Subject: Re: [Asrg] Certs required to send mail ?(Was: My Opinion regarding ietf asrg session (it went badly! ))

From: "Jon Kyme" <[email-masked]>
Date: Tue, 25 Mar 2003 12:48:30 +0000

> Jon,
> JK> If Certs were required to send mail AND were only issued under strict
> terms
> JK> and conditions AND revocation for T&C violation was properly managed.
> 
> 
> And if everybody were a nice person, we would not have this problem.
> 
> When offering an "If" please discuss the feasibility of implementing the
> proposal.
> 

Dave,
I think you may have missed the context of my reply, 
which was not to make a proposal as such - but to comment on
this point made by Vernon Schryver

>
>If certs were required to send mail, then we'd have big ISPs
distributing
>CDROMs labelled "4000 free hours" and automatically issuing certs
>along with user names and passwords.  There would be no change from
>the current situation, except that the commercial CAs would have
>another revenue stream.
>

(Which might profitably have been quoted in your response)

The feasibility would hang on a CA issuing certs only subject to
strict T&C, taking responsibility for revoking in the case of demonstrated
violation of that T&C and for client software to correctly consult
revocation
lists.  The technology for this is all well-understood but there doesn't
seem to be a body in place offering this facility.  But I'm not proposing
such a system - that's for others with more expertise in this area. And
besides,
its a business problem rather than a technical one.

This is probably equivalent to the CA maintaining a whitelist.
(with some cryptographic overhead :-)  )
As has been suggested previously in this group, a trusted whitelist
is very close approach to a "good solution".

--
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 08:58:29 -0700 (MST)

> From: "Jon Kyme" <[email-masked]>

> its a business problem rather than a technical one.

No, Dave's response was on target.  If ISPs would enforce strict T&C,
there would be no spam.  User names and passwords are required to send
spam, and ISPs could terminate accounts for spamming.  Expecting ISPs
to revoke certs for spam when they now refuse to termiante accounts
for spam makes no sense.

There is essentailly no spam that is not ultimately the responsibility
of an ISP that is trivial for spam targets with minimal technical
clues to identify.

To send spam, every spammer must identify itself to an ISP.  That ISP
knows every customer using its sevices so that it can bill its customers,
as well as detect bad behavior such as DoS attacks.  It takes time and
effort to sift RAIDUS or other logs to discover that the IP address
10.2.3.4 that sent spam at 10:01 GMT was in use by port 1234 on server
567 and that Joe Spammer had used a CHAP password to identify himself (or
his computer), but no rocket science is needed.  Adding certs to user
names and passwords does not affect what ISPs can and ought to do to stop
spam.

Similarly, every spammer's web pages are hosted by an ISP that could
enforce T&C's against spam.

This applies to open proxies.  Essentially all ISPs prohibit running
open proxies.  Spam whose original ISP is hidden by an open proxy
could be stopped by the second ISP enforcing its T&C against open
proxies.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 25 Mar 2003 16:30:22 +0000

>to revoke certs for spam when they now refuse to termiante accounts

NO, begging your pardon, you're mistaking me - I commented that a *CA* 
(not necc. an *ISP*) revoking a Cert would be required to make something 
like this work.  I know that applications have failed to check back up 
certificate chains for revocation, but if this were done then an ISP would
be unlikely to risk their cert by signing spammers certs.  

Please by all means argue with what I said, but it's most unfair to shoot
me down for saying something that I did not in fact say.

I'm not sure whether this is feasible at all. I don't claim any special
knowledge in this area.

>could be stopped by the second ISP enforcing its T&C against open

Yes absolutely, and there's currently no sanction against rogue ISPs
except blacklisting.

You implied that the use of certs could have no impact on this issue,
I merely pointed out how it *might*.

I'm sorry that I didn't make myself clear enough.
I hope this helps.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 10:04:30 -0700 (MST)

> ...

> ...

I didn't understand that the idea was to have CAs revoke the certs of
ISPs when ISPs failed to revoke the certs or terminate the accounts
of spammers.  However, that is even more implausible than expecting
ISPs to start terminating spammers.  UUNet won't terminate its small
resellers that cater to Ralsky and friends.  Why would Verisign revoke
UUnet's certs, merely because third parties complain to Verisign about
getting spam from UUNet's customers?

You must "follow the money" in any proposed solution.

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 25 Mar 2003 17:32:23 +0000

>getting spam from UUNet's customers?

Well, a better question is why would [ISP name here] buy a certificate
from [CA name here]
with which to sign it's subscribers mail certs (and risk having it revoked
if
they don't revoke subscribers) ?

A. Because (many users at) Hotmail and AOL don't accept mail without it.
(in my fantasy)

See? Following the money. Also (as I've said) a "business" rather
than a "technical" problem. I'm not qualified to judge the business case 
for this - you?

Anyway signing at the ISP is probably cheaper to deploy.
I believe there has been discussion of signing in transport (received
headers?) .

I don't understand why there's this almost "religious" objection to
proposals
based on signing - I guess that that shows how little I understand this
"culture" .

Incidentally, which of "the man"s categories should this thread belong in?
Or should it go off list?

---

From: Dave Crocker <[email-masked]>
Date: Tue, 25 Mar 2003 09:49:17 -0800

Jon,
Tuesday, March 25, 2003, 9:32:23 AM, you wrote:
JK> A. Because (many users at) Hotmail and AOL don't accept mail without it.
JK> (in my fantasy)

let's assume that getting them to adopt the mechanism would, in fact,
make the mechanism useful.

have you ever tried to sell anything to either of those two
organizations?  they are predictably unresponsive.  (that's not a
criticism of them, merely an observed fact.)

and pure logic or predictions of the future are not persuasive
arguments.  they need to see very, very high likelihood -- read:
certainty -- that they will directly and immediately benefit from the
change.

JK> I don't understand why there's this almost "religious" objection to
JK> proposals
JK> based on signing

it is not religious.  it is the result of 10 years of direct experience
trying to get large-scale cert-based systems deployed... unsuccessfully.

JK>  - I guess that that shows how little I understand this
JK> "culture" .

it's true that some standards groups tend to ignore experience.  the
ietf commits that sin -- to use a religious reference -- sometimes, but
we try not to.

d/

>>Vernon Schryver    [email-masked]

JK> --
JK> _______________________________________________
JK> Asrg mailing list
JK> [email-masked]
JK> https://www1.ietf.org/mailman/listinfo/asrg

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 11:14:05 -0700 (MST)

> ..
> ..

You are qualified to judge the cases that matter to us.  You and I
might not be able to say much about the revenue stream that Verisign
is after, but we can certainly judge the business case for AOL and
Hotmail or AOL and Hotmail users refusing mail from [ISP name here]
because of a lack of a certificate.  We can't know dollar figures,
but we can predict the conclusions of the people in charge from
what they've already decided in essentially identical cases.

If certificates could do as you've proposed, then AOL, Hotmail, and/or
their users could just reject by the IP address or domain name of [ISP
name here] in envelope, header, or body (e.g. URLs).  If there could
be any risk to the cert of [ISP name here], then there would be the
same risk to it's IP address and domain name.

What is the practical difference between the BGP feed of the RBL+ 
and any certifcate system?  Think of an IP address as a certificate.
The IP address of the SMTP client is unique and practically unforgable.
[ISP name here] risks being cut off by not dealing with its spammers
and being listed in the RBL.
(The BGP feed of the RBL+ causes listed outfits to disappear from
the Internet as seen by subscribers.)

Yes, I know the RBL has not ended spam.  The reasons are not
mysterious and apply to all of the propsed certificate or other
authentication schemes.

It's discouraging that people are still saying that authentication
would fix spam years after common MUAs (e.g. Netscape) can send and
check signatures and/or keys and SMTP-AUTH, SUBMIT, and SMTP-TLS are
universally available.

---

From: [email-masked]
Date: Tue, 25 Mar 2003 13:17:02 -0500

> than a "technical" problem. I'm not qualified to judge the business case 

I believe Douglas Adams had a nice quote about "how many philosophers had
come up with many explanations for mankind's unhappiness, most of which
involved the movement of small green pieces of paper - which was odd, as
in general it wasn't the small green pieces of paper that were unhappy".

AOL and Hotmail aren't gonna do *SQUAT* with certs unless it's clearly
demonstrated to them how it will help their small green pieces of paper
in *THIS* quarter's SEC filings.  Stockholders don't seem to be interested
in the long-term prospects, why should upper management?

> based on signing - I guess that that shows how little I understand this

The problem is that even those of us who *believe* in crypto are having a
hard time seeing how to jump-start the PKI on the scale needed to stop
spam.  I sign stuff, and I've advocated that the next release of Sendmail
be shipped to by default advertise STARTTLS (generating a self-signed cert
with openssl if needed) just to piss the Echelon people off.

That doesn't mean I know how we can launch either a PGP or x.509 PKI that's
sufficiently large, robust, *AND* trustworthy to be useful as a one-stop
fix for spam.

The problem is that there's *three* requirements up there, and people want to
make it a solution.  What we seem to be lacking is a general understanding
that any anti-spam solution is going to be "chinese menu - pick one from column
A, B, and C".

A nice column-B ruleset:  If it's signed by a cert that's strong enough to
link it to a person or business entity, it's probably not spam. If it isn't
signed, see column A and C.

A bad column-B ruleset: If it's not signed by a cert, reject/spam/whatever it.

See the difference?

---

From: Brad Templeton <[email-masked]>
Date: Tue, 25 Mar 2003 11:08:22 -0800

> to revoke certs for spam when they now refuse to termiante accounts

One can make this case, but I have always felt the IETF's broader goal was
suport of an end-to-end internet.  As such, ISPs are just there to route
packets, not to enforce policy.   Can we attain that 100%?  Probably not,
but we certainly want to try.

The irony of this is amazing.  I remember one day on slashdot there were
two highly active threads.  One was about the value of the end to end
principle, and the other was about a UDP for the largest australian ISP which had
too many spammers on it.  (Blocking all usenet postings from the ISP, even
from the innocent users.)

All day long most of us decry when ISPs and firewalls take policy steps, trying
to ban certain protocols, putting in secret proxies, stopping you from
natting, and we tell them they should worry about their core business, which
is routing packets quickly and reliably.   Then when their downstreams
do something we don't like, we blame them for non-enforcement.

I'm not saying we might not, in the end, have to give up some of the end
to end principle to stop spam.  But we should do so kicking and screaming.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Tue, 25 Mar 2003 10:27:03 -0800 (PST)

But ISPs do terminate accounts for sending unsolicited emails in any kind 
of large number. There is a reason why all spammers have switched to China.

ISPs that don't terminate spammers make it worth for themselve and can not 
get peering from other isps (i.e. remember AGIS?). And if they are buying 
transit, then it becomes responsibility of their upstream to enforce AUP.

You can not hope to stop spammer who just signed up today at large isp,
but large spammers rely on pemanent connections and try their best to hide 
who they are and where they are sending emails from, these should be our 
primary targets for anti-spam propsals (would be nice to have good 
statistics on how much email really comes from those 150 large spammers, 
but I suspect getting reliable statistics on this is impossible).

---

From: [email-masked]
Date: Tue, 25 Mar 2003 10:57:14 -0800 (PST)

AOL & Hotmail would be quite responsive if it meant really reducing amount 
of spam they have to process on their mailservers. After all money means 
something to those folks and they are spending great deal of it on 
bandwidth, storage, abuse support costs, etc as far as spam goes.

The way I see it, if for example we can stop email from being claimed to 
have come from hotmail or aol when email did not, they'll adapt such a 
solution because it means less time spent on processing abuse complaints.

If we can actually reduce the amount of spam their mailserver has to 
process, they'll go for it even more.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 25 Mar 2003 14:00:08 -0800

If people are endorsing the idea of certificates on ordinary personal
mail, does this mean they have rejected the principle that we should
tamper as little as possible (and ideally not at all) with individual
person to person mail because:
	a) It is not spam, and
	b) Any attempt to require new software by all senders of mail
	   is an extremely difficult goal to attain.

It seems to me the only way to ever get to a goal like requiring new software
for all senders of mail would be highly draconian -- ie. rejecting or
bouncing mail from them -- and result in a lot of lost mail.  Avoiding lost
mail is surely one of our top goals, if not the highest goal, of any e-mail
standards group.  Yes, even higher than 100% effectivness at stopping spam.

So if you are advocating certificates or any form of system where people
would say, "Get new sending software or risk your mail being bounced"
can you explain why you do so?   Is it because you disagree with the
principles above?   Or is it because you agree with them but have decided
after careful examination that systems in line with the principles are
impossible?   I would be interested to see proof of such an assertion if
you have it.

In my own examination of spam systems, I have grouped them into a few classes,
as far as software is concerned.

a) Some require new software only at the recipient.  These can most easily be
adopted, one user at a time.  However, there are limits on what they can do.
There are also political problems (blacklisting falls in this category.)

(Almost all solutions require some new software at the recipient end but it
can be gradually installed in all proposals I have seen.)

b) Some also require new software by legitimate bulk
mailers.  I consider this a difficult, but attainable task, since the numbers
of such mailers are (comparatively) few compared to the number of users of
all mailing software.

c) Some ask for new software at senders, but do not demand it.  They have
a fallback if the senders don't have the software.  The fallbacks range from
easy to use to hard, and the risk of lost mail varies accordingly.  They 
don't want the fallback to be too easy because they want pressure on senders
to adopt the new protocol, and don't want it to be too hard or too much mail
is lost.

d) Some ask for new software for spammers (for example labelling requirements)
and hope that legal means (such as Lessig's bounty proposal) can force spammers
to run this software.   Good luck!

e) Some demand new software at senders, such as stamp generators, certificates,
etc.   They plan to, at least eventually, insist on it or refuse mail.

f) There has been one case where a software change has been demanded of senders,
namely the closing of open relays.  Though it has taken several years, most
open relays are closed, but not all of them.   There was considerable pain.

My experience of the history of deploying software suggests you will easily
get recipients to install new software if it cuts back on their spam well.
Demands on senders are extremely difficult, especially on MUA senders.  Changes
to MTA senders can happen gradually over the course of perhaps 5 years under
extreme pressure, with pain and dropped mail.

Do any disagree with these conclusions?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Dave Anderson" <[email-masked]>
Date: Tue, 25 Mar 2003 19:14:09 -0600

> of large number. There is a reason why all spammers have switched to
China.

Some do terminate accounts, but I know first hand that some participate
either via pink contracts or selling their lists.  I had an account once
that even my wife didn't know about.  I never gave out it's address either,
yet I got spam.  And an account like [email-masked] is not a very
guessable account.

On another occasion I had an ISP that intevened when I sent a nasty gram to
the offending spammer.  My ISP, as it turned out was hosting the sammer
inside their netblock.

But then I also had a large ISP that was very good.  The moral hear is that
many ISPs are good net-citezens, and others are deceptive trash.

> but I suspect getting reliable statistics on this is impossible).

Why couldn't a large ISP stop, or perhaps seriously hinder spam?  If they
implemented a system where every account could only send 25-100 messages it
would seriously discourage spammers.  I suspect the more reputable ISPs do
this, but many don't.  There in is where the problems lye.  It is up to the
receive, not the sender to verify mail.

At home, I just block the China spammers outright, using IPFilter I simply
block out the whole IP range and it massively reduces spam.  But at work I
need to be more selective.  Business people do not understand the smut virus
infected mail came from the same place as a field rep.

Any solution needs to be individualized down to the sender and the receiver.
So certs may have a place.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 18:16:20 -0700 (MST)

> From: Brad Templeton <[email-masked]>

> packets, not to enforce policy....

That's mistaken.  The end-to-end principle says that ISP routers and
wires should just pass packets and not be smart, but nothing about
enforcing usage policies.  Since at least the 1980's (the equivalents
of) ISPs have been expected to enforce usage policies.  Remember the
NSFNet AUP.  Perhaps the fact that Steve W. only zapped one or two
outfits for violating the AUP and the many gatekeepers at ISPs and
customers (including me) used the threat of the AUP to control their
users is relevant to the failure by modern ISPs to care.

> from the innocent users.)

Again, that is entirely consistent.  The end-to-end principle says nothing
about ignoring violations of AUPs.

> to end principle to stop spam.  But we should do so kicking and screaming.

But you're right that nasty garbage does violate the end-to-end
principle.  Lazy, slumlord ISPs prefer to violate the end-to-end
principle as a cheap hack to enforce AUP restrictions.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 18:27:51 -0700 (MST)

> From: [email-masked]

> of large number. There is a reason why all spammers have switched to China.

I wish I thought that was a joke instead of offensive and knowingly
false noise like "SPEWS has listed all of UUNET".

> transit, then it becomes responsibility of their upstream to enforce AUP.

Who, pray tell, is upstream of UUNET or Sprint?
(yes, Sprint is rumored to have started actually terminating spammers)

> who they are and where they are sending emails from, ...

Since email spam first became a problem, I have not seen a single
spammer that was able to hide from anyone with minimal technical clues.
They can hide from computer programs (e.g. SpamAssasin and SpamCop)
for a while or linger, but that's only because computers are too stupid
to know about IP routing and so forth

---

From: [email-masked]
Date: Tue, 25 Mar 2003 22:57:32 -0800 (PST)

<rant>

> yet I got spam.  And an account like [email-masked] is not a very

Depending on how isp servers are setup it may have been possible to "hack" 
into the server and see list usernames. Don't asume they actually "sold" 
your email address.

> many ISPs are good net-citezens, and others are deceptive trash.

Yes there are good and bad isps, but we do work together to get rid of bad 
guys and try to clean up our ranks even if end-users don't see it. And for 
example when I see continuing spam from particular isp, I send them note 
that if they do not stop the abuse, I'll block their entire net from 
accessing my 32,000 ips. You'd be surprised how well this works, I often 
receive human response on what had been on or what real situation had 
been, so continue the behavior and I end up doing what I promised or 
complaining to their upstreams. I know other isps do similar things and 
most of good blacklists are run by ISPs.

> would seriously discourage spammers. 

Some do, some dont, there are good reasons for either choice.

> I suspect the more reputable ISPs do

Perhaps we (ASRG group) should work on that problem and have both be 
responsible for verifying emails and agree how to do it! Any working 
solution should involve both source and destination cooperating and ways 
to distinguish good source from the bad.
 
> infected mail came from the same place as a field rep.

Problem with China is actually more on that they are actively hosting 
spammer websites despite large number of protests and warnings. This and 
other actions (in terms of following internet standards) causes many to 
block china outright on the core routers, but there is also growing 
concerns that this is all being done on purpose and its "goverment 
sponsored" (remeber they control pretty much all ip entrances to 
chinanet) actions and they actually do want china blocked from most of 
world for political reasons and as a way to suppress access to free press.

</rant>

---

From: [email-masked]
Date: Tue, 25 Mar 2003 23:45:07 -0800 (PST)

Hm, I almost forgot before what kind of group this is. You know at one 
side (ARIN meetings) I'm considered to much into abuse prevention, 
here its the opposite, I'm too linient on isps...

As far as Sprint, UUNET - I do not believe they have unsolicited emailers 
on their network (do not confuse issues of sending email and hosting some 
websites that are sometimes promoted in spam due to bad policies on 
accepting new agents), if it is so, I know who to contact there, in fact 
I'll see of these people in less then two weeks on ARIN meeting in Memphis
and if there is some position that ASRG has on what ISPs should and 
should not do, I can deliver it.

And the issue of abuse, I suspect will be discussed there quite a bit 
there and encorage you to see current proposals and discussion at
http://www.arin.net/policy/discussion.html
But I have to tell you, ISPs (including me) do not view proposal 
2003-2 as a good one as ARIN has no role in actual routing operational 
issues and position on revocations has not been made clear but we can work 
on at least cleaning up whois records and things to help facilitate 
communication and made it easy to track problems to get a response.

In any case if you have interest in these discussions please participate 
at ppml mailing list, make your opinions known, etc.

But in the future please do not assume that ISPs do not have interest in 
stopping spam, on the countrary we're the ones who have largest financial 
losses due to it, losses associated with additional bandwidth, cost of 
additional equipment, support costs for direct handling of spam into the 
network abuse prevention out of the net and we're the ones who have most 
interest in working solution. ISPs are the ones who started blacklists, 
because of your upstreams many of your are not receiving spam and in 
most cases they do it out of their own packet and do not charge you 
anything extra even if it costs us. It would be in the best of this 
group's interests not to alianate ISPs (especially large ones) but work 
together to find suitable solution. And of the solutions that are found 
I'm certain the ones that will be most workable and fastest to 
implement worldwide are the ones that ISPs can use on their end and not 
necessarily the ones that require every user to do something.

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 26 Mar 2003 09:46:44 +0000

> Changes

My wife - she's a clinical scientist - pointed out to me (some time ago
now)
that medico-scientific "advances" are *always* reported in the popular
press
as bearing fruit in the "next five to ten years".

I think we should formally adopt this phraseology - with luck we'll all be
in different jobs by then.

---

From: "Teo" <[email-masked]>
Date: Wed, 26 Mar 2003 17:28:16 -0000

> Do any disagree with these conclusions?

There is also some work involving "tarpits" done by Marty Lamb at
http://www.martiansoftware.com/tarproxy

In my opinion this would fall somewhere in the middle of all the options
listed above, and it might actually have the greatest chances of success, as
it doesn't require the cooperation of anyone in particular. As outlined
above, if enough are spread around, pain would start to be felt and
sysadmins will sit up and take notice.

A short description of the principle, in the words of its author:

********************** start quote
"An email message would be fed to the incremental classifier one piece (or
token) at a time. After analyzing each piece, the classifier would respond
with a classification of the message so far, providing a running probability
that the message is spam.

Now imagine that your SMTP server has been provided with an incremental
classifier. You now have a real-time indicator that a message is likely spam
while the spammer is connected.

The Idea

Now we have moved identification of spam to the time of its receipt. But how
can the SMTP server best use this knowledge? I propose that the running
probability from the classifier be used to throttle the connection with the
offending server. If an incoming message looks like spam [1], the connection
could be slowed dramatically, consuming the spammer's resources and wasting
their time [2]. This would transform the server into a sort of dynamic
tarpit, in which the spamminess of the incoming message affects the
viscosity of the tar [3]. As the spam probability goes up, the socket speed
goes down [4].

If enough of these dynamic tarpits were in place (or just a handful were
placed in the right places), the spammers' mail software would bog down,
reducing the rate at which they can send messages, in turn reducing the fees
they can charge their customers. If these tarpits were ubiquitous, they
could completely change the economics of spam, creating a scarcity of
bandwidth experienced only by spammers."***************************** end of
quote

Regards

Teo

---

From: Brad Templeton <[email-masked]>
Date: Wed, 26 Mar 2003 10:41:32 -0800

Tarpits are an interesting idea, but of course they have a risk.  As we
know all spam detectors have false positives, and we must be very sure
we don't tarpit a legitimate mailer.   In one case, when we at the EFF sent
out our newsletter including some notes about spam, SpamAssassin tagged it
as spam.  This would have put us in a tarpit if it used similar algorithms
to SpamAssassin.

However, this can work if you can make an easy system for legitimate mailing
lists to whitelist themselves to be immune from any tarpitting.   I would
recommend a wide variety of means of whitelisting, ranging from the basic
of getting your IP on a list, to certificates, to magic-tags etc.