Subject: Re: [Asrg] The Solution To Spam - The First Response

From: "Ken Hirsch" <[email-masked]>
Date: Wed, 2 Jul 2003 20:40:38 -0400

From: "Kee Hinckley" <[email-masked]>
> This list has had this type of discussion before.  Those are
> approximately the requirements necessary for an SSL certificate.
> SSL certificates currently last one year at about $100/cert.  The
> margins are such that virtually no background checks are done.  And
> of course there is no revocation, arbitration or verification done
> for how you use it afterwards.  I would guess that, at a minimum,
> the level of support you are requesting would result in a fee on the
> order of $1000/year in order to support the necessary infrastructure
> and support needs.  It might be somewhat lower because the volume of
> sales would be many orders of magnitude higher than SSL certs, but I
> can't see it being any cheaper.

You say that like it's a bad thing.  If it would reduce the number of
SMTP servers by one or two orders of magnitude, that's great! Perhaps
I should remind you that your own (reasonably priced) service is
$36/year per user.  A $1000 would cover 28 people.  I should hope the
average SMTP server services more people than that!

But your assertion does not really check out.  The extra cost for
identify verification should be on the order of $100 for the first
year and maybe $30 extra per renewal.

For example, the cost of a passport application is $55 for the State
Department and $30 to the acceptance facility (usually the post
office).  The USPS just announced the availability of a service for
CAs to check identities in person.  I'm sure the cost will be
comparable to the $30 that they get for passport applications.

Or, my bank will do it for free for their customers, and there is a CA
(digitrust.com) that is associated with the American Banking
Association.  Their charge is $175 for a business identification or
SSL certificate.

And why should it cost more?  For the first time, somebody needs to
process the application, run a credit check, check ID against
databases.  In time (<1 hour) and fees (e.g. $25 for a credit report), that
should be less than a $100.  For a renewal, a good practice would be a
credit check (to see if there's anything really fishy) and mailing the
renewal code to the address to see if it's still good.  An extra $30?

So, how much do CAs charge for code-signing certificates, which should
be comparable?  The most expensive is Verisign, which is $400 the
first year and $300 for renewals.  Others are half that.

Right now the PKI is weak on certificate revocation, but that's not
strictly necessary. Third parties can label a given identity as a
spammer, just as they do for IP addresses.

In fact the PKI as it stands is adequate for identify verification, at
least in the United States, but as I indicated in earlier messages,
that's not quite enough to prevent spam.  You also need (at least) the
property that there are not too many certificates per person (although
the cost does put some limit on it.)

PKI provides
  certificate => identity
but not yet
  identity => few certificates

Note that IP addresses and domain names provide neither property.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Jul 2003 11:56:11 -0400

>SMTP servers by one or two orders of magnitude, that's great! Perhaps

I'm not sure why that would be good.  But leaving that aside.

>year and maybe $30 extra per renewal.

Identify verification is only part of the proposal I was responding 
to.  The other piece was verifying the good behavior of cert owner. 
That requires a clearing house for complaints, an arbitration 
process, and a mechanism for ensuring that the same person doesn't 
pop up under a different name (which is a different sort of 
verification problem, as you point out).  That's where I'd expect the 
expense to come.

Never mind the question of how you certify someone in a country that 
doesn't have as codified a banking and company registration system as 
those where most SSL certs are issued.

>first year and $300 for renewals.  Others are half that.

Code signing certs are probably a better example than SSL certs.  Do 
you know how they handle complaints and revocations?

>spammer, just as they do for IP addresses.

Right now virtually none of those third parties have an arbitration 
process.  That would have to change.

Modulo the problem of countries without a reliable certification 
structure, I actually I think that requiring signed certs on mail 
servers is a reasonable thing to do.  Forget revocation for spamming 
and the like.  At the very least it would solve the open-proxy 
problem.  But the third-world problem is a very real one.  One of the 
benefits of email right now is that it has created a level playing 
field for communication throughout the entire world.  Cutting the 
third-world out of the information flow is not something I want to do.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Ken Hirsch" <[email-masked]>
Date: Thu, 3 Jul 2003 16:51:19 -0400

> process,

I don't really expect that to be much of a problem.  People are quite eager
to give you free help to find violators and it's not expensive to put out
spamtrap addresses.

From what we've heard from ISP's, complaints are rare and they manage to
handle those without huge expense.  From all sources I've seen, the overlap
between IP addresses of spammers and IP addressses of legitimate email  is
tiny.

As long as problem M (below) is solved, there's really very little point in
the certicate holder fighting revocation, since once identity is established
everybody else can use it to make their own determination as to whether to
accept mail from them.

Problem M (Multiple identities/certificates/IP addresses/domain names/etc.):
> and a mechanism for ensuring that the same person doesn't

This is key.  But I think it is necessary for any permanent solution to the
spam problem. Everything else I've seen proposed is either a temporary fix
in the spam arms race or is something (such as RMX) that would only be
useful if used in conjunction with something that solves problem M.

> those where most SSL certs are issued.

This is a good question.  I would hope that any people on the list with
knowledge about how CA's operate, especially internationally, would come
forward.  Do you have any comments about Problem M?  I notice that there is
a pbaker at VERISIGN.com.

My earlier proposal about getting CAs more or less directly involved in the
spam problem might be misguided.  As long as they can verify identity (in
the strong way, solving Problem M), then other organizations can build on
that to solve the spam problem.

The essence of my earlier proposal:
(1) mail servers can accept mail (without challenge-response) only if it is
verified at either at the server level or the individual message level.
There are already technologies to do this (SSL client certificates,
IP-lookups to a verifying organization, S/MIME signatures, etc.).
The method must have a reliable, short chain to a responsible organization
or individual with strong identity (see Problem M).
It is not necessary that everyone choose the same method.

(2) mail that cannot be so verified must be subject to challenge-response
authentication.

Conjecture:
It might be possible to grandfather-in existing SMTP servers that are known
to be legitimate.  But the fact that there are soooo many SMTP servers is a
problem.  Not only it in cumbersome to manage so many millions of items,
more importantly it is hard to even gather the data about who is sending.
You may never have received a message from fredsgrocery.com, but it may well
have a legimate automated mailing system.  (Obviously challenge-response is
mostly a problem with mailing lists and other automated mail systems.)  If
you could find out all SMTP servers with a good reputation, you could
arrange to verify them by looking up, say, 63.10.45.12.presumedinnocent.org.
But it is critical that this NOT apply to new/unknown servers and it would
be subject to easy revocation.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Jul 2003 21:25:33 -0400

>to give you free help to find violators and it's not expensive to put out

So what happens when Roving gets a new customer who has a bad list 
and 100 people accuse them of spamming?  The problem isn't getting 
people to complain about spammers.  It's keeping potentially innocent 
victims from getting shot.  That's where the lawsuits start flying. 
Just look at the wide range of BL's that exist.  Clearly people have 
very different ideas of what constitutes a spammer.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Walter Dnes <[email-masked]>
Date: Fri, 4 Jul 2003 18:12:39 -0400

On Thu, Jul 03, 2003 at 04:51:19PM -0400, Ken Hirsch wrote

> Conjecture:
> It might be possible to grandfather-in existing SMTP servers that are
> known to be legitimate.  But the fact that there are soooo many SMTP
> servers is a problem.  Not only it in cumbersome to manage so many
> millions of items, more importantly it is hard to even gather the
> data about who is sending.  You may never have received a message
> from fredsgrocery.com, but it may well have a legimate automated
> mailing system.  (Obviously challenge-response is mostly a problem
> with mailing lists and other automated mail systems.)

  A legitimate list would have no problem with asking on their webpage
that you whitelist "mail.fredsgrocery.com" before subscribing.  A
(sub)domain name is better than IP addresses or From: or Envelope-Sender
because...
  - Envelope-Sender can be forged and many MUA's don't parse it.
  - From: can be forged... *AND REQUIRES THAT THE MESSAGE BE ACCEPTED
    FOR PARSING* before you can make a decision
  - a (sub)domain name can change IP addresses transparently if the host
    changes IP addresses. And it can handle multiple addresses, e.g. ...

[waltdnes@m433 waltdnes]$ host cnn.com
cnn.com has address 64.236.24.20
cnn.com has address 64.236.24.28
cnn.com has address 64.236.16.20
cnn.com has address 64.236.16.52
cnn.com has address 64.236.16.84
cnn.com has address 64.236.16.116
cnn.com has address 64.236.24.4
cnn.com has address 64.236.24.12

> If you could find out all SMTP servers with a good reputation, you
> could arrange to verify them by looking up, say,
> 63.10.45.12.presumedinnocent.org.

  This seems to be a mirror image of current DNSbls which list bad
actors.  I think the current approach is better.  There are, hopefully,
fewer "bad guys" than "good guys" so the logistics of listing the "bad
guys" are easier.

> But it is critical that this NOT apply to new/unknown servers and
> it would be subject to easy revocation.

  Everybody starts off presumed innocent until listed in a DNSbl, which
takes care of your worry about new/unknown servers.  Note that "one
listing" can include IP address ranges, such as is the case with
residential (usually dynamic) IP addresses.  Another advantage of
today's DNSbls is that they're *NOT* official and "accountable".  MAPS
was the ultimate example of what happens when you play by Marquis of
Queensbury Rules against enemies who play dirty.  MAPS are good-guys,
but good intentions aren't enough.

  Other DNSbls have been accused of list-first-ask-questions-later.  But
giving spammers umpteen levels of appeal while a shell company continues
to blast away is a joke.  As soon as one company is finally blocked,
they switch to another numbered shell company that was registered for a
minimal price, and resume spamming.  Again, they'll pound away on your
inbox for weeks or months while the appeals process continues.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: "Ken Hirsch" <[email-masked]>
Date: Sat, 5 Jul 2003 10:43:21 -0400

From: "Walter Dnes" <[email-masked]>
> takes care of your worry about new/unknown servers.

That's rather the opposite of what I meant.  It is necessary that new and unknown
servers be presumed guilty.   That's one of the main problems with blacklists.

There are thousands of new open relays and open proxies created each week.  A virus
could create hundreds of thousands in a day.  Blacklists can't cope with that.

I am only proposing this reputation-based whitelist as an aid to transition.  Once
mail is no longer accepted from unknown servers, there would be no way to build a
good reputation.

Searching on "reputation" and various mail-related terms, I discovered
http://www.mxes.org/. Tracking of reputation could be very helpful to heuristic
systems like SpamAssassin, but the n-squared nature of mail connections make it
unlikely that it would work very well.

---

From: Walter Dnes <[email-masked]>
Date: Mon, 7 Jul 2003 01:03:29 -0400

On Sat, Jul 05, 2003 at 10:43:21AM -0400, Ken Hirsch wrote

> That's rather the opposite of what I meant.  It is necessary that
> new and unknown servers be presumed guilty.   That's one of the main
> problems with blacklists.
> 
> There are thousands of new open relays and open proxies created
> each week.  A virus could create hundreds of thousands in a day.
> Blacklists can't cope with that.

  Start off with DNSbls listing dynamic IP address *RANGES* (e.g. CIDRs)
and you'll have most of today's proxy problem licked.  Actually, blocking
all non-static IP address ranges does converge to your proposal of white
listing "valid" mail servers.