Subject: Re: [Asrg] 5b. Opt-Out, 2nd version

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Mar 2003 17:24:50 -0800

The list maintainer need not be one entity. All we need is agreement on the
hash function. I sugest a keyed digest with the key sha1("asrg")

You could give your email address to your participating isp, verisign, the
uspostal service or alan ralsky as you choose.

Most registrars would not keep any record of the addresses listed.

 -----Original Message-----
From: 	Brad Templeton
Sent:	Wed Mar 26 17:11:20 2003
To:	Hallam-Baker, Phillip
Cc:	[email-masked]'; 'Kee Hinckley'; 'Brad Templeton'; 'Asrg
([email-masked])'
Subject:	Re: [Asrg] 5b. Opt-Out, 2nd version

On Wed, Mar 26, 2003 at 04:57:35PM -0800, Hallam-Baker, Phillip wrote:
> Hang on a second here, I don't think anyone in the crypto world I'd
> seriously worried about an atack which woud allow an attacker to find an
> eficient inverse function for sha1 and I they did we would be sooo screwed
> every other way it would not be funny.
> 
> I was thinking we would add boogus email addresses that have already found
> their way to the lists...

The privacy goals are twofold.  We would like to avoid having to declare
publicly your desire to opt-out, though frankly this is not that much of
a killer.

Secondly, we would want to avoid spammers deliberately spamming all the
people
who opted out because they can get a list of all of them.

The seeding idea is interesting.  It doesn't solve the first problem, your
name will still go on a list that can be made public, but as I said we can
probably survive that, it's just somewhat ironic to have to go public to
protect your privacy.

You would need to seed the opt-out list with hashes of tens of millions of
fake
addresses, and those fake addresses would need to be ones that can't be
spotted as fake (they don't bounce) and which occur on popular spamming
lists,
but which are not anybody's mailbox.

That's a bit of a tall order!

Reversing a secure hash is (of course) not an issue here, you don't need to
do it to turn the list of hashed addresses into real addresses when you have
the database of 50 million valid emails on CD the spammers trade around.  If
you get spam, you're on their lists, so they can make a list of everybody
on the opt-out list who is on a common spammer's list.

Now why they want to spam it I don't know, possibly for spite.  Only well
hidden
overseas spammers would do it, but they would.

It is also a DoS attack on people.  If you hate somebody, extract the list
of
opted out people, then fake mail from the hated person to thousands of opted
out people.  Presuming the opt-out is working, the recipients will be extra
angry, this would bring down a rain of trouble on the poor soul.

Perhaps this is the greatest danger of the opt-out list.  It also applies to
the special domain I described and all other systems though.  If opt-in were
morally acceptable, it would certainly be easier to implement, but it isn't.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Wed, 26 Mar 2003 17:39:09 -0800

> Most registrars would not keep any record of the addresses listed.

Can you be more specific as to how that solves the problem?

My issue is this.   If you have a system -- any system at all -- which
will "clean" (ie. remove opted out addresses) from a large spammer's master
list (such as the lists they trade around on CD, you all have gotten spams
to buy them) then it is inherent that you will be giving them back a list
of all people on their list not in the opt-out list, and thus a list of
all people on their list who _are_ on the opt-out list.

The only way to avoid that would be what direct marketers do.  The cleaner
also delivers the spam!   You would need bonded companies which send
spam, but remove any opted out address from the mailing.  They are bonded
to not reveal the contents of the list.

This may seem bizarre but in fact is not out of the question.  This is how
the direct marketing business works.  Of course the postal service is the
only company which delivers the mail.  

But if you want to do a direct mailing, the list sellers don't give you a
copy of their list.  They prefer to give it to a trusted 3rd company that
is mailing your ads for you.  (Often they print, stuff and address for you.)
You hand them the ad, and tell them what lists you are buying, and they 
clean the lists (of dups) print, stuff, address and take it to the post
office for you.)

However, larger mailers are trusted to get lists, and for a price you can buy
them.

To avoid people "stealing" the lists, they seed them with special trap addresses.
If they get a direct mailing that they didn't rent the list for, they come and
get you.

So if there were a "official" spamhuases, which respected the opt-out list,
you would not even need to blacklist it, because you could just opt-out and
encourage your users to opt-out.

Spammers who wanted to deliver their own spam would not be able to clean their
lists, and would be subject to the full wrath of anti-spam systems.

This sort of thing has been proposed by spammers in the past, and quite
correctly we have not trusted them.  If the mailing houses however were
approved by us (meaning IETF folks and major ISPs) it's not as silly as it
sounds.   At least until everybody gets on the opt-out list, and the company
becomes moot, and we start over again, unfortunately.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg