Subject: RE: [Asrg] PKI and Filters

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 8 Mar 2003 17:13:52 -0800

> That went wrong in a couple of ways.  People like C|Net and 
> specifically
> including C|Net have well earned reputations as senders of 
> unsolicited,
> unwanted, unasked for, irritating, commercial bulk mail.  

Which it why I believe we have to have a protocol that makes 
consent an empirical fact that can be checked by the MTA.

Let us get away from the whole 'he said she said' thing.

> The second wrong turn is that what advertisers like C|Net want don't
> matter, except to the extent it affects their own behavior.  The only
> people with standing to complain about false positives are people who
> failed to receive mail.  People who failed to send can go pound sand.
> As the slogan goes, "My mailbox, my rules."

The problem is when ISPs claim this. So they have a subscriber 
who pays to get an INTERNET account and then finds that the ISP
is going to decide who she gets mail from. Oh it turns out that
planned parenthood is on the ISPs blacklist.

Don't think such a thing is impossible. SPEWS recently listed 
the whole of UUNET because a maintainer took a dislike to a
Web site they hosted. Several blacklists list the whole of China
and Korea.

And presumably if you subscribe to something like Amber Alert
which relays the state amber alert (kidnaped kids) warnings to 
subscribers you probably want to get the messages.

> How will Hotmail and Yahoo ensure that a new user is not a spammer?

They have pseudo turing tests for subscribers and they implement
rate limiting. You cannot send 100 emails a minute from a new 
hotmail account. There are also limits on connections from the
same IP address.

> On the other hand, if Hotmail requires a credit card number, they can
> detect Ralsky, or at least wreck the credit rating of the owner of the
> credit card.  However, they could to that today without 
> Verisign's "help."

They could or they could take advantage of the extreemly
reasonable prices of VeriSign payment services.

> The result of that would be to cram the Internet back into the old
> AOL/Genie/Compuserv fancy BBS model. 

You forget who you are talking to, I did more to destroy that 
model than most people on this list.

> I'm sorry to be so blunt about the Verisign nonsense, but
> SHEESH--give us a break!

Don't deny yourself a tool out of spite.

If you believe that you can do just as well with self signed certs,
or raw keys in the DNS that is fine too.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 8 Mar 2003 18:42:05 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

 ...
> planned parenthood is on the ISPs blacklist.

You wrote about C|NET, not ISPs.  C|NET is not an ISP but an
advertiser, or at best a publisher.

> Web site they hosted. Several blacklists list the whole of China

Are you sure of your facts there?  I don't recall hearing of SPEWS
listing all of UUNET's IP addresses.

> ...

So you're saying that Hotmail users could no longer send mail from
other ISPs using their Hotmail addresses as Reply-To, From, or Sender
header values or envelope Mail_From values?  So you'd push them back
into the AOL BBS model and off the Internet?  I hope that is impossible.

> reasonable prices of VeriSign payment services.

The credit card factor, whether PayPal, VeriSign, or some other
outfit is obviously irrelevant.  So why did you mention Verisign?

> model than most people on this list.

No, you forget who you're talking to, and I'm not referring only
to myself.  There are, or were the worst of the flood, readers who
I think did incomparably more than you to break open the BBS model.

> or raw keys in the DNS that is fine too.

My problems with commercial CAs have nothing to do with spite, but
with their business models.  The prices of certs are orders of magnitude
too low to do the things that the customers of commercial CA vendors
are lead to expect they're buying.  You can't verfy my identity for
a mere $150-$350, no matter how good your intentions, and so you (not
just Verisign) cannot issue a cert that really authenticates me.  
I suspect a $350 price won't buy the liability insurance for errors
in issuing certs, and that is why Verisign says "here's a cert, but
we really don't know if it's any good so don't call us if it's a waste
of bits and CPU cycles that causes you to lose money or launch missles."
On the other hand, even $350 is barely below the price point for a
commercial cert.  No user will spent $50 to buy a cert for a personal
mailbox, which is why no one has a Verisign personal cert.  Cert
vendors simply cannot get the money to do honest authenticating because
cert buyers won't pay for it.

My problem with Verisign itself is not spite, but continuing lies and
gross misrepresentations.  Your obviously completely bogus claim that
Verisign has had anything whatsoever to do with keeping credit card
numbers out of the hands of bad guys is classic Verisign self-serving
knowing misrepresentation.  Perhaps you assumed no one around here
knows about DH or other means to get session confidentiality.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 8 Mar 2003 19:02:31 -0700 (MST)

I just wrote:

]                        Perhaps you assumed no one around here
] knows about DH or other means to get session confidentiality.

To forestall quibbles, yes, a simple DH exchange with random keys won't
exclude men in the middle.  To exclude a man in the middle, you need
something like certs.  However, I've never heard of any men-in-the
middle attacks on "internet commerce" sessions that certs would have
prevented.  There have been plenty of man-in-the middle attacks on
credit card numbers, but they've been outside the parts of the path
protected by public keys or within the end systems.  Two recent examples
are described in http://catless.ncl.ac.uk/Risks/22.61.html#subj9 and
http://catless.ncl.ac.uk/Risks/22.61.html#subj10

See also http://www.securitymanagement.com/library/000836.html
http://www.counterpane.com/pki-risks-ft.txt
http://www.securityfocus.com/columnists/60
http://www.csl.sri.com/users/neumann/insiderisks.html#132
and http://www.microsoft.com/technet/security/bulletin/ms01-017.asp

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 08 Mar 2003 16:34:44 -0500

Vernon Schryver <[email-masked]> wrote:
> header values or envelope Mail_From values?

  If those users have Hotmails consent, that's fine.  If the mail
recipients can verify that consent, it's also fine.

  Without those two parts of the puzzle, the recipient can only tell
he's being lied to.  Lack of informed consent means no consent, and
the deceitful mail should get trashed.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 8 Mar 2003 20:09:22 -0700 (MST)

> From: "Alan DeKok" <[email-masked]>

> recipients can verify that consent, it's also fine.

I guessed at two different intended meanings for what the other person
was talking about.  The other involved checking Hotmail's consent
about mail from another outfit and so not going back to the BBS model.

Checking Hotmail's consent is not trivial in practice, unless you are
a member of the Wishful Thinking Design School and accept handwaving.
It's not obviously impossible, but neither is it obviously practical.

---

From: Kee Hinckley <[email-masked]>
Date: Sun, 9 Mar 2003 13:35:52 -0500

>mailbox, which is why no one has a Verisign personal cert.  Cert

I was.  I tried to go from a their free one to a paid one.  But 
Versign told me I had to change my name :-)

>At 1:15 PM -0400 5/10/97, ID-Center wrote:
>  >Dear Kee,
>  >
>  >As an evaluation ID, Revocation/Replacement is not available.  To obtain
>  >another ID, simply return to the enrollment pages @
>  >http://digitalid.verisign.com/brw_pick.htm   Since our systems will  not
>  >process duplicate orders, please add a digit such as the number "1" to the
>  >end of your last name, to complete a new enrollment.
>  >
>  >Thank you for using VeriSign's Digital ID Services.
>  >
>  >Customer Support
>  >VeriSign Digital ID Center

Seriously though, you are correct.  The cost of true verification is 
higher than the cost anyone is going to be willing to pay for it--the 
benefits aren't big enough.

On the other hand, the cost of verifying that you really own the 
email address you say you own is definitely manageable (and could 
even be done without human intervention).
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg