Subject: RE: [Asrg] 5b. Opt-Out, 2nd version

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Mar 2003 16:57:35 -0800

Hang on a second here, I don't think anyone in the crypto world I'd
seriously worried about an atack which woud allow an attacker to find an
eficient inverse function for sha1 and I they did we would be sooo screwed
every other way it would not be funny.

I was thinking we would add boogus email addresses that have already found
their way to the lists...

 -----Original Message-----
From: 	[email-masked]
Sent:	Wed Mar 26 14:59:08 2003
To:	Kee Hinckley
Cc:	Hallam-Baker, Phillip; 'Brad Templeton'; 'Asrg ([email-masked])'
Subject:	RE: [Asrg] 5b. Opt-Out, 2nd version

> >We could add to the list addresses that are not actually valid - like
> >the striker addresses for example.

I think this is called "poison pill" and different pills can be inserted 
into lists that are distributed to different parties. Then if unwanted email

appears on this email, that can be used as verification that they 
decryppted entire opt-out list. 
 
> How would you validate them?  And if you don't, why wouldn't some 
> helpful person do a dictionary attack on the opt-out list in order to 
> remove everyone.

Similar "poison pill" system can also work for central server that 
provides authentication to get opt-out list. In this case you invent some 
easily guessable email addresses but not actually use it in any email. If 
somebody querries for it and gets opt-out no answer but then there are 
unsolicited emails coming to it, you know who did something wrong.

----
William Leibzon
Elan Communications Inc. 
[email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Wed, 26 Mar 2003 17:11:12 -0800

> their way to the lists...

The privacy goals are twofold.  We would like to avoid having to declare
publicly your desire to opt-out, though frankly this is not that much of
a killer.

Secondly, we would want to avoid spammers deliberately spamming all the people
who opted out because they can get a list of all of them.

The seeding idea is interesting.  It doesn't solve the first problem, your
name will still go on a list that can be made public, but as I said we can
probably survive that, it's just somewhat ironic to have to go public to
protect your privacy.

You would need to seed the opt-out list with hashes of tens of millions of fake
addresses, and those fake addresses would need to be ones that can't be
spotted as fake (they don't bounce) and which occur on popular spamming lists,
but which are not anybody's mailbox.

That's a bit of a tall order!

Reversing a secure hash is (of course) not an issue here, you don't need to
do it to turn the list of hashed addresses into real addresses when you have
the database of 50 million valid emails on CD the spammers trade around.  If
you get spam, you're on their lists, so they can make a list of everybody
on the opt-out list who is on a common spammer's list.

Now why they want to spam it I don't know, possibly for spite.  Only well hidden
overseas spammers would do it, but they would.

It is also a DoS attack on people.  If you hate somebody, extract the list of
opted out people, then fake mail from the hated person to thousands of opted
out people.  Presuming the opt-out is working, the recipients will be extra
angry, this would bring down a rain of trouble on the poor soul.

Perhaps this is the greatest danger of the opt-out list.  It also applies to
the special domain I described and all other systems though.  If opt-in were
morally acceptable, it would certainly be easier to implement, but it isn't.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Wed, 26 Mar 2003 15:31:10 -0800 (PST)

> every other way it would not be funny.
Technology advances, both in terms of scientific research on cryptography
and just pure computational force power. You can never assume it'll not be 
broken... 

In reality I was thinking more in terms of trying to add somewhat easily 
guessable poison email address to catch those doing dictionary attacks 
and using the results improperly.

But Brad is also right, if somebody has 100 million email addresses 
gathered from everywhere else and they wanted to clean it up to real 
addresses, they would check with this opt-out list of 20million addresses, 
there is good bet 99% of those 20million are contained in those 100million
(people would opt-out when they are already receiving too much unwanted 
email and their email is already known), that however does not mean there 
are no valid email addresses in remaining 80million so spammer would 
probably continue to send to all 100million anyway. 

But this does expose the problem that if you distribute list and let 
email marketing company do all validation on their own, they will get 
almost entire list. With cental server, while this is still also possible, 
at least the authority providing the service can gather statistics of how 
many queries each particulr authorized client is doing and if they see 
somebody doing brutal force check of their 100million addresses, they 
probably know its not a legit bulk mailer company. With opt-out specific 
to each domain, the ability to do central verification is gone so even if 
you see somebody doing this kind of check (which is difficult - you only 
know statistics for your domain), its unclear if you can have any serious 
response to it.

---

From: Chuq Von Rospach <[email-masked]>
Date: Wed, 26 Mar 2003 17:32:04 -0800

On Wednesday, March 26, 2003, at 05:11  PM, Brad Templeton wrote:

> The seeding idea is interesting.

if we revisit something I mentioned a while ago -- the idea of a 
"robots.txt" for e-mail, to allow a domain to define usage/consent 
rules in a standardized way. It's fairly trivial to extend that concept 
to include traps addresses, ones placed into that file specifically to 
catch people attempting to harvest and use the concent addresses. And 
any IP that mails to a trap address gets blackholed for a period of 
time.

It creates the problem of people using those addresses as an attack 
mode, but the attacks are fairly limited and can be handled: 
subscribing [email-masked] to [email-masked] only gets people in 
trouble to the degree they try to mail to bar.com, and only to the 
degree that the trap address becomes known outside of the folks 
controlling the domain -- and as it becomes known, its usefulness goes 
away and it should be changed, since the spammers will figure it out 
and wash it, leaving behind only something useful for the trolls...

this is a fairly common way to trap the web robots that misbehave, it'd 
be a reasonable way to both extend consent out for email and protect 
the addresses in the file, since it wouldn't be obvious what addresses 
are the traps, only that there are traps there. and yes, trap discovery 
is an issue, but there are ways to deal with that, also.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 26 Mar 2003 22:37:20 -0700 (MST)

> From: Brad Templeton <[email-masked]>

> ...
> ...

> ...

Why do some spammers curently test 10,000 arbitrary user names at many
domain names to see if they are valid with either Rcpt_To "vrfy" or
trial spam?  Whatever their reasons, wouldn't it be far faster and
easier for them to get the same information using the opt-out system?

Imagine that you are a spammer and do not have a current list of
targets.  What if you test against the opt-out system a list of 10,000
or 1,000,000 user names, starting with "tom", "dick, and "harry," and
continuing with zillions of other names including message-IDs and
other strings, all combined with a few 1000 or 1,000,000 domain names?
That would give you a list of many of the entries in the opt-out list.
If you were a spammer who doesn't believe the opt-out list applies
to your important message, could you use such a list?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Wed, 26 Mar 2003 23:09:13 -0800

> easier for them to get the same information using the opt-out system?

That is indeed the problem I am pointing out.   I noted dictionary attacks
as another possible avenue.  That's less likely with a cleaning "service"
in that the service could notice that you're trying to clean a dictionary
list, but even then it's hard to fully protect.

One way or another, if there is an opt out list, the spammers will get
ahold of most of it, and presumably abuse it.

However, it should be noted that this would be a particularly strong
offence, sent to people who are known hostile to spam, so doing this would
bring down even harsher penalties, but I wouldn't bank on their effectiveness.

If the list is seeded with tens of millions of addresses which are bogus, it
it becomes harder, but there must be no way for them to find out if those
addresses are bogus -- ie. you must not be able to verify them with vrfy,
and mail servers must accept delivery for them, or they will be quickly
weeded out.   The seeded addresses would of course contain lots of dictionary
style addresses (common names, initial plus common last name etc.)

But it would possibly result in a lot of spams you have to eat just to make
this tactic ineffective.

It was for this reason that I decided that the rather unsatisfactory approach
of getting a new mailing address that had a reserved word in the domain to
indicate opt-out was all that could be done to be immune to this particular
attack.   But it's pretty dramatic, having to get a new email.  (though you
could have an autoresponder on your old email to tell people about your
new one, and even forward the old one for a time etc.)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 27 Mar 2003 12:04:23 +0100

On Wed, Mar 26, 2003 at 10:37:20PM -0700, Vernon Schryver wrote:
> trial spam?

What evidence do you have they do?
I can't see this happen. We host about 10000 domains and we do log VRFY
commands. I see about one VRFY a day and and checking the session it's not
from spammers but someone using a telnet connection to speak SMTP and
playing around.

If you mean by verify that they use
  mail1.asp-platform.com:216.109.92.216 rejected:
    <[email-masked]>
    to <[email-masked]>
this would mean that they care for the results. They don't. Although the
above inject results in a permanent error every time, they did exactly
the same sender/recipient pair about 70 times within the last 12 hours.
Probing would mean doing it once, ok maybe 2-3 times to be sure, but not
70 times within 12 hours or 208 times within the last 36 hours or 368
times within the last 60 hours

The last "massive spam attack" were about 5 million bounces where the
spammers used the same username as sender name they used for the recipient,
i.e.
    from	[email-masked]
    to		[email-masked]
they didn't get the bounces back. We got them.
They simply don't care and why should they?

I have yet to see a reason why spammers should honor an opt-out list at all.
With snail mail it a massive cost factor, so "robinson lists" save a lot
of money for the sender.
With email nobody cares. And you will never get a law to enforce this
policy. And if you get it in country one they abuse it in country two.
And what worldwide resolutions/agreements mean this days can be seen in
tv and every newspapers for the last few days.

Discussing opt-out list strategies is IMHO a waste of time.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 27 Mar 2003 07:36:26 -0800

> With snail mail it a massive cost factor, so "robinson lists" save a 
It's yet another example of lumping the e-marketers in with the 
fraudulent spammers, and assuming they're one in the same in search of 
"a solution". The e-marketing segment is a different beast (and a much 
tinier problem) to the problem of all that forged garbage. The folks 
who are already hiding themselves won't deal with opt-out lists, other 
than to grab them to spam to them, also. Opt-out lists would be great 
with the e-marketing segment, but 100% compliance in that segment 
woldn't even be noticed if we don't fix the bigger problem.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 27 Mar 2003 08:57:18 -0700 (MST)

> list, but even then it's hard to fully protect.

I don't understand that.  I am talking about a dictionary attack on
the opt-out list.  Separately, anyone running an SMTP server and paying
any attention notices some current dictionary attacks.  Some dictionary
attack spamware seems to be multi-threaded and hits SMTP servers with
100s of names per second.

> style addresses (common names, initial plus common last name etc.)

Enough people already use trap lists such as
http://www.rhyolite.com/anti-spam/dict-attack.html so that there are
millinos of such traps.  They are somewhat effective for things like
the DCC, but they're certainly not The Final Solution To Spam.

> new one, and even forward the old one for a time etc.)

I don't understand that because it seems to imply that people either
opt-out of everything or nothing.  Anyone who want's to opt-out of
everything is best served by not having an address, or at least not
having an address that is ever given to anyone but very close personal
friends who won't pass it on.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 27 Mar 2003 09:14:39 -0700 (MST)

> From: Markus Stumpf <[email-masked]>

> from spammers but someone using a telnet connection to speak SMTP and

I see almost no use of the SMTP VRFY or EXPN commands.  Instead I and
many others see uses of the SMTP RCPT_To command (sometimes followed by
DATA) to get the same effect as VRFY.  Note that sendmail does not
normally log RCTP_To commands used in place of VRFY.

> I have yet to see a reason why spammers should honor an opt-out list at all.

Spammers vary.  Some don't want to offend prospective customers and
see everyone as a prospect.  Others don't have as as much foresight
and don't care if they offend non-customers.

> Discussing opt-out list strategies is IMHO a waste of time.

I think "arranging deck chairs on the Titanic" fits.  It's not a
complete waste, but so far the benefits seem unlikely to be enduring.

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 27 Mar 2003 17:48:06 +0100

> normally log RCTP_To commands used in place of VRFY.

I use a heavily patched qmail and I see everything ;-) like
   12-247-32-83.client.attbi.com:12.247.32.83
	allowed: <[email-masked]> to <[email-masked]>
using this method against a qmail smtpd doesnt make sense at all, as
qmail will accept all messages, except for blocked sender addresses
(badmailfrom).

> and don't care if they offend non-customers.

I have talked to a former customer (a publisher of computer magazines)
who did a spam mailing to about 50000 addresses to get new subscribers.
He said he doesn't care much about offending. The users that read it
and find it interesting aren't offended and do a trial or become
subscribers at once. The ones that are not interested may be offended,
but he doesn't care about them.
IMHO the problem with spam is that it still works, 'cause if they are
interested they say "damn, it's spam, but it's interesting" and they
but it.

I also know about a smaller ISP that fought (and fights) spam whenever
possible. But when one of the admins was spammed with a offering for
cheap USENET news service via satellite they signed the contract with
that company. *sigh*

	\Maex