Subject: [Asrg] 0 General - Fake HIV Letters in mail

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 20 Mar 2004 09:47:27 -0800

http://www.nytimes.com/2004/03/20/nyregion/20letters.html

The email variants cannot be far off.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Sat, 20 Mar 2004 16:19:24 -0500 (EST)

> http://www.nytimes.com/2004/03/20/nyregion/20letters.html

Registration required.  Anyone have a pointer a place the story can be
found that doesn't, or a summary of the story, or some such?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Barry Shein <[email-masked]>
Date: Sat, 20 Mar 2004 18:08:08 -0500

> The email variants cannot be far off.

Yes, and perhaps I'm jumping the gun here, but isn't the real msg that
after 200+ years in operation the USPS hasn't really been able to do
anything about this sort of thing other than via mail fraud laws or
similar? And warning people to be suspicious as this article does.

I guess my real bone is that there's been a growing conflation, to my
thinking, of authentication vs UBE. Fraudulent messages needn't be
bulk, and not even particularly unsolicited, and unsolicited bulk
email needn't be fraudulent.

I think we can do something about UBE, but before trying to do
something about authentication one might seriously ponder why the USPS
(and no doubt non-US) haven't tackled this in general except by
offering special, higher-cost authenticating services.

I think the answer is in that last phrase: authentication costs.

This is why I'm rather dim on the whole SPF/RMX/CallerID effort, I
think you're better off just coming up with a higher-cost
authenticated messaging using something like SSL and certificates or
PGP or whatever for those who want it (and we all might want it at
some times, just like certified or registered mail) and just let
everyone know that if it isn't via an authenticating source then,
well, it's no more trustable than any random letter you get in your
postal mailbox (Congratulations, You have just won one of the
following four prizes!)

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: John Levine <[email-masked]>
Date: 21 Mar 2004 01:36:40 -0000

>email needn't be fraudulent.

All quite true.  I went to a meeting a month ago of the Anti-phishing
Working Group which despite its funky name consists of big banks, big
ISPs, and big law enforcement with a smattering of software vendors
and a few tourists like me.  Phishing is as bad a problem as spam, but
it's less well known because the primary targets are large
organizations that tend not to talk about it other than to each other.
They're now seeing upwards of 12 distinct attacks per day with the
most common targets being eBay, Citibank, and Paypal.

Some phishing is done by broadcast spam, but a lot is carefully
targeted, e.g., at foreign holders of US bank accounts who often fall
for the verify your account scam.  Losses are large.  At the meeting a
guy from the Department of Justice talked about cases with six and
occasionally seven figure losses, and people going to jail for many
years.

Phishing entirely depends on authentication failure.  A web site,
e-mail, or other message looks like it's from a large familiar
organization, but it's not.  At the moment, there's little they can do
to prevent it.  SSL is no help since any crook with $50 can get a 100%
genuine SSL certificate that works in all of the browsers and mail
programs people use, that proudly certifies that a web page or e-mail
is truly from CITIBANK-ACCOUNTS.COM which, of course, is not Citibank.

I suggested that since the banking industry is heavily regulated and
in the US there's no question who's a bank and who isn't, they need a
distinctive signer who only signs for banks with a trademark that
could be advertised for brand awareness.  ("It's not from your bank
unless it has a Golden Dollar Sign in the corner.")  A guy from the
FDIC said they've been thinking about it.

This could help the phishing problem, at least the part of it that's
against banks, but I don't see any extension to dealing with spam.
It's pretty clear that pure authentication agents don't work, because
the costs and benefits don't work.  Most people aren't willing to pay
$5000 for a signer to send someone out to do a background check and a
personal visit, nor are they even willing to go to PGP signing fests,
but without some sort of real world check, it's just pushing paper
around.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 20 Mar 2004 22:45:45 -0500

Barry Shein <[email-masked]> wrote:
> PGP

  To authenticate what, exactly?

  Part of the problem is the lack of a naming scheme for domains.  I
don't know if a company is at "example.com", or "example-company.com",
or "example-this-is-cool.com".  The inability of the end user to trust
a name has a direct correlation to the spammers ability to abuse that
name.

  DNS names are structured, but for marketing/political reasons,
everybody wants a "dot com" name.  So even Canadian businesses aren't
using "example.ca", they're using "example-canada.com", or
"example-ca.com".  That kind of nonsense is causing them problems, but
we're the ones asked to fix the problem.

  So why not enforce structured names?  It's technically feasible, and
is a start towards authenticating *something*.

> ... and just let everyone know that if it isn't via an authenticating
> source then, well, it's no more trustable than any random letter you
> get in your postal mailbox (Congratulations, You have just won one
> of the following four prizes!)

  That requires well-known sources.  If I get a letter from my bank, I
have many ways of telling that the letter is authentic.  If I get an
email from them, I have many fewer ways.

  Signing messages is a start.  But what identity is trusted?
example.com, example.ca, or example-canada.com?  Without a trusted
naming scheme, cryptographic signatures not much more than a way to
burn CPU cycles.

  Alan DeKok.

---

From: Doug Royer <[email-masked]>
Date: Sat, 20 Mar 2004 21:12:37 -0700

>naming scheme, cryptographic signatures not much more than a way to
S/MIME  forces the 'From' address to match the signature.
It makes no other claim. It has nothing to do with your location
or the originating domain. In fact I can send email from several domains,
each using my cert that says I am [email-masked]'. It makes no difference
which domain I send it from, it only means I have the private
key to that public signature and it matches the 'From' line. The
signature only means - yes the signature matches the From line.

If the cert has not been revoked (by checking), then you know that
the person that used the cert had permission to use that 'From' address.

*IF* you trust the CA in the signature, then you trust that it came from
a valid user of that email address and was not forged.

That alone would stop 1,000's of forged email spams I get every week
to the domains I administer.

*IF* you do trust the CA and it is spam - you could add that public
cert to your blacklist, publish that as a spam cert. And you can 
*automaticly*
find the authority for that domain in the signature and complain.

*IF* you do NOT trust the CA - your where your at now. I for one have
a handful of CA's that I trust.

-- 

Doug Royer                     |   http://INET-Consulting.com
-------------------------------|-----------------------------
[email-masked]                 | Office: (208)520-4044
http://Royer.com/People/Doug   | Fax:    (866)594-8574
                               | Cell:   (208)520-4044

              We Do Standards - You Need Standards

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 21 Mar 2004 10:00:43 -0500

Doug Royer <[email-masked]> wrote:
> or the originating domain.

  Which means that you still have no idea if the the address in the
"From" line is truthful.  Please go back and read the rest of my comments.

  If you want to spoof example.com, which has a Canadian branch
office, as an individual, you can register "example-canada.com", and
send S/MIME signed messages from it.  The recipients have no way of
knowing such messages are fraudulent.

  Sure, the signature means it's easier to verify that it was *you*
who committed the fraud, but how does that help the recipients, who've
lost money?  How does that help law enforcement, when you've used that
money to flee the country?

  Validating identities means nothing if the identities being
validated are fraudulent.

> the person that used the cert had permission to use that 'From' address.

  From who?  The signing authority, who sells signed certs for $40?

> *automaticly* find the authority for that domain in the signature
> and complain.

  Again, if that information is valid.  If not, you're stuck.

  It's easy to get a domain and/or certificate with fraudulent identities.

> a handful of CA's that I trust.

  That's nice for you.  How does that scale to everyone else?

  Alan DeKok.

---

From: John Levine <[email-masked]>
Date: 21 Mar 2004 16:54:33 -0000

>the person that used the cert had permission to use that 'From' address.

Well, not quite, you know that the CA that signed the cert thought
that the sender had permission to use that address.

>a valid user of that email address and was not forged.

We're back to the key management problem.  I don't see how a public
signer that signed enough keys to be useful as a whitelist wouldn't
also let enough bad guys sneak through that you'd want to use it as
a blacklist.

For small and reasonably well defined communities, a company signing
its employees certs, or various geekly groups who know each other,
sigs can work, but I've never been able to see a plausible way to
scale up to the whole world of e-mail.

Regards,

---

From: John Levine <[email-masked]>
Date: 21 Mar 2004 16:54:33 -0000

Regards,

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 12:29:34 -0700

>"From" line is truthful.  Please go back and read the rest of my comments.
Now that I have -  so what?

>knowing such messages are fraudulent.
And which trusted CA are you talking about would issue a [email-masked]
address to a example-canada.com email address? None that I know of, so
they could send email as [email-masked] - which would not
be forged - so what?

>money to flee the country?
You have failed to make your point. The only thing you have shown so far
is that [email-masked] sent you email.

I own royer.com, it does not mean that I own all businesses named 'royer'.
So again so what?

>validated are fraudulent.
You have not made the case that [email-masked] is invalid.
You just have declared that it is not [email-masked] and we agree.

>  From who?  The signing authority, who sells signed certs for $40?
Read up on certs to find the answer. If you pre declare that your
will not trust any CA anyway - what's your point?

>  Again, if that information is valid.  If not, you're stuck.
Stuck with what? You now know that [email-masked] is a cert
to ignore or blacklist. Why is that a bad thing?

>  It's easy to get a domain and/or certificate with fraudulent identities.
I'll reimburse you if you can get a fraudulent cert for 'royer.com' from 
a CA that I trust.
Willing to try? In fact I'll pay you twice their fee. Else please stop 
this noise.

>  That's nice for you.  How does that scale to everyone else?
Scale has nothing to do with it - nothing changes.

--

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 12:37:36 -0700

>that the sender had permission to use that address.
Which is why I said:

    "The  signature only means - yes the signature matches the From line. "

and

  "*IF* you trust the CA in the signature, then you trust that it came from
    a valid user of that email address and was not forged. "

>also let enough bad guys sneak through that you'd want to use it as
I do not know of anyone selling keys for a white or black list. I do 
know of a few
CAs that sell certs that match the domains they check them against. The CA
sell certs that match the 'From' line, they do not declare the email 
address pure.

>scale up to the whole world of e-mail.
This is mixing subjects. Being able to validate that the 'From' line is 
not forged
has nothing to do with black or white lists.  You can black or white list
based on email address as well as certs - no change to scaleability.

If over time I learn that 'spam-certs-ca' sells certs for any domain name
I can blacklist any cert signed by them. MUCH more scalable that
trying to guess the thousands 'From' address that may be sending spam.

--

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Mar 2004 14:42:38 -0500

> You just have declared that it is not [email-masked] and we agree.

You know that a given email address or domain is valid, and matches the 
S/MIME certificate. Now what? It still does not prove to you that 
someone is not a spammer.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Mar 2004 14:48:25 -0500

> based on email address as well as certs - no change to scaleability.

While S/MIME certificates may prove to you that a given email address or 
domain is valid, the question is what do we do with that information? 
The end goal here is to reduce spam - the question is how would the use 
of S/MIME help with that?

This is the same problem that we face with LMAP/MARID proposals like SPF 
- once you have established identity, what do you do with that identity? 
Same for IP addresses of MTAs.

> trying to guess the thousands 'From' address that may be sending spam.

Just like we cannot blacklist domain registrars, we will not be able to 
do the same for CAs. All that the CA is providing is assurance that a 
given email address or domain matches the information in the 
certificate. They do not try to tell us whether a given person is a 
spammer. Same for domain registrars.

Yakov

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 12:56:49 -0700

Yakov Shafranovich wrote:

> You know that a given email address or domain is valid, and matches 
> the S/MIME certificate. Now what? It still does not prove to you that 

Now go back and read my email and point out where I said that S/MIME
emails are guaranteed free from spam? I said it would stop forged email.
I made no other claim. I also said that would stop the 1,000's of forged 
emails I get
every week on the systems I administer.

