Subject: [Asrg] Answers to the questions on PKI etc

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 20 Mar 2003 10:45:12 -0800

OK Bob and others have made some statements about PKI and how it won't work
because the spam senders are organized.

Well so ar the gangs that do credit card fraud, offline gangs will go as far
as renting premises, setting up storefronts and doing legit business for
many months before they take in a huge amount of business, get the account
factored and run. There are instances of that online but not as many as
offline.

The fact is that providing a registered address is very hard for a spam
sender to do. The big ones simply do not want to give an offline identity,
it is hard to do that in a way that cannot be traced back, particularly if
you intend to do so repeatedly. The cost of a certificate is not going to be
a major barrier for spamhaus, but the authentication process is.

The other point is that authentication is only one half of access control.
The other half is authorization. You are not obligated to accept a message
just because it is signed or otherwise authenticated.

However a simple algorithm for choosing the parties I would whitelist would
be to take the F500 companies, the Internet 500 companies, the edu domains,
the major ISPs who implement rate filtering, etc.

All the rest of the mail would go through very tight filtering and I would
accept a very high level of false positives on the residual. 

If someone really wants to contact me they can go to a hosted mail provider
that implements rate limiting and send a contact ping.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 21 Mar 2003 20:21:21 -0700 (MST)

> To: [email-masked]

> ...

That's another way of saying that serious (e.g. crypto) authentication
has little to do with spam solutions.  Little spam is forged from the
F500 etc., so you can get most of the effects of using serious
authentication by whitelisting those domains with (an equivalent of)
sendmail access_DB entries (i.e. toy authentication) and then requiring
contact pings and so forth.   This avoids holding your correspondent's
hands while they figure out certs, CAs, PGP key rings, or whatever you
pick for authentication.

(Note that I said "relatively little spam is forged from the F500
etc.," but not "no spam".)

Of course, the trouble with this is that white-listing is not a
solution for spam except for people who don't have or need not have
a spam problem, because they do not want to receive mail from
strangers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg