Subject: [Asrg] Forbes: Pay up

From: Steve Schear <[email-masked]>
Date: Wed, 02 Jul 2003 16:16:16 -0700

A promising way to curb spam: Charge the sender.

Hoping to stop the evil epidemic of spam, Philip Raymond is putting a price 
on it. The 46-year-old software executive has a provisional patent on a 
service called Vanquish, which requires e-mail senders to post a cash bond 
of 5 cents into a bank account for every piece of e-mail they send. If a 
recipient judges the mail to be illegitimate, the sender loses the nickel, 
with four pennies going to the recipient's Internet service provider and 
one penny going to Vanquish as a processing fee. If the recipient okays the 
message, that sender is cleared from then on. But if the human or machine 
behind the spam won't post a bond, the message doesn't go through.

With Internet service providers processing 6.9 billion spam messages a day, 
the price for senders could add up quickly. "We don't search for 
combinations of words and numbers," Raymond says. "We let recipients decide 
if they want it."

In a trial of the service, 400 customers from eight small Internet service 
providers were offered Vanquish for free. Vanquish blocked spam cold, but 
users also experienced installation problems and delays in checking e-mail. 
Vanquish, based outside Boston, says it has fixed the glitches for its June 
launch, and aims to have a lofty 35 million users by the end of the year. 
It expects ISPs to pay 20 to 45 cents per customer per month.

Raymond, who has started and sold two previous tech firms, figures that 
legitimate marketers, accustomed to paying for their messages in other 
media, will understand and appreciate Vanquish. As it is, private filtering 
systems and spam blacklists block plenty of marketers' e-mails. Yahoo and 
AOL have destroyed messages between Procter & Gamble and customers who 
agreed to be contacted, as well as acceptance letters to Harvard University 
applicants.

Raymond has a good idea--other firms such as IronPort have also announced 
spam-bond products--but doesn't have much money. Vanquish is burning 
through $38,000 a month, even with three engineers working for one-third of 
their usual salary. Recently Raymond had to beg his advisory board for 
another $75,000.

http://www.forbes.com/forbes/2003/0707/110.html 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Roy S. Walker" <[email-masked]>
Date: Thu, 3 Jul 2003 00:46:44 +0100

"Charge the sender" was discussed yesterday at the famous 'spam summit' at the house of commons in 
the UK.  View seems to be: this will further encourage the practice of spammers to gain control of 
legitimate email servers, with the intention of sending out spam from an 'authorised' sender (the 
recent piece on the BBC re British Airways as a source of spam refers..). This idea will NOT work 
in practice.  Naive innocents would pick up the charge.

Roy

--
Roy S. Walker
Chief Executive
ADVA Technologies Ltd
+44 (0)8450 539331
www.advascan.com

On Wed, 02 Jul 2003 16:16:16 -0700, Steve Schear wrote:
>This email has been scanned by the ADVASCAN(tm) antivirus / antispam
>service
>For more information please visit www.advascan.com.
>
>

This email has been scanned by the ADVASCAN(tm) antivirus / antispam service
For more information please visit www.advascan.com.

This email has been scanned by the ADVASCAN(tm) antivirus / antispam service
For more information please visit www.advascan.com.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 02 Jul 2003 19:59:15 -0400

This topic has been discussed many times before, take a look at 
www.irtf.org/asrg/ and the links to the archive and the list maintained by 
William Leibzon.

At 12:46 AM 7/3/2003 +0100, Roy S. Walker wrote:
>Content-Transfer-Encoding: (null)
>

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 02 Jul 2003 21:18:47 -0400

> A promising way to curb spam: Charge the sender.

  I've always been somewhat mystified by these solutions.  While they
appear to be useful, they drastically change the trust model for
network traffic.  (SMTP =~ no trust needed or used, $$ =~ trust, who?)  I
haven't seen analyses that such a change in the trust model would be
acceptable to the recipient.

  That is, would the possible centralization of the administration of
$$ (i.e. trust verification) be less problematic to the recipient than
spam?  I could see people deciding that receiving ~100 spams/week is a
reasonable trade-off for preventing a third party from having access
to your email messages, or habits.

  In addition, changing the cost/benefit trade-off for one network
behaviour will also result in changing the cost/benefit trade-offs for
other network behaviours.  If SMTP has costs, some "inventive" person
will discover a way to avoid the cost through abusing another
protocol.

  As a more general statement, I'm not sure that the current
trust/consent model on the Internet can be applied to the future,
unless we re-visit the whole gamut of assumptions, designs,
implementations, and use patterns.  But that's outside of the scope of
ASRG...

  Alan DeKok.

---

From: Barry Shein <[email-masked]>
Date: Wed, 2 Jul 2003 21:27:17 -0400

> in practice.  Naive innocents would pick up the charge.

I don't agree with that.

There are many instances in life where some unscrupulous person could
cause charges to unfairly be attributed to you.

Somehow, we cope, such as cancellable credit card transactions etc.

What it does is raise the bar on:

a) Securing one's system lest they be put in a situation of having to
get charges removed.

b) Providing an economic base (actual revenue and loss of revenue to
fraud) to pursue spammers with.

Imagine if credit cards were simply these (nearly) free services
which, say, only simplified the process of a merchant billing a
customer, perhaps a swipe just provides standardized information to
the merchant's POS system to generate a bill, mailing info etc.

How could the credit card companies possibly pursue fraud?

But, add that 2-4% in merchant charges and the billions in income lost
to the banks over fraudulent charges etc and suddenly there is both
the will and the way to pursue fraud vigorously.

Doesn't eliminate fraud entirely, but we certainly don't feel any need
to volunteer our time on IETF mailing lists to kick around ideas on
how to curb credit card fraud!

Why? Because there's big bux in pursuing credit card fraud.

Just about none in pursuing spam.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Matt <[email-masked]>
Date: Thu, 3 Jul 2003 13:13:04 +0100

> in practice.  Naive innocents would pick up the charge.

Actually just a factual correction - the article was slightly 
misleading. The spam came direct from super-zonda, it was the web site 
that was being proxied through BA-Travel's web site. Your point remains 
though.

Solve the problem of email forgery (which is required for the "charge 
for email" model) and you've solved the spam problem (or at the very 
least we can go back to just using blocklists).

Matt.

---

From: mathew <[email-masked]>
Date: Mon, 14 Jul 2003 23:06:16 -0400

> to your email messages, or habits.

That's why it's important to design the protocols correctly.

It's perfectly possible to implement digital cash systems such that the 
"bank" doesn't get to see the e-mail, the sender and recipient can stay 
anonymous to each other, yet the recipient can be confident that his 
account was credited with the appropriate cash sum.

There's also no reason why it would be necessary to have a centralized 
system. You could have a number of administration entities, just like 
you do for DNS etc.

I've been thinking for a while that a bunch of people on this list, 
myself included, are pretty much convinced that the "use as much 
resources and as much of people's attention as you like, for free" 
model is fundamentally broken, and that sender-pays will be necessary.

It seems to me that those of us who think "sender pays" is necessary 
could usefully set up a separate list to come up with requirements, and 
a proposed implementation model, which could then be brought back here 
for the inevitable nit-picking.

It also seems clear to me that even if the majority think that "sender 
pays" won't work, that's no reason why it need be killed. Unlike many 
other solutions, it can quite happily "compete" with free e-mail and 
live or die by whether it works in the real world; it doesn't need 
universal adoption to be useful.

mathew