--

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Mar 2004 15:13:07 -0500

> every week on the systems I administer.

Mea culpa - you only addressed the forgery issue. There are still some 
interoperability issues with S/MIME but that's probably something that 
will be solved sooner or later.

However, this is an anti-spam group and within the context of fighting 
spam, how will this help? The problem that I have is that there are 
several identity schemes here and none of them address the point of what 
do you do, once the identity is established. There is IP identity, 
domain/IP identity (LMAP/MARID), more heavier cryptographic identities, 
etc. All of these lead into the same point - once the identity has been 
established, what happens then?

This is a question to the entire group, not you directly.

Yakov

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 13:32:08 -0700

Yakov Shafranovich wrote:

>> This is mixing subjects. Being able to validate that the 'From' line 
>> is not forged
> While S/MIME certificates may prove to you that a given email address 
> or domain is valid, the question is what do we do with that 
> information? The end goal here is to reduce spam - the question is how 
> would the use of S/MIME help with that? 

Computer automated traceability when you trust the CA.

Computer automated cert blacklist creation on spam detection.

Currently it takes manual labor to track spam. Some things can be 
automated, others
take manual time to verify or decipher the true source of the spam. With 
certs from
trusted CAs you can automatically process the cert  back to the cert domain
and complain, blacklist or whatever.

Now you know who is responsible for the domain that used that 'From' 
line.  I can automate
the rejection of that cert. And over time I may elect to stop trusting 
and toss all email
signed by that CA if it turns out they sell a cert to anyone for any domain.

If all email was required to be signed. A spammer could buy a cert from 
a trusted
CA. It would take seconds to minutes for that  cert to be blacklisted 
once they started
sending spam. They would get one shot per cert and that cert would then 
be useless
in a very short amount of time. They would hit very view systems that used a
shared cert blacklist. It would not matter if each copy of the spam was 
unique
or not. A VERY expensive way to send spam.

>
> This is the same problem that we face with LMAP/MARID proposals like 
> SPF - once you have established identity, what do you do with that 
> identity? Same for IP addresses of MTAs. 

Not sure why you think that SPF establishes identity. It only says that 
domain X is
valid for sending with the  address for the listed domain.

Virtual hosting makes blacklisting the IP address a hostile act to the 
innocent
domains on the same shared virtual hosts. Not the same issue.

> Just like we cannot blacklist domain registrars, we will not be able 
> to do the same for CAs. All that the CA is providing is assurance that 
> a given email address or domain matches the information in the 

I agree and I never claimed it would stop spam. I claimed it would stop 
forged email.
And I claim that it would allow for much faster an accurate spam blacklists.

Anyone can blacklist a non-trusted CA.

--

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 13:50:47 -0700

> several identity schemes here and none of them address the point of 
> what do you do, once the identity is established. There is IP 
> identity, domain/IP identity (LMAP/MARID), more heavier cryptographic 
> identities, etc. All of these lead into the same point - once the 
> identity has been established, what happens then?
>

(1) Sign email so that you have a handle for the sender.

(2) Create a standard header that provides information for an 'opt-out'. And
      can be used automatically by a computer. That data needs to also 
include the RCPT value
      that was used as the target. Legal spammers and mailing lists 
would use this.

     Now you can get off of lists by clicking an OPT-OUT button on a 
future MUAs
     that says 'take this RCPT TO' value and remove it from your lists'.

(3) Create a protocol for for black lists much like the IM complain buttons.
      It does not matter why thousands of people 'complain' about the 
email (or IM)
      If thousands of people complain, add the cert to the black list.

     Have the protocol track if the user says 'spam', 'offensive', or 
whatever.
     Allow the black list subscribers to select they do not care about 
offensive
     complaints and only want a mostly spam free inbox. We have PG-13
     PG-17 and it got this rating for 'adult content' or whatever. No 
censoring
     of the address, just a meta tag. One, two, or a few may get mis 
tagged a few times.
     But thousands of people says 'offensive' would be a good hint to 
others.

