Subject: [Asrg] Gray list: rating of associates

From: "Dave Lampert" <[email-masked]>
Date: Tue, 18 Mar 2003 12:19:01 -0500

Here's a solution that, together with many other solutions, may reduce the
economical value of spam to the spammers.

PATENT NOTICE (My lawyers made me do it!): This solution is part of a
patent-pending technology ("Prioritized communication") available upon
request by emailing
<mailto:[email-masked]>. We intend
to make this technology widely available through numerous vendors under paid
license as per http://www.ietf.org/rfc/rfc2026.txt sections 10.3.2 and
10.3.3, so I'd like to see this addressed in the ASRG recommendation for
standards.

In short, this doesn't block spam, but rather relegates it (and other
unsolicited email) to a low or zero priority (you pick it up when YOU want
to). Email from people you know have a higher priority rating. You get to
rate each person and the system issues them a unique contact email address
(usually a base name plus a GUID like the one listed above) just for them.
The system makes it easy to manage these and easy for your friend to update
his/her address book. If the unique address falls into the wrong hands and
spam begins, you can lower the rating on it, and possibly issue a new unique
address to the friend (if he/she is STILL your friend!).

The technology goes well beyond this, such as computing the product of the
importance of the email (the "importance" tag as set by the sender) and the
rating of the sender by the recipient, and using this to rank priority of
all messages (including non-email messages such as IM chat, voice mail,
etc.). You only get lower priority messages when you're good and ready for
them, but still get extremely urgent messages even when you're sitting in a
movie theatre.

I've browsed through the boards and found two different, but related
threads:

[Asrg] Random thought (Jason Hihn)
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01252.html

[Asrg] Peer to Peer MTA network (Claus Färber)
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00826.html

Please tell me if there are other related threads that I've missed.

This system is well developed already but not yet commercially available. I
look forward to all our your feedback on how this will fit into the
anti-spam mission.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Dave Lampert" <[email-masked]>
Date: Tue, 18 Mar 2003 13:06:17 -0500

The priority ratings per sender (i.e. Jane) are privately accessibly only to
the recipient (i.e. Ian). Ian can change his rating of Jane, but neither
Jane nor anyone else can see or edit those ratings. Ian does this at a
private web site of the ISP/ASP.

It is true that if someone guesses the GUID, they may be able to hop onboard
someone else's high ratings. Yes, GUIDs are somewhat guessable, since they
are algorithmic based on net ID and other information, but it's unlikely a
spammer would go to that trouble. This method does also support certificate
tagging within the email header, but that hasn't been implemented yet
(besides, that would require a change to the email client).

The most likely way of hacking this is to sniff a non-encrypted email and
then spoof it, but again, we try to use networks that are NOT sniffable by
just anyone!

Did I miss something? How else would a hacker/cracker do this?

-----Original Message-----
From: matthew richards [mailto:[email-masked]]
Sent: Tuesday, March 18, 2003 12:38 PM
To: Dave Lampert
Subject: Re: [Asrg] Gray list: rating of associates

what would prevent a spammer from reverse engineering the
prioritization system and then making hack emails that pretend to be
high priority from friends?