Subject: Re: [Asrg] Economic model is borken. (sic.) Let's fix it

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 Mar 2003 17:29:10 -0800

>Now as far as I know, I wrote the first challenge/response spam
>blocker 6 years ago, so I've been running tools like these longer
>than anybody else.

I believe that John Mallery of the MIT AI lab has a prior claim 
there. He wrote a challenge/response authentication callback
loop back in 1992 for the COMLINK mailer that we used to 
publish the Clinton/Gore '92 (and the other candidates who made
it available) campaign litterature on the Internet.

Nathaniel Bornstein applied the same technique to filter his mail,
spam was not a severe problem at the time but Bornstein thought
he got rather a lot of mail. He then used the same idea yet again 
as the basis of the First Virtual payment scheme. 

I don't think that the response loop idea is acceptable as a general
solution. In my view it should only be used as a last resort if
a mailer has exhausted every other means of authenticating the
sender. That means SSL, S/MIME and PGP. Nobody should be using 
intrusive means of authentication when there are non-intrusive
options available.

The reason for this should be obvious, response loop messages are
just another form of spam. I use the term spam to mean any 
unnecessary message I don't want.

As readers of the IETF list will be aware I have recently taken
exception to certain people who send a challenge every time they
get an email, unless they think the sender important enough to
be put in their whitelist.

I think it is acceptable to send a callback loop request if all
other means of authentication have been exhausted first and the
message in question has been identified as having a high 
probability of being spam. Otherwise this type of behaviour is
simply anti-social.

Another problem with some of the challenge response services on
the net is that some of them  have a pretty poor understanding of
privacy and confidentiality. One of these services recently spamed
me saying 'we notice that you recently responded to one of our
callback loops'. Sounds to me as if someone needs a session at the
blunt end of a cluebat.

		Phill

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 22:21:50 -0500

>it available) campaign litterature on the Internet.

The other problem with challenge/response systems is that there's a 
missing link in the interface.

I go to a web site and purchase something.  They send me an email 
receipt.  How exactly are they going to automatically get through my 
challenge response?  And don't say "you should have whitelisted 
them."  J. Random User is not going to do it unless it's as simple as 
hitting a single button.  Not to mention the question of "whitelist 
*what*?"  Their sales address?  Their support address?  Their domain? 
And using what authentication system?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 11:34:35 -0800 (PST)

> intrusive means of authentication when there are non-intrusive

How intrusive is it for a person to expect all correspondents to use
S/MIME or PGP authentication?  Most of the people I correspond with don't
even know what those are, let alone know how to use them.

My inbox is presently guarded by an autoresponder that sends and receives
return-address confirmation requests via SMTP.  One might say that, in
effect, I consent to receive email from people who use (and monitor) the
"From" address that they use.  While not technically elegant, this method
is widely implemented and pretty well understood.  

I'd love to replace it with something less intrusive, but I don't think
it's really my decision.  Rather, the decision lies in the hands of all
the people with whom I correspond.

So then the problem is getting everyone to use SMIME or PGP or whatever.  

They don't have to know they're using it (just like they don't "know" what
SMTP stands for), it just needs to be pervasively implemented.

> probability of being spam. Otherwise this type of behaviour is

I disagree with that assertion - autoresponder-based whitelists are a net
gain for the community.  Since instituting my autoresponder and whitelist
about a year ago, I've received about two pieces of spam.  The number of
unseeing spam messages is probably around 1500.  I've probably sent a
couple dozen (admittedly annoying) confirmation requests to actual human
beings.  In the big picture, the number of annoying messages put before
live humans has dropped from 1500 to 25.  If everyone took up whitelisting
and automated confirmation, the number of unwanted messages everyone
received would drop by a comparable ratio.  I don't think this that's an
anti-social vision at all.  To the extent that it is, the blame lies on
the penis-extension people and their ilk, not those who have instituted a
system that results in a reduction of the total number unwanted messages
arriving in inboxes.
 
It's not a perfect solution, and I hope we can come up with something
better, but it works.  I note that this very mailing list uses a similar
method to screen subscription requests.  I don't consider that
anti-social, in fact I consider it a very wise practice.

The bandwidth cost of every piece of spam goes up by a factor of two to
three, though - there's the confirmation request, and then the bounce
report created by said request.  That's the drawback I have the hardest
time rationalizing.  But it works *very* well, and that's rationalization
enough for me.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 15:51:32 -0800 (PST)

On Wed, 5 Mar 2003, Kee Hinckley wrote:

> challenge response? 

Sometimes I whitelist the domain beforehand, most times I just check the
'holding pen' folder for a message from the merchant some time later.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 6 Mar 2003 23:04:10 -0500

>'holding pen' folder for a message from the merchant some time later.

The question is not how we do it.  But how someone's grandmother is 
going to do it.  There is no interface.  It's an error-prone and 
manual process.  It also completely fails when a company changes it's 
name, or when the primary domain is not the same as the particular 
store you shopped at.

One can certainly imagine standards to deal with this problem. 
Browser plugins, special URLs....

But fundamentally whitelisting fails without authentication.

In fact, I just got one such.  A social engineering paypal theft 
scam.  Mail from Canada, with a form that submits to Rusia, which 
then sends the email to Florida.  Fortunately it fails a trivial 
header check.

>Return-Path: <[email-masked]>
>Received: from 24.222.182.119 ([24.222.182.119] verified)
>   by somewhere.com (CommuniGate Pro SMTP 3.5.7)
>   with SMTP id 2086244 for xxxx; Thu, 06 Mar 2003 17:08:43 -0500
>Date: Thu, 06 Mar 2003 18:19:51 -0600
>From: [email-masked]
>To: xxx
>Subject: Your PayPal account is Limited.
>Mime-Version: 1.0
>Content-Type: text/html; charset=us-ascii
>Content-Transfer-Encoding: 8bit
>X-Mailer: Microsoft Outlook Express 5.50.4522.1200
>Message-ID: [email-masked]

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 23:40:30 -0800 (PST)

> name, or when the primary domain is not the same as the particular 

Granted that we aren't our own target market, and it's error-prone and
manual, but IMAP and a good mail client will provide a UI for the holding
pen folder.  From the receiver's point of view, it's just a good filter,
and like most filters you do need to check the hits from time, and
definitely when an expected message doesn't make it to your inbox.

> But fundamentally whitelisting fails without authentication.

Fails occasionally, and would be greatly improved without authentication,
but I think it's only a couple good client implementations away from
acceptance by a sizable chunk of the market.  As filters go, it works very
well and requires little maintenance.  

How would you propose using strong authentication for the 'reciept from a
merchant' scenario?  Or would you?

More interestingly, how do you propose adding authentication to email, in
general?

> then sends the email to Florida.  Fortunately it fails a trivial 

Nigerian bank scammers are the only ones to get through my filter so far
(two, maybe three occasions).  I was beginning to think that they were the
only spammers who actually read their responses.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 12:35:00 -0500

>Fails occasionally, and would be greatly improved without authentication,

It fails occasionally only because whitelisting is not widely used. 
Use it widely and the spammers will adapt.  I just had to reply to 
someone's damn challenge response system on this list.  Any spammer 
wanting to hit people on this list need only browse the archive, 
construct a list of who spoke to whom, and spam away.

>well and requires little maintenance.

Given the correct UI I will grant that it requires little maintenance 
for individuals who talk to their friends.  It requires quite a bit 
for individuals who rely on email for their day-to-day business.  But 
the point is, and I think a large number of people have already made 
it on this list, that solutions that require changing the MUA are 
less likely to gain acceptance than systems at the MTA level.

>More interestingly, how do you propose adding authentication to email, in

Of the systems I've seen proposed, I currently lean towards domain 
authorization.  Is this MTA allowed to send email from this domain? 
To that I would add a fallback that says, if not, is this *user* 
authorized to send email from this domain?  The first is a simple DNS 
lookup.  The second requires cryptographic tokens.  I would combine 
that with a public distributed checksum database, fed by the major 
ISPs (who must be authorized to join it, and who must meet certain 
standards of behavior).  I would then argue for a gradual system that 
works like this.

1. Initially ISPs only block bulk email that doesn't match the 
authorized domain standard.
2. Over time as companies move to protect their domains (and that is 
the incentive--protecting yourself from forgery), they can (or 
individuals can) block based on domain or personal authentication 
even for non-bulk email.  Note that at this point there is still no 
MUA change required unless you are sending email from a location 
other than one authorized by your domain.

I think that meets the necessary requirements of placing changes in 
the locations where they are most likely to be made, and providing 
for a gradual path to greater and greater security.

What I don't know in that model, is how we deal with malicious ISPs.

At 12:08 AM -0800 3/7/03, Nate W wrote:
>  If the sender values the message so little that they
>won't do something simple to get it through to me, then there's no reason
>that I should value it enough to read it.
You missed the point of the original poster.  The value of my sending 
you a bug report is far greater to you than to me.  I can walk away 
without losing anything.  You lose big.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Nate W <[email-masked]>
Date: Fri, 7 Mar 2003 13:08:05 -0800 (PST)

On Fri, 7 Mar 2003, Kee Hinckley wrote:

> someone's damn challenge response system on this list.  

It may have been mine, and (if the message above is any indication) it was
probably because you addressed a reply directly to me (or whoever) while
CCing the list.  Sending replies to the list alone would make more sense,
but that's neither here nor there.

This may be optimistic, but I don't think spammers will adapt to
widespread whitelisting.  They'll try, but they'll fail.  Maintaining
"Millions" CDs of address pairs (recipient and a whitelisted sender known
to work for that recipient) is a big job.  First there's the problem of
finding a whitelisted address that actually works.  Then there's the fact
that a single spam gets through, the address pair ceases to work.  
Two-Millions CDs might get popular, but they won't make much difference in
the amount of spam actually seen by whitelist users.

Sending spam with a customized address in the "From" header of every
single outgoing message requires much more bandwidth than the usual relay
hijack approach of sending a single message with many enevelope
recipients.  It does happen now, but AFAICT it's unusual, I assume because
it requires enough bandwidth to get noticed and stopped.  I'm curious
about this though, if anyone has evidence to the contrary I'm all ears.

(Note that I see whitelisting as a way to address the problem of time
wasted by recipients.  It does not solve the bandwidth-waste problem, in
fact I acknowledge that it makes that problem worse.)

> Any spammer wanting to hit people on this list need only browse the
> archive, construct a list of who spoke to whom, and spam away.

That assumes that there's a lot of off-list conversation going on among
the list members.  Having an autoresponder&whitelist setup reduces that a
bit. :-)

Having usable addresses posted in mailing list archives strikes me as an
exceptionally bad idea, though.  It's rather ironic that an anti-spam
group would create such a resource for spammers.  There's plenty of ways
around this problem.

> But the point is, and I think a large number of people have already
> made it on this list, that solutions that require changing the MUA are

True, but I doubt that there will be an effective MTA-level solution.  
The information the MTA has to work with just isn't enough to make a
reliable decision about consent. (Not to mention the number of MTAs
controlled or hijacked by spammers.)  We have DNSBLs and the like, and I
think that's about as far as MTA-only solutions will get.  Adding
information for the MTA to base the consent decision upon will require
changing the MUA at one end or the other.

I'd love to believe that there's an MTA-only solution out there, but it
seems to me that the MTAs don't have access to enough information to solve
this problem.  But again, I'd like to be persuaded to believe otherwise.

> authorized domain standard.

Sounds like an authenticated MTA-based whitelist.  I like it.

> other than one authorized by your domain.

How does one block email based on sender authentication information
without adding authentication information to the message with an
MUA?  Perhaps I misunderstand; please elaborate.

> What I don't know in that model, is how we deal with malicious ISPs.

I like that model a lot.  Two ideas come to mind for dealing with losers:

Revoke their certificates.  How this is accomplished is left as an
exercise for the reader.

Require member ISPs to join with a contract stating that they will:

a) pay cleanup costs associated with spam from their domain;
 
b) pay extra for their membership, with the extra cost paying for
 spam-control infrastructure;

c) pay all costs associated with legally persuing individuals or
organizations who send spam through that ISP (this should encourage the
ISP to create and enforce strict terms of service for their customers);

d) put a deposit in escrow upon joining, to be refunded if they
leave the origanization on good terms, to be forfeited it to pay for
expenses as above.  This would be an obstacle to smaller ISPs though so
I'm not real fond of this one.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Troy Rollo <[email-masked]>
Date: Sat, 08 Mar 2003 08:37:45 +1100

At 13:08 7/03/03 -0800, Nate W wrote:
>to work for that recipient) is a big job.

1. That's not the only way to adapt to whitelisting.

2. This ignores the damage done by whitelisting.

See pp17-22 of 
http://www.noie.gov.au/projects/confidence/Improving/Spam/Interim_Report/CAUBE_Sub.pdf

In fact if you haven't been working on the spam problem for a few years at 
least, you should probably be reading that whole document in order to come 
up to speed (or at least to have enough basic knowledge to start evaluating 
proposed solutions).
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 18:27:26 -0500

>about this though, if anyone has evidence to the contrary I'm all ears.

I just ran a database query on 22,000 pieces of confirmed spam. They 
came from 18,000 distinct email addresses.  They already have to 
change the from header because they need to avoid filters and 
checksums.  In fact, if I look at the top repeating addresses most of 
them are actually viruses.  The rest are messages from spam-friendly 
bulkmailers (GreatDeals, DailyInbox, ClickForMail...).

Now admittedly, that's on a small user-base and over time.  You'd 
need to talk to someone with a huge real-time database to get an idea 
of how frequently they change the data.

>exceptionally bad idea, though.  It's rather ironic that an anti-spam

I've long since given up worrying about obscuring my email address. 
My experience has been that your address on one web page or having it 
on 4000 does not make much difference in how much spam you get. 
Having it on one just means the spam ramps up a bit more slowly.  I'm 
not going to let spammers get in the way of people communicating with 
me--whether by obscuring my email address or by using challenge 
response systems.

Then again.  Microsoft put my webmaster address on every template 
shipped in one version of FrontPage.  So I'm kind of resigned to 
having my addresses public.  The number of sites that change the text 
of the mailto but not the data is scary.  The number of people who 
click on it and don't notice (or know to edit the address) is even 
more so.

>changing the MUA at one end or the other.

First of all, I think we can go a long way without even thinking 
about consent.  You need to leverage incentive.  Legitimate bulk 
mailers (like ZDNet and those that handle commercial mailings) are 
running scared.  Two many anti-spam solutions are likely to nail 
them.  (Especially the ones that talk about economic models.)  They 
are incented to authenticate, and they'll pay to make it happen.

[Kind of repeating what I said before here, but I'm still trying to 
come up with the clearest version of the process.]

MTAs at ISPs are incented to reduce volume and customer complaints. 
They could use existing systems to identify bulk email, but they'd 
get false positives (mind you, some of them don't care :-).  Combine 
a tool for recognizing bulk email (e.g. DCC) and a tool for 
authorizing bulk mail (pick one) and what we have left are the 
lower-volume spammers.

A solution?  No.  But we've bought ourselves some breathing space.

*Then* we can talk about moving tools into the MUA.  Again, we start 
where the incentive is there.  Nobody likes their domain to be 
forged.  The vast majority of users are at ISPs and enterprises. 
Those domains can implement domain authorization systems similar to 
what we imposed on the bulkmailers.  Who gets burnt in the legit user 
space?  The roadwarriers and the techies, who now have to find a way 
to authorize their out-of-domain email.  But those are the folks who 
will find it with the pain to take advantage of MUA changes, VPNs or 
other techniques.

At that point you've reduced the number of forgeable email addresses 
by (I'm completely guessing here) an order of magnitude.  Now it 
becomes reasonable to start instituting general filters against all 
unauthenticated email, not just unauthenticated bulk email.  And with 
that, the DCC-like portion can be retired from the system.

>MUA?  Perhaps I misunderstand; please elaborate.

You still make it an MTA decision.  Mind you, that doesn't mean that 
the end user can't make the choice via a configuration option--but 
the blocking is done at the MTA.

>Require member ISPs to join with a contract stating that they will:
...

Keep in mind that this assumes they have to join something.  It's not 
clear how you persuade (for instance) 163.net to signup for anything. 
Sure, they don't get to block spam with the system, but who's going 
to stop them from sending?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Nate W <[email-masked]>
Date: Fri, 7 Mar 2003 16:18:11 -0800 (PST)

> 1. That's not the only way to adapt to whitelisting.

If you've got a more worrisome idea I'm all ears.  I did read the document
you referenced and did not see anything to be very concerned about.  

Some of the "problems" listed there were not very well thought out.  For
example, the "problem" of establishing initial communication between two
whitelisted individuals, subscribing to mailing lists, etc.  The author
seems to have assumed that non-approved messages are lost forever.

> 2. This ignores the damage done by whitelisting.

Yes, because you snipped the bit that didn't.  I acknowledge (for the Nth
time) that there are costs to whitelisting.  However I believe the cost to
be smaller than the benefit.  Not perfect, but I find it a big
improvement, at least until something better comes along.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: Troy Rollo <[email-masked]>
Date: Sat, 08 Mar 2003 11:28:34 +1100

>seems to have assumed that non-approved messages are lost forever.

As I indicated, that document is a starting point - it doesn't enumerate 
each difficulty through all possible angles to its final conclusion. I 
would suggest that if you think these are not problems, you haven't done so 
either.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 21:52:44 -0500

Kee Hinckley wrote:

> came from 18,000 distinct email addresses.

Tried a bigger sample.  Out of 1715448 spam _connections_, 659228 unique 
MAIL FROMs.

---

From: "Eric S. Johansson" <[email-masked]>
Date: Sat, 08 Mar 2003 09:07:08 -0500

Kee Hinckley wrote:
> challenge response?  And don't say "you should have whitelisted them."  
> J. Random User is not going to do it unless it's as simple as hitting a 
> single button.  Not to mention the question of "whitelist *what*?"  
> Their sales address?  Their support address?  Their domain? And using 
> what authentication system?

problem has been solved with stamps.  I know I'm sounding like a broken record 
(or will very shortly).  The model is if you filter for stamps, then a robot can 
attach a stamp to an auto response and it will get to your inbox.  It's simple, 
it's reliable, and if you make the right stamps, it's not easily exploited by 
spammers.

by using stamps, you will eliminate any need for special white listing, domain 
authentication, complicated dns reverse lookup rules and can be implemented 
quickly and easily without major changes to infrastructure.

---eric

---

From: "Eric S. Johansson" <[email-masked]>
Date: Sat, 08 Mar 2003 09:09:31 -0500

> 2. This ignores the damage done by whitelisting.

3. ignores the theft value of white lists

If white lists become widespread, they will become a theft target.  You'll see 
more identity theft as result of white lists.  Happy, happy, Joy, joy

---eric

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 8 Mar 2003 10:03:10 -0500

At 9:07 AM -0500 3/8/03, Eric S. Johansson wrote:
>problem has been solved with stamps.  I know I'm sounding like a 
>broken record (or will very shortly).  The model is if you filter 
>for stamps, then a robot can attach a stamp to an auto response and 
>it will get to your inbox.  It's

1. What is the incentive for a company to add a stamp?  You initiated 
the transaction, and now you are charging them to communicate with 
you about it.  Why won't they just add a disclaimer to the site 
telling you that you should let there stuff through?

2. If they do automatically add a stamp, what keeps me from abusing 
that fact by continuously generating non-paying transactions which 
require responses?

(If you've got an FAQ on these things somewhere, feel free to point me at it.)
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 8 Mar 2003 08:54:03 -0700 (MST)

> From: "Eric S. Johansson" <[email-masked]>

> > challenge response?  ...

>attach a stamp to an auto response and it will get to your inbox. ...

No, that is not a solution, because it is based on the engineering of
wishful thinking.  So is absolutely any other idea related to the
Internet that begins with "Install X at most Internet X" when X is a
kind of hardware or software operated by 1,000 or more people.

Anything that requires actions by 1000 people or 0.01% of the relvant
population, whichever is smaller, before it is useful will probably
never happen and certainly cannot be relied on.

Unless the first few dozen individuals who install your proposed change
benefit significantly, there will never be another few dozen individuals
who install it.  People do not do things unless they see some real
benefit from it or progress toward their goals.

Charging for email is an exceptionally hopeless idea, because it starts
with "first a large minority of users install email stamp software
and buy stamps."  Until at least 10,000,000 people regularly stamp
their messages and require stamps on incoming mail, stamps are only
overhead that will merely cause legitimate mail to be lost.

If the next XP automatic update installed the necessary software, you
would still not have critical mass.  You would still need to convince
the first 10,000,000 to buy e-stamps.  Until all of your correspondents
had bought e-stamps, your own roll of e-stamps would be useless.  Your
friends would see how little you got out of the exercise, and somehow
never get around to buying their own rolls of e-stamps...or signing up
with Verisign for a PKI email non-spamming identity or any other
proposal that starts "first you get everyone to ..."

When do you think the IESG would install e-stamp software on all of
the IETF WG mailing list systems?  Before you answer, note that most
of the spam I suffer comes from IETF lists because their operators
refuse to install minimal spam filtering such as rejecting mail entirely
in Asian character sets.

Look at history:

 - PayPal looks like it could survive, because the first people who used
    it got some good out of it.  If you need to pay or receive $10,
    rendezvousing on a PayPal account is easier than sending a check.

 - the WWW took off because HTML was somewhat useful for the first
    users as a mark-up language and a very few individuals at enough
    big outfits (e.g. CERN) pushed it as a network thing that it
    was immediately useful to others at those big outfits and eventually
    outside.

 - Paul Vixie's RBL took off because the first people who used it
    it benefited.  It was similar for all other well known blacklists
    and non-distributed filters.

 - the DCC took off and will survive as long as new versions of the
    checksums stay ahead of the spammers, because the handful of
    outfits that first tried the DCC had enough mail traffic to exceed
    its required critical mass and so got some spam filtered that
    would otherwise have been delivered.

On the the other side, the dot-com boom and bust is filled with ideas
that went "first we'll get lots of users, and then those users will
find it useful and we'll get more users." Look at the history of
"micropayments."  That idea is quite similar to e-stamps, and was a
dud.  If you don't remember microspayments see
http://www.openp2p.com/pub/a/p2p/2000/12/19/micropayments.html

In the real world, if the first "early adopter" users don't find it
useful (whatever it is), you will never have a second batch of users,
and the early adopters will soon drop it.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Johansson" <[email-masked]>
Date: Sat, 08 Mar 2003 11:28:10 -0500

Kee Hinckley wrote:
>> broken record (or will very shortly).  The model is if you filter for 
>> stamps, then a robot can attach a stamp to an auto response and it 
>> will get to your inbox.  It's
> 
> 
> the transaction, and now you are charging them to communicate with you 
> about it.  Why won't they just add a disclaimer to the site telling you 
> that you should let there stuff through?

good question.  here are two answers that I usually give.  Which works for you?

1) the incentive is to make sure their messages delivered.  In the physical 
world, if I call them up on the telephone and order a catalog, they have an 
incentive to add postage to make sure I get but I asked for otherwise they risk 
me taking my business elsewhere.  so, why should not be the same electronically.

2) increasingly, antispam filters are taking out legitimate communications from 
businesses.  The use of a stamp would allow them to bypass the filters without 
requiring the recipient to do anything special (i.e. white list, filter exception).

> 
> 2. If they do automatically add a stamp, what keeps me from abusing that 
> fact by continuously generating non-paying transactions which require 
> responses?

this is a serious risk factor before near full adoption.  In a nutshell, the 
business would need to be careful about how many messages it was prodded into 
generating for a given address.  There would need to be some logic put into the 
robot to say "hey!  I have received over X messages in the past Y hours from 
this user.  Time to get a human".

another variant of this would be to create a denial service attack by forging 
from address so simple logic like the above wouldn't work.  A third variant 
would be to have a robot hammering on the Web site generating message requests 
to random destination addresses.

I accepted this is a weak spot but I believe it can be solved.  Using techniques 
such as address probes (i.e. does this domain/user exist) and rate analysis 
(normal vs. abnormal levels of traffic) can help minimize the impact.

There are some other solutions I'm thinking about but they aren't well enough 
formed for public disclosure.

> (If you've got an FAQ on these things somewhere, feel free to point me 

unfortunately, not yet.  have you read http://harvee.billerica.ma.us/camram/ 
yet?  I want to do an faq in a wiki but I need a wiki for the camram site and I 
haven't had the cycles to set it up.

---eric

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 8 Mar 2003 14:20:51 -0500

At 11:28 AM -0500 3/8/03, Eric S. Johansson wrote:
>1) the incentive is to make sure their messages delivered.  In the 
>physical world, if I call them up on the telephone and order a 
>catalog, they have an incentive to add postage to make sure I get 
>but I asked for otherwise they risk me taking my business elsewhere. 
>so, why should not be the same electronically.

That incentive does not exist until a significant percentage of 
systems block non-stamped email.  Until then the only person 
suffering is the one who installed a non-stamp-blocking system, not 
the vendor.

>2) increasingly, antispam filters are taking out legitimate 
>communications from businesses.  The use of a stamp would allow them 
>to bypass the filters without requiring the recipient to do anything 
>special (i.e. white list, filter exception).

This logic works better.  But of course any standard authorization 
mechanism can provide this benefit, not just stamps.

>this is a serious risk factor before near full adoption.  In a 
>nutshell, the business would need to be careful about how many 
>messages it was prodded into generating for a given address.  There 
>would need to be some logic put into the robot to say "hey!  I have 
>received over X messages in the past Y hours from this user.  Time 
>to get a human".

I can register a new domain for $10.  I can receive all email sent to 
that domain, and create a new one every day.  Now if you aren't going 
to give me a cut of the stamp price, then maybe I don't have a big 
incentive.  But if you are then you have a fraud problem.

>I accepted this is a weak spot but I believe it can be solved. 
>Using techniques such as address probes (i.e. does this domain/user 
>exist) and rate analysis (normal vs. abnormal levels of traffic) can 
>help minimize the impact.

Yow.  That's a pretty heavy bit of infrastructure for doing nothing 
but set up a mailing list.

Something to remember when thinking about fraud, spam, and attacks on 
the internet--especially when comparing to that in real life.  There 
are lots of things that people would never do in real life that they 
will do online.  Furthermore, do to the point to point nature of the 
internet, every single lowlife in the world has a direct connection 
to you.  So, multiple decreased inhibitions by increased access and 
you've got to be a lot more careful.

The other thing that really concerns me about spam fighting is the 
cost of unintended consequences.  Stamps are one type of solution 
that is very prone to this, as are many of the legal solutions people 
have proposed.

These solutions don't try to stop spam.  They try and set rules for 
spamming.  "You may spam if you pay postage."  "You may spam if you 
provide an unsubscribe address."  These solutions legitimize spam. 
They open up the door for lawsuits against ISPs who block email that 
meets the rules.  They send a message to every company in the world 
that it's okay to send email to people who didn't give consent, so 
long as they follow the rules.  A postage-paid system that doesn't 
put a company like ZDNet out of business (what, a million messages a 
day or something like that?) is *not* going to be a barrier to entry 
for most companies.  Instead of having a thousand or so spammers 
running around hitting you every day, you're going to have tens of 
thousands of companies sending you email every month saying, "If you 
don't want to be on this list, please follow these arcane unsubscribe 
directions."  This will *not* be an improvement.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Eric S. Johansson" <[email-masked]>
Date: Tue, 11 Mar 2003 13:06:25 -0500

Kee Hinckley wrote:
>> catalog, they have an incentive to add postage to make sure I get but 
>> I asked for otherwise they risk me taking my business elsewhere. so, 
>> why should not be the same electronically.
> 
> 
> That incentive does not exist until a significant percentage of systems 
> block non-stamped email.  Until then the only person suffering is the 
> one who installed a non-stamp-blocking system, not the vendor.

agreed.  Every single solution I've seen here on this mailing list has a major 
problem getting away from T0.  Solution I'm proposing as implemented by camram 
is a filter chain that allows messages to escape the filter by either stamp or 
white list.  The last stage is a classic Bayesian filter for message sourcing 
into Spam/good mail/indeterminate.

This model of filter gives you benefits from day one even if a small number of 
users adopt the filter.  It lets senders validate themselves if their message is 
categorized wrong and most Spam is still filtered.

> mechanism can provide this benefit, not just stamps.

yes but the other authorization mechanisms are frequent more clumsy and or fail 
because of centralized infrastructure requirements.  Proof of work stamps such 
as hashcash work extremely well in this setting.

>> I accepted this is a weak spot but I believe it can be solved. Using 
>> techniques such as address probes (i.e. does this domain/user exist) 
>> and rate analysis (normal vs. abnormal levels of traffic) can help 
>> minimize the impact.
> 
> 
> Yow.  That's a pretty heavy bit of infrastructure for doing nothing but 
> set up a mailing list.

Granted, one could hammer the subscription side of the house but it's a fairly 
low risk target.  In any case, it clearly need more thinking to solve the problem.

> the internet--especially when comparing to that in real life.  There are 
> lots of things that people would never do in real life that they will do 
> online.  Furthermore, do to the point to point nature of the internet, 
> every single lowlife in the world has a direct connection to you.  So, 
> multiple decreased inhibitions by increased access and you've got to be 
> a lot more careful.

very good point.  I've been thinking about this for quite a while and have 
closed most of the holes.

> The other thing that really concerns me about spam fighting is the cost 
> of unintended consequences.  Stamps are one type of solution that is 
> very prone to this, as are many of the legal solutions people have 
> proposed.
> 
> provide an unsubscribe address."  These solutions legitimize spam. They 
> open up the door for lawsuits against ISPs who block email that meets 
> the rules.  They send a message to every company in the world that it's 
> okay to send email to people who didn't give consent, so long as they 
> follow the rules.  A postage-paid system that doesn't put a company like 
> ZDNet out of business (what, a million messages a day or something like 
> that?) is *not* going to be a barrier to entry for most companies.  
> Instead of having a thousand or so spammers running around hitting you 
> every day, you're going to have tens of thousands of companies sending 
> you email every month saying, "If you don't want to be on this list, 
> please follow these arcane unsubscribe directions."  This will *not* be 
> an improvement.

I agree it's a concern.  And I will argue two points.  First, stamps will drive 
off most spammers.  Second, even if it does create one million legitimate e-mail 
advertisers, that is an improvement.  Like it or not e-mail advertising is not 
going to go away.  The best we can hope for is raising the costs so it's 
minimized and use this opportunity to create the right cultural rules which are 
often stronger than legal rules.

At the end of the day, the unintended side effects will be something that 
neither of us considered.  And we will go around and try and solve that problem 
as well.

---eric

---

From: "Eric S. Johansson" <[email-masked]>
Date: Tue, 11 Mar 2003 13:10:27 -0500

> kind of hardware or software operated by 1,000 or more people.

as I have already explained in another post, I'm building something that will 
work even if only a single person uses it.  Obviously, full effectiveness isn't 
reached into you have a significantly higher number but it will be effective. 
It's a transitional tool.

> overhead that will merely cause legitimate mail to be lost.

if you had read the document I had been pointing people to, we're not talking 
about purchasing stamps.  Stamps are generated through a proof of work puzzle 
known as hashcash.

> and the early adopters will soon drop it.

yup.  I agree.

---eric

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 11 Mar 2003 11:24:58 -0700 (MST)

> work even if only a single person uses it. ...

> about purchasing stamps.  ...

You need to include a URL every time, because I don't recall anything
I'd call "hashcash" that is of any use against spam for its first
50,000,000 users.

>                        Stamps are generated through a proof of work puzzle 
> known as hashcash.

The things I've seen described named as hashcash are hopeless for many
reasons but most obviously because the speeds of computers on the net span
a performance range of more than a factor of 1000.  Systems that spammers
can use are more than 1000 times faster than systems used by non-spammers
who need to send and receive bulk mail (albeit not as bulky as most spam).

It's probably far too early discuss any particular solution.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 11 Mar 2003 20:20:47 -0500

At 1:06 PM -0500 3/11/03, Eric S. Johansson wrote:
>drive off most spammers.  Second, even if it does create one million 
>legitimate e-mail advertisers, that is an improvement.  Like it or 
>not e-mail advertising is not going to go away.  The best we can 
>hope for is raising the

This is why I promised to go off and write a short summary of why 
spam is bad (not what it is--but just what is bad about it).  One 
million legitimate e-mail advertisers could inflict far more damage 
on the network and email users than spam currently does.  If stamps 
are set so low that existing bulk mailers can afford it, then they 
are set low enough that the tragedy of the commons still applies. 
The email in my inbox is still going to be trying to fool me into 
opening it--it's just that when I do, the contents won't be quite as 
offensive.

>costs so it's minimized and use this opportunity to create the right 
>cultural rules which are often stronger than legal rules.

To date we have not been terribly successful in creating a culture 
for cyberspace.  The barbarians overran us at the gates.  :-)

>At the end of the day, the unintended side effects will be something 
>that neither of us considered.  And we will go around and try and 
>solve that problem as well.

"Hi, we'd like you to install this complex infrastructure.  We don't 
know if it will make things better.  It might make things worse.  But 
it *will* stop spam if everyone does it."  We need to work on that 
marketing pitch :-).

At 1:15 PM -0500 3/11/03, Eric S. Johansson wrote:
>Stamps are generated automatically through the outbound e-mail 
>filter. see: http://www.camram.org/camram_engine.html  section 
>"Outbound messages"
>
>No purchases necessary, no human interaction provides better user experience.

I just read your document.  If she sends email without a stamp there 
is most certainly human interaction.  You require the sender to 
download software to generate a stamp.  Consider the fun a virus 
writer will have forging copies of that message.

An in any case, you still have to deliver the message, just in case 
it's important.  Yes, it's in jail.  So for an early adopter, all 
their received email ends up in the "bad message" folder.  And any 
commercial senders, faced with either buying hardware to generate 
stamps, or just letting a few early adopters fetch their email out of 
the junk bucket, do the cheap thing--nothing.

At 1:46 PM -0500 3/11/03, Eric S. Johansson wrote:
>Let me rephrase my comment them.  The cost of sending e-mail on a 
>low-end machine will probably the only about 30 or 40 seconds per 
>address[1].  This

I'm not clear how you say the user won't notice.  That's 40 seconds 
that the email client sits there saying "sending email" in it's 
(often modal) dialog box.  And if you background it, you need to 
figure out how to deal with dialup users, who thought they had sent 
their email and can now disconnect, but actually can't yet.  And 
that's just for one address.  Sending a joke to all the people in 
your address book could get pretty annoying pretty fast--especially 
when 90% of your friends don't need the stamp in the first place. 
Again, the problem is that it's causing pain for early adopters, but 
not providing any benefits.  (I'm starting to feel like a broken 
record*.)

On the other hand, as Vernon has pointed out, the high end machines 
don't seem to feel the pain.  So, looking at this from the standpoint 
of who values their realtime more, we're hurting the end-user more 
than the spammer.

* I just dated myself, didn't I?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society