telling it that 
your address for me will be [email-masked].
5. My server remaps [email-masked] to be the standard from 
address for mail to [email-masked].
6. My server sends me mail telling me that your address is 
[email-masked].
7. I add [email-masked] to my address book and remove 
[email-masked].
6. Finally we can talk.  But only if I use my server. And if I ever 
go anywhere else I can no longer communicate with you.  And of 
course, if I don't have a server that supports this, I have to handle 
this whole negotiation by hand.

I think having an address book that is so complex that only a server 
can manage it is a bad idea.  Tying it to your current email address 
(which as we all know, changes frequently for people) and company or 
ISP is even worse.

Fundamentally this is just another complex 
challenge/response->whitelist system, and they have two problems that 
I think will keep them from working.

1. They annoy customers, so businesses won't adopt them.
2. They don't work with automated business email, so customers won't 
adopt them.

We've already had at least one public complaint (and many private I'm 
sure) of Nate W, who is using such a system on this list.  (And a 
broken one as well, I've had to respond to "Nate's Secretary" 
multiple times already.)  And we've also seen the failure of content 
filters on this list.  I'm surprised nobody's bounced my domain due 
to some blacklist yet.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 15:44:51 -0500 (EST)

> that mail server retains an N-factorial list of possible email

It's not N-factorial; where did you come up with that?  It's
N-squared.

> any of my contacts.

No.  When you send mail to your contacts, you'll need to use their
public challenge-response address to revalidate yourself.

This is a pain, no doubt.  There's no pain-free way to end spam that I
can see.

> between two people.

No, not really.  Like I said, you have an initial challenge-response
contact address for the first contact.  You need to make the challenge
easy to solve by a human, but hard for an automated process.

> go anywhere else I can no longer communicate with you.

Yes, you can, via dfs-bizcard.

> can manage it is a bad idea.

Lots of people already do that.  LDAP, anyone?

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 17:30:23 -0500

>It's not N-factorial; where did you come up with that?  It's

Sorry.  Up too late last night.

>This is a pain, no doubt.  There's no pain-free way to end spam that I

True.  But this doesn't come close to ending spam.  All spam ends up 
having to be filtered by a system that tells you which messages in 
your challenge-response queue should be looked at.  Why go to all 
this hassle if you're going to have to filter anyway?  Yes, it's 
easier to filter, yes you can look less often.  On the other hand, 
with all these email addresses, you're going to have a lot more spam 
there.

>easy to solve by a human, but hard for an automated process.

It's more than just challenge response, there's a multi-step process 
going back and forth.  If I send you mail initially with a throw-away 
address then you have't a clue whether "Kee Hinckley" 
<[email-masked]> is really the person you were talking to at 
the conference yesterday.  So I have to send you email with my 
bizcard address in the from so you recognize it, and then you have to 
reply with your throw-away, and then I need to reply with my 
throw-away.

>Yes, you can, via dfs-bizcard.

So I actually need to keep *two* addresses in my address book for 
every person, and be careful only to use the correct one?  Or are you 
assuming that the server will remap the To: address as well?  I 
suppose it might as well.

>Lots of people already do that.  LDAP, anyone?

Nope.  LDAP is a static directory.  I can always download it to my 
desktop.  This address book is algorithmically driven.

Look.  From a technical perspective you're proposing something very 
cool with lots of flexibility and neat possibilities.  It's got lots 
of power.  You've even convinced me that it could be done.

But the average user isn't going to understand it at all.  Never mind 
that they don't need any of the side benefits.  There is no incentive 
for creating the infrastructure required for such a system.  It makes 
dealing with new people and new addresses much harder than it 
currently is in email or any other medium.  We've got people hear 
yelling at someone whose challenge response is simply a "reply", but 
you're proposing a complicated back and forth combined with a Turing 
test.

If we want a system to be deployed for end-user use, it's got to pass 
the elevator test.  That's the standard VC test for a concept. 
You've got to be able to explain it to someone during an elevator 
ride.  I don't see that with any system described so far.  That's why 
I'm convinced that the initial solution has to be a simple 
modification to the MTA, with later migration to the MUA. *Static* 
directory services still haven't taken off, I don't think dynamic 
ones are going to have any more success.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 18:35:09 -0500 (EST)

On Fri, 7 Mar 2003, Kee Hinckley wrote:

> your challenge-response queue should be looked at.

You don't look at that queue at all.  It's managed automatically; anything
that stays in the queue more than a few days without getting a response
is discarded.

> If I send you mail initially with a throw-away address then you
> have't a clue whether "Kee Hinckley" <[email-masked]> is
> really the person you were talking to at the conference yesterday.

Sure I do.  I remember you by your name, not your email address.

> every person, and be careful only to use the correct one?

Not necessarily.  If an email comes in for a throwaway address from
the wrong person, it could just issue a challenge.  So the only time
you need to update your address book is if you're changing ISP's.

> But the average user isn't going to understand it at all.

That's the problem.  It has to be implemented in a way that makes
it easy to use.  This is a long-term research group, right? :-)

--
David.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 21:04:04 -0500

>that stays in the queue more than a few days without getting a response

Ah.  I see.  So the Turing test is a necessary part of it.  Otherwise 
the spammer can simply automate the response and then send the spam. 
But now you've just said that you never check the queue.  So you 
don't get the quick message from someone going on vacation, the 
notification from the library system that your book is overdue, or 
the email from shipping at your favorite book company telling you 
that your book is out of stock.

>Sure I do.  I remember you by your name, not your email address.

But you've just reduced the limited amount of authentication that the 
email system has.  If I tell you my email address is [email-masked], 
and you get email from [email-masked], you can be pretty sure a 
reply will go to the real me.  If all you know is my name, and you 
get mail from someone claiming to be me  with the address 
[email-masked] you know only know whether the domain name matches 
what you were expecting.

I'm not saying this is a huge authentication problem as there 
probably aren't a lot of exploits--but it certainly seems like a step 
in the wrong direction.

I suppose you could work around it by using a convention based on the 
real address.  That would make things work a bit better.  (E.g. 
[email-masked]).  Then at least a human could 
reconstruct the original contact address.  Or do you consider that 
too much of an opening for spammers?

Then too, I have a bias towards long term identities.  I'm virtually 
certainly the only person in the world with my name.  Everything I 
say is directly traceable back to me, so I don't say anything online 
that I'm not comfortable having traced back to me, and I assume that 
anyone can contact me.  Now if the Eudora/PGP plugin would come back, 
I'd go back to signing all my messages as well.

>it easy to use.  This is a long-term research group, right? :-)

Sure.  But I'd rather see all that effort put towards something more 
obviously useful--like authentication.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society