Subject: RE: [Asrg] Economic model is borken. (sic.) Let's fix it

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 8 Mar 2003 10:40:14 -0800

> 1) the incentive is to make sure their messages delivered.  

> 2) increasingly, antispam filters are taking out legitimate 
> communications from 
> businesses.  The use of a stamp would allow them to bypass 
> the filters without 
> requiring the recipient to do anything special (i.e. white 
> list, filter exception).

[I don't see the distinction between these arguments]

The same argument holds for authentication based approaches that
do not involve a per message charge.

If C|Net has a certificate that proves that they sent an outgoing 
message their subscribers know it came from them and is not spam.

This mail has an S/MIME signature, you can tell it came from me.

		Phill

---

From: "Eric S. Johansson" <[email-masked]>
Date: Tue, 11 Mar 2003 13:35:55 -0500

> This mail has an S/MIME signature, you can tell it came from me.

big problem.  Authentication based approaches are subject to problems of 
monopolization, centralization, and fraud.

monopolization is easy to understand.  The only company really distributing 
certificates on any scale is VeriSign.  They've purchased their closest 
competitor.  Expect similar behavior if authentication based e-mail becomes 
accepted.

Centralization speaks to the infrastructure.  Imagine the number of servers and 
bandwidth you would need if every e-mail client checked the CRL every time they 
received a piece of e-mail.  Now imagine what happens when the net breaks.  If 
you don't hold e-mail until you can verify the certificate, then a spammer can 
create a DOS against the CRL servers and let their Spam go through.

Additionally, this raises the specter of control in terms of who can and cannot 
send e-mail.  No certificate, no e-mail privileges.

Fraud: What's going to stop the spammer from buying certificate after 
certificate after certificate and spamming.  Additionally, if there is no 
monopoly on CA's, how do you deal with a rogue CA?  you know, one that has a 
large number of legitimate users but refuses to revoke spammer certificates?

and last, what about anonymous e-mail?  Authentication based systems prevent 
that from happening and this is a bad thing.

properly designed stamp based systems suffer from none of these flaws.  Granted, 
they have some of their own but in the end, you have a completely decentralized 
system that can function no matter what is happening on the net or in goverment.

---eric

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg