Subject: RE: [Asrg] 5b. Opt-Out, 2nd version

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Mar 2003 13:04:31 -0800

> On Wed, Mar 26, 2003 at 03:07:18AM -0800, [email-masked] wrote:
> >         a. Serious issues that the encryption technology 
> maybe broken 
> > 	   later on and as such allow to get clear list of all 
> opted-out 
> > 	   email addresses
> 
> Alas, there is no maybe about it.
> 
>     Spammer's List of 50 million E-mail addresses | cleaning 
> service | diff
> 	
>     Will get you effectively all the email addresses that have gone on
>     the opt-out list.  I mean, if you aren't on the spammer's 
> lists, you have
>     minimal reasons to go on the opt-out list so it is 
> effectively complete.
>     (Though corporate sites can put their entire population 
> on the list
>     with safety, but in that case why not just list the 
> domain rather than
>     the individuals.)

We could add to the list addresses that are not actually valid - like
the striker addresses for example. 

This would mean that the results of the diff would be a mixture of 
good and bad emails. If anything the result of a check would be more 
likely to give a bad email than a good one.

	Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 26 Mar 2003 16:33:57 -0500

>the striker addresses for example.

How would you validate them?  And if you don't, why wouldn't some 
helpful person do a dictionary attack on the opt-out list in order to 
remove everyone.

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Wed, 26 Mar 2003 13:08:02 -0800 (PST)

> >the striker addresses for example.

I think this is called "poison pill" and different pills can be inserted 
into lists that are distributed to different parties. Then if unwanted email 
appears on this email, that can be used as verification that they 
decryppted entire opt-out list. 
 
> helpful person do a dictionary attack on the opt-out list in order to 

Similar "poison pill" system can also work for central server that 
provides authentication to get opt-out list. In this case you invent some 
easily guessable email addresses but not actually use it in any email. If 
somebody querries for it and gets opt-out no answer but then there are 
unsolicited emails coming to it, you know who did something wrong.

----
William Leibzon
Elan Communications Inc. 
[email-masked]