Subject: [Asrg] How to can the spam

From: Jason Hihn <[email-masked]>
Date: Wed, 05 Mar 2003 14:23:03 -0500

We need to start from scratch, with a new system capable of embracing,
extending and exterminating the current system, while preventing spam.
(Dubbed "ENG" (Next Generation Email) for this thread)

At the heart of NGE is the following idea: Deprecate '@'. It was a very good
choice, but is tainted with the taste of spam. We need to switch to another
character. I find any of the following acceptable: !#%&~|{} This char is
called the 'promoted' char. The old '@' is the demoted char.

This new symbol will only be used by the NGE system. Use of it will require
advanced capabilities by the sender and receiver. If no such capability
exists, (the next-generation-ness was lied about) it modifies the address to
use the '@' character.

The I'd deferring technical details to those who have thought about it more,
but I'd like to offer up a few technical things:
1) [email-masked] is still the same account to the
user. The user will never need to know the difference. Optionally, they can
learn that emails using the new character are always legit.

2) After wide-spread adoption, spam filters (user-based) or servers
(organization/ISP-based) can be set to drop incoming unsolicited mail using
'@'.

3) we can still run SMTP, just they need a patch for the new separator. This
NGE system will/can talk SMTP to the local host (SMTP mail server) for easy
upgrading. Note: SMTP hosts must be configured to talk to local host (or
trusted) addresses only!

4) The NGE software (receiver side) will be required to verify the sender as
legit. How this is done needs to be discussed. Once legit is decided it can
be promoted (if we want to be aggressive and try for NGE capabilities
anyway, and it passes) or demoted.

On to my technical approach:
I'm entertaining using signatures issued by the ISP, and verified against
the server in the ISP's MX record. If an ISP sees too many inquires for a
user, then that user maybe flagged as spammer, and the account can be
suspended/revoked/throttled back. Eventually the sender will exhaust his
checking accounts or credit card numbers at the ISP and he'll have to move
to a new ISP. The key to this approach is to keep the limits low, make let
them only get off a few hundred before they are yanked. Also watch the
undeliverables. It is rare for me to send to a wrong address, maybe 1 a
month. Surely 10 a month is reasonable? (And they'll all happen in minutes!)

The problem with the above is the MX record can be untrustworthy AND
spammers can multiplex through multiple accounts and/or ISP's. Maybe certs
from a Cert Authority is to be required on the MX?

Multiplexing through accounts (as to not trip the send/sig inquiry limit)
should still trip on the undeliverables as well. (At this point I might
recommend planting invalid email addresses on the web so the spammer using
email address gathering from web pages will trip the undeliverable limit)

Thoughts/comments/suggestions?

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 15:33:46 -0500

>called the 'promoted' char. The old '@' is the demoted char.

Well, let's stay away from ones that the email system already uses. 
! and % in particular would be rather bad news.  Also, keep in mind 
that there are thousands of web forms out there that think 
(incorrectly) that they know what an email address is.  I'd say that 
I'm only successfully able to put a "+" in my email address on web 
forms about 75% of the time.  But anyway, nits.

>suspended/revoked/throttled back. Eventually the sender will exhaust his

I'm not clear on what you mean here by "inquiry".  Are you assuming 
that I'm a spammer if I send too much email?  Or are you assuming 
that each query comes from a bounce or complaint?  And in either 
case, how do you verify that the site making the query is in fact the 
site that was sent the email?  What keeps me from writing a program 
to make it look like someone else is spamming?  Does the sending ISP 
have to maintain state and keep track of how many messages I sent and 
make sure it matches the complaints?

>month. Surely 10 a month is reasonable? (And they'll all happen in minutes!)

I'm currently the victim of a hoax that has resulted in hundreds of 
people sending email to [email-masked] every day.  About 25% 
of those messages contained that hoax, or other hoaxes.  So I decided 
to be nice and set up an auto-responder.  It did a reply-all to the 
mail and told people that they had just received a hoax.  I was 
easily bouncing 50 messages a day--because people were forwarding 
these hoaxes to everyone in their address book, and large numbers of 
those addresses were incorrect.  That, combined with people accusing 
me of spamming them, made me back-off and just reply to the sender. 
Eventually I had to back off from that and just bounce with an 
extended bounce message.  I'm still getting 300 messages a day, plus 
another 4-500 viruses.

On a related subject.  When considering authentication schemes, 
please consider how you are going to handle bounces.  I've seen spam 
masquerading as a bounce before (and viruses as well, of course). 
(I've even seen spam masquerading as a spam complaint.)
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Pierre Fortin <[email-masked]>
Date: Wed, 5 Mar 2003 21:15:24 -0500

On Wed, 5 Mar 2003 15:33:46 -0500 Kee Hinckley <[email-masked]>
wrote:

> forms about 75% of the time. 

Getting a + in there is generally easy...  the problem is unsub'ing from a
list you no longer want...  had a heated go-around with orbitz.com; but
they did "discover" their error and corrected it...

I make it a point to go after a big misconfigured mailer on a regular
basis...  "abuse@" attempts are pretty much ignored; but bounced failure
notices to the right people delivers an amazing level of success.  Try it
and make the world a little better for all of us...  besides... no
delivery attempt == no bounce -- which means they share in my pain and no
more...  :>

Pierre

PS:  just talking about spam doesn't do much; fighting back makes the
world better a misconfigured mailer at a time... 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg