Subject: [Asrg] Consent systems

From: [email-masked]
Date: Wed, 02 Jul 2003 14:25:42 -0500

>>I think an important aspect of such a consent-based system is precisely
>that the
>sender (or spammer or whoever) MUST NOT BE ABLE TO INQUIRE IN ADVANCE
>regarding
>what (hypothetically) would and would not be accepted.

> I'm not sure that this is necessarily true. It would certainly take the
wind out of the "legitimate mass mailers" if it could be shown that they
could have ascertained that their mailing was unwanted before they sent it.

I think any spammer which includes "obscuring" techniques designed to fool 
filters in their spam would have a hard time claiming that their mailing wasn't 
unwanted.  One of the things my incoming mail filtering system does, in fact, is 
to trigger off of various types of obscuring techniques that are done by 
spammers but basically never in legitimate E-mail.

> Equally, knowing in advance that a message with particular
characteristics will be blocked need not (of itself) help the spammer in
constructing a message that will get through. 

Maybe, but it tells them how much they maybe can get away with.  I don't think 
it's what we ought to do.  I'd rather see them forced by default into 
least-common-denominator formats.

> If we're worried that spammers can deduce the anti-spam function of a system 
in some way shouldn't we also be concerned that spammers can (a) read this list 
(b) freely download widely used spamtools?

Sure, and we can safely presume they do BOTH a and b.  

The way for them to get their spam past my permission list and into my Inbox is 
to:

  1)  send it in plain ASCII text without attachments of any kind;
  2)  get past my other heuristics in my incoming mail filtering system;
  2)  not include anything in it which another content filter (such as Spam 
Assassin, for instance, which they should presume I'll customize) would consider 
evidence of spam.

But hey, if a spammer (who spams everyone else on the planet!) wants to send 
*me* a *legitimate*, non-spam message... I don't see why I shouldn't accept THAT 
one, if I want to.

> I believe that your objection may be answered by having some sort of
"scope" field in a consent expression. You can choose to set the scope of
your expression to be (say) "local" which might be equvalent to configuring
your MUA or MDA. You might choose to set it "organisational" in which case
your expression might be propagated to your firms (ISP?) mail system. Only
a "global" scope for expression has any of the risk that you're worried
about, and only then if the expression includes filtering criteria
explicitly, rather than references to "message classification" engines
which an arbitary entity won't necessarily have access to.

One of the (many!) things that my incoming E-mail filtering system does is that 
it has specific support for multiple users (suitable for use in a corporate 
organization) where there is provision for individual users to set their 
filters, banned sender domains, POP3 mailboxes around the Net, and the like 
differently from other users.

My incoming mail filtering program is presently over 1300 lines of SPITBOL, 
which is a rather large SPITBOL program.  I haven't implemented yet some of the 
things I think it should do (like sender-specific permission lists) although 
even just with what I have so far, I've filtered out a lot of the crap that I'd 
otherwise have to deal with, and GREATLY reduced the hassle and annoyance factor 
involved with the messages I *do* get every day.  (It actually does a lot more 
than just go/no go filtering... it also strips out most banner ads and the like 
from mail delivered by widely-used services, for example).

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John Fenley" <[email-masked]>
Date: Fri, 04 Jul 2003 20:45:27 -0600

Perhaps with all this talk of consent it is time for me to call attention 
back to Choicelist.

Choicelist was not a message tracking system, it was a consent/trust system.
It was only designed to be useful for commercial email as a filter by 
passing system.
Over the last week or so, I have discovered how to incorporate a trust 
system for personal mailers into the existing framework.

I think it was Walt Dnes that proposed separate systems for personal and 
commercial email.

As I believe Choicelist was already a good system for handling commercial 
consent, I tried to figure out how to incorporate Personal consent into the 
system.

Here is a rough outline of the system I came up with:

Choicelist Personal Ids can be requested.
Choicelist Personal Ids give all the options of a Commercial Choicelist 
account (Multiple addresses, authentication options, Etc).
These Ids allow the user to bypass Spam filters when they contact anybody 
using Choicelist to block mail.
The Choicelist MUA would have a button to report abuse of a personal 
address.
These reports would be confirmed and reviewed in real time, and offending 
Ids terminated.
The response cycle for complaint to listing will be as short as possible 
(hopefully on the order of seconds).
The reason this reporting will be sufficient to stop abuse of personal 
addresses lies in the way these Ids will be distributed.

When personal Ids are requested, only an address is required. A password is 
sent to that address. Each address can be used to request a new Choicelist 
personal Id every 3 months. This address is used only for the transmission 
of a single Choicelist Id. Anonymity can be preserved because Ids are 
transferable, and an Id can be decoupled from the address information.

Other routes to Personal Ids can be used as well, though each method should 
have drawbacks that outweigh an Ids usefulness for spamming because of the 
limited amount of spam that can be sent before an Id is terminated. It will 
not be economical to purchase a $5 id to get maybe 20 seconds of spamming, 
but a person could use a single Id indefinitely.

I believe this to be an effective way to eliminate abuse of Choicelist 
Personal Ids, and Choicelist already prevents abuse of Commercial Ids. I 
therefore see Choicelist as a complete consent system with few (if any) ways 
to abuse it while allowing contact with strangers without any uneeded 
barriers.

Choicelist requires no changes to mail sending systems, and can protect 
mailers from claims of abuse.
Choicelist also provides benefits at low adoption rates, and so should be 
implementable.
Choicelist is also expandable to any messaging protocol (SMS, IM, Etc.)with 
little or no change to the consent structures.

I could go on, but I will not. This is as close to the “Magic Bullet” as I 
think is necessary to stop spam permanently.

John Fenley

www.choicelist.com

_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail