Subject: [Asrg] Basic Proposals So Far ...

From: Art Pollard <[email-masked]>
Date: Wed, 26 Mar 2003 16:18:46 -0700

I don't follow this mailing list perhaps as close as I ought to but I 
thought I would make a basic list of ideas.  Some things seem to be a 
variation of these but these are some of the basic ideas that I've seen so far.

These are:

1) Leave the message on the server and let the client retrieve the message 
allowing for unforgeable addresses.  Also allowing for post-sending 
cancelation by a sysadmin.

2) Have the client check with the sending server to see if the server 
actually sent it.

3) Charge for sending e-mail

4) A Turing Test.  (i.e., the e-mail client sends a message back to the 
sender asking some sort of question that only a person could answer.)  I 
personally like this one.  It is fast and easy.

5) Black hole lists or ways to manage them.

6) Digital certificates that say you are who you say you are.

1, 2, 3, and 4 all would only need to be performed the first time a new 
contact is initiated.  (i.e., so for example with #3, you would be charged 
$0.01 per new person you contacted via e-mail each time after that you 
would be added to a whitelist and it would pass through at no charge.)

As has been mentioned various security schemes such as SSL, digital 
signatures, etc. can be added to any/all the above for additional security.

-Art

-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 27 Mar 2003 16:56:02 +0100

On Wed, Mar 26, 2003 at 04:18:46PM -0700, Art Pollard wrote:
> allowing for unforgeable addresses.

What I never understood with this setup is:
   How do I as a person know that some server somewhere has a message for me
   without the server sending me an email/notification telling me he has
   email for me.

Alice wants to send me a email. She opens her mail client and writes the
text, fills in my email address.
What happens next?
Do I get a short notification that Alice's server has a message for me
waiting? This would really be a big gain. I have the notice in my
mailbox and I have to make a connection to another server, do some sort
of authentication there (otherwise everyone could retrieve my email).
And of course I would also get a lot of those "notifications" from
spammers. And I would have to wade through them and delete them. What is
the difference to just delete the spam message.
Ok, my mailbox isn't filled with spam, but it's filled with messages
telling me spam is waiting on the servers.

And what if Alice chooses to change the provider? Then she writes from
a different server, even if the has the same email address.
Would you trust the new server or would you just delete the notification?
What is the gain with this system if spammers continue to fake sender
addresses just like they do now?

> Also allowing for post-sending cancelation by a sysadmin.

You mean like "the sender wishes to reclaim the message sent to you
earlier?" Surely not without (strong) cryptography. And that would
require a - non existant - distributed Internet wide PKI.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg