Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Eric D. Williams" <[email-masked]>
Date: Mon, 31 Mar 2003 15:09:23 -0500

Although I think this already exists in one form or another [RFC2635 - "DON'T 
SPEW..."].  Has anyone considered drafting a preliminary or running list of MTA 
configuration best current practices for reducing 'spam'?  Phill, from your 
posting I perceive that may be something that you could begin to work on (with 
others or not). Certainly any work product could be improved, evaluated and 
substantiated by the group.

All: A question is the discussion of end-user MUA technology uses of encryption 
something people want to address as a 'spam' control solution?  This is just a 
question.

-e

On Monday, March 31, 2003 2:42 PM, Hallam-Baker, Phillip 
[SMTP:[email-masked]] wrote:
>
> > > >Well, if you were a spammer and you did that, you'd soon be out of
> > > >business.  I would estimate that fewer than one in 100 e-mail users
> > > >use PGP or GnuPG at all, and even fewer than that have a
> > public key.
> > > >So you'd drastically limit your audience.
>
> PGP is irrelevant, every major email client with the exception of
> Eudora has supported S/MIME for 5 years now. There are half a billion
> S/MIME clients out there.
>
> The problem is that few clients are currently configured to use
> encryption. This is going to change in future, in part because of
> spam and in part because its the right thing to do.
>
>
> > > >In fact, widespread use of GPG-style encryption could help defeat
> > > >spammers.  If most people only accepted encrypted messages (except
> > > >from whitelisted mailing lists and such), it would become very
> > > >expensive to spam.  (Yes, I know this will never happen -- don't
> > > >bother replying.)
>
> Unfortunately not, there are SSL accelerators that do thousands of RSA
> operations a second. They are unfortunately not FIPS approved in general
> but spam senders don't care about that.
>
>
> > It was only an example. But I do wonder.. any encrypted PGP
> > or GnuPG message
> > would have higher social credibility for me...
> >
> > But imagine this in a message:
> > --- start---
> > [javascript]
> > $cypher_text="dsfjhsjdfhsdfjksdhfskjfhsd.."
> > function decrypt(key, cypher_text){
> > /* do description */
> > document.writeln($plain_text)
> > }
> > [/javascript]
> >
> > [body onload=decrypt("aasc", $cypher_text)]
> > --- finish ---
> > Now all your filters, Bayesian or not, will only work on the
> > actual text
> > seen between start and finish.
>
> Not necessarily, run the code in a sandbox, if you can't trust
> the code enough to do that then certainly don't forward it to
> the user, discard it like any other virus.
>
> > No filtering will be done of
> > the "message" -
> > what the user sees.  Furthermore, variable and function names
> > are infinitely
> > variable, and what is not variable is standard html/js stuff and has
> > significant legit use.
>
> First I don't believe there is any legit function for Javascript
> and absolutely not in email. Filter all active code at the firewall
> unless it comes from an authenticated and trusted source.
>
> This goes for attachments too, filter out all the word and excell
> documents with macros unless the sender is trusted. There must be
> code readilly available to detect macros in these files.
>
> Second renaming the variables does not affect the ability of
> recognizers to detect it, this was demonstrated by some anti-cheat
> software that was developed at Southampton University in the
> 1980s. Code can be identified by the structure very easily.
> Virus checkers use the same techniques.
>
> 		Phill
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 15:35:03 -0500

> -----Original Message-----
> From: Eric D. Williams [mailto:[email-masked]]
> Sent: Monday, March 31, 2003 3:09 PM
> To: 'Hallam-Baker, Phillip'; 'Jason Hihn'; Jim Youll; David F. Skoll;
> [email-masked]
> Subject: RE: [Asrg] How to defeat spam that uses encryption?
...
> something people want to address as a 'spam' control solution?

I certainly hope not. End to end encryption will destroy server-side content
filtering, unless it holds private keys in escrow.  If it does, it's not
that bad, though there are several advantages drawbacks:
1d) Bandwith of public key retrieval. I'm assuming you have to ask my email
server for by pub key before sending me a message.
1a) slows you down, increases your bandwidth needs. Requires you to work in
lock-step with other email servers that may be sharing information and
conspiring against you (RTBL, see 3a)

2a) eliminates one-message-to-all, takes more CPU
2d) hurts mailing lists, takes more CPU

3d) you're a spammer and you will know I exist
3a) Before sending a pub key, check B&w lists

Of course, these keys could be implemented completely transparently to the
user.

But I think we are better off NOT using it, just for the fact that I don't
want anyone to be able to determine that my email address is valid before
sending.

Not to mention that this stuff could not be implemented in a global scale.
France is very much against any kind of encryption. Whatever methods we
choose must be globally applicable, and that fact is enough to eliminate
this as a standard.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 31 Mar 2003 17:29:30 -0700 (MST)

> From: "Eric D. Williams" <[email-masked]>

> something people want to address as a 'spam' control solution? 

It's a complete non-starter and waste of time, because it suffers
the threshold problem in the worst way.  Early adopters get no
benefit and many hassles.  Despite decades of work, the mechanisms
to distribute keys are practically useless.  The user interfaces
are coming along, but they're still poor and sometimes just don't work.

You can sometimes justify the practical hassles of encryption for
keeping your communications private, but that avoids the threshold
problem.  Many of us have used at least PGP for professional reasons,
but that's a whole other world.

Encryption, whether signing by senders or decrypting by receivers, is
useless against spam until almost all of your correspondents use it.
If you receive mail from a representative sample of strangers on the
Internet, that implies that encryption will be useless to help your
spam problem until almost everyone on the Internet uses it.

Whitelists are snake oil in this context.  If you can whitelist everyone
who sends mail to you because they won't be using encryption at first,
then you can just whitelist them and forget about the encryption.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg