Subject: RE: [Asrg] My Opinion regarding ietf asrg session (it went badly! )

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 21 Mar 2003 17:08:56 -0800

> I agree that the meeting was.... unbalanced. It would have be en more 
> appropriate to have a meeting like this at a symposium or conference 
> attended by management and 'decision makers'.

I was pretty irritated that more time was spent on ill informed comments
against certificate based authentication alone BEFORE the authentication
presentation than was spent on the authentication presentation.

We had four people come to the mike with comments about why certificates
won't work before they had actually been proposed.

Such comments are rarely constructive or usefull. In particular I was very
surprised to see people who should know better stating that a straw man
system in which email from anyone with a certificate is automatically
accepted is 'not going to work'. Well like Homer Simpson would say
Duuuhhh!!!!

That is not the proposal that has been made on this list but we had four
people attacking this straw man at great length. I would hope in particular
that people who have been arround PKIX for as many years as Bob Moscowitz
would have enough of a clue to realize that I would not suggest anything as
stupid as the proposal he argued against.

You cannot rely on certificates alone. Once people use certificates on a
widespread basis the spam senders are going to attempt to get hold of
certificates. This is expected.

The first line of defense is to have good authentication procedures. CAs who
perform authentication before a certificate is issued are going to provide a
higher bar for the spam-senders. As Jon demonstrated spam senders, in
particular garbage creators do not want to give a genuine address.

Disclosure of interest - I have a commercial interest here since once the
spam senders decide they need certificates they are going to start with the
CA's whose 'authentication process' consists of an unchecked Web form.

A second line of defense is the law, anyone who applies for a certificate on
the basis of false information has committed fraud in practially every
single jurisdiction where the law means anything.

Spam senders are not going to be deterred by certificate cost but they can
and will be deterred by the risk of being caught. Obtaining a false
instrument for monetary gain is a serious offense. Using a false instrument
to obtain computer services (mail delivery) is a very serious offense that
the FBI, Special Branch, Interpol etc. treat very seriously.

Of course the Nigerian scams are pretty sophisticated and it is likely that
false businesses will be established that meet the authentication criteria
for a certificate to be issued. Note that the cost here is not the amount a
certificate might cost but the cost of setting up the front business. If a
lot of certificates are required these costs increase dramatically since any
cert that can be linked to a spamy cert can also be revoked.

The third line of defense is black listing and revocation. To take
revocation first, it now works PERIOD. We have the proven capacity to
support revocation via OCSP or XKMS at any scale. This is not cost free,
that is why the cert cost might well be higher for high, high volume certs.
Caching is going to be an absolute MUST here. The CA has to reserve the
right to only provide a limited number of responses for the same cert within
the given validity period 10 lookups a day good, 10,000 an hour and you get
blocked).

It may not be possible to revoke a spammy cert however as the criteria for
revocation are quite strict - as strict as the original authentication
criteria. This is where blacklisting and more likely greylisting comes in. A
mechanism is required to report that a certificate is considered 30% spammy.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Fri, 21 Mar 2003 20:21:04 -0500

I believe it is possible to formulate solid arguments regarding why 
an approach will *or will not* work, without trying it first. That 
there's been a shortage of solid arguments doesn't change this.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 22 Mar 2003 13:05:56 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

>  ...

> ... 
> ...

If that could work, then we would not have a spam problem.  Spammers
already must identify themselves to reputable ISPs with something that
has the relevant features of certificates, including laws against
fraud that are sometimes even enforced.  Those things are credit card
numbers.  In reality we have the spectacle of ISPs including Sprint
claiming they can't figure out how to deal with credit card fraud even
when a single spammer has used hundreds of stolen credit card numbers
and is known by name.  We also have ISPs advertising "try us for 2
weeks; no credit card required" on central California radio stations
yesterday.

It makes no sense to expect ISPs to know their customers well enough
to issue certs that might reduce spam when they can't be bothered
to know their customers today to reject well known spammers. 

If certs were required to send mail, then we'd have big ISPs distributing
CDROMs labelled "4000 free hours" and automatically issuing certs
along with user names and passwords.  There would be no change from
the current situation, except that the commercial CAs would have
another revenue stream.

Any spam filtering you might do based on certs can be done better and
faster on IP addresses, unless you can white-list all of your incoming
mail because you don't want mail from strangers.  If Ralski &co. could
not get new certs as often as required to keep sending, then they also
could not get new blocks of IP addreses.  We know they've no trouble
getting either single dial-up addresses or fair sized blocks, and so
simple logic shows that they could get as many certs as they might need.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Sun, 23 Mar 2003 09:50:42 +0000

>the current situation, except that the commercial CAs would have

If Certs were required to send mail AND were only issued under strict terms
and conditions AND revocation for T&C violation was properly managed.
Then you'd have a CA that was actually earning its income.

I think these certificates would probably cost considerable more than
personal certs do now.

--

---

From: Dave Crocker <[email-masked]>
Date: Mon, 24 Mar 2003 17:55:13 -0800

Jon,
JK> If Certs were required to send mail AND were only issued under strict terms
JK> and conditions AND revocation for T&C violation was properly managed.

And if everybody were a nice person, we would not have this problem.

When offering an "If" please discuss the feasibility of implementing the
proposal.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>