     Who would hold this data? The same people that make money selling
     the much less accurate black lists now. If you do not like them, do 
not subscribe.

(4) Some kind of SPF record is needed. If someone steals my S/MIME cert
       and the matching password. They COULD send spam as me. But with
       some kind of SPF record, they would have to do that from my domain.

       Now I can retake control of my cert (a) cancel it (b) blacklist my
       own cert as 'stolen' (c) call my admin and say that 'someone' 
from 'our'
       domain has stolen my cert and password and is sending email as me.
       MUCH more controllable and trackable.

(5) If some kind of virus figures out how to use my cert / password.
       Same solution as (4).

--

---

From: John Levine <[email-masked]>
Date: 21 Mar 2004 21:20:24 -0000

>Computer automated cert blacklist creation on spam detection.

Oh, goody, anyone who dislikes me can send in a few denouncements and
get me added to blacklists.  You're making one of the classic FUSSP
errors, to assume that bad guys (not all of whom are spammers) will
play by the rules.

AOL has a system fairly similar to what you're proposing built around
their spam button.  Since their mail system is closed, they know the
IP from which each message was sent, and they carefully track the
complaint rates of each sending IP.  Moreover, if you send them your
IP range and contact address, their scomp subsystem will send you back
the mail that people complain about.  I can report that 100% of the
mail that scomp sends me is either mail from confirmed opt-in lists or
direct responses to mail that the AOL member sent.  None of it is spam
by any definition other than "mail I don't want".  If you're going to
blacklist on complaints, the false positive level will be ferocious.

Regards,

---

From: John Levine <[email-masked]>
Date: 21 Mar 2004 21:20:24 -0000

Regards,

---

From: der Mouse <[email-masked]>
Date: Sun, 21 Mar 2004 16:19:55 -0500 (EST)

> Just like we cannot blacklist domain registrars,

We can't?  I see no real reason why not.  It would be mildly
complicated by all the different whois output formats, but only mildly.
(More of a problem would be that a few TLDs don't tell you what the
registrar for a domain is in a form that can be matched up with other
TLDs' info, but that merely means you have to maintain separate BLs for
such TLDs.)

You do write that

> [CAs] do not try to tell us whether a given person is a spammer.
> Same for domain registrars.

Legitmate CAs, and legitimate registrars, perhaps.  But even among the
legitimate ones, some will be spammer-friendlier than others, and there
will soon be some that are pure spammer fronts - for example, if I
thought it were worth the bother to implement, I would cheerfully
reject anything registered through paycenter.com.cn.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Mar 2004 16:38:52 -0500

> TLDs' info, but that merely means you have to maintain separate BLs for

Technically it is feasible, practically it might not be as simple.

> reject anything registered through paycenter.com.cn.

How can a registrar be "spam friendly"? They are not required to do any 
checking at all on registrations, so I am not sure how that would be 
defined.

Yakov

---

From: der Mouse <[email-masked]>
Date: Sun, 21 Mar 2004 16:55:54 -0500 (EST)

> How can a registrar be "spam friendly"?

- The registrar may actually *be* a spammer.  I've seen it said that
   paycenter.com.cn is an example, and what I've found on the subject
   certainly doesn't disagree.

- They may fail to nuke spamemr domains once they are noticed and
   pointed out to them.  (Such failure was recently almost universal.
   This is changing.)

- They may fail to make even rudimentary checks on the information
   provided.  For example, I once saw a spammer domain registered with
   country=US, state=Madrid.  I've seen spammer domains registered to
   postal addresses containing no letter but X, repeated many times
   over.

- They may do pink contracts, or ignore complaints, or any of the
   various other ways that any organization can be spam-friendly.

> They are not required to do any checking at all on registrations, so
> I am not sure how that would be defined.

They are not required to do any checking, no, but they are not
prohibited from, either.  Failing to take reasonable antispam steps
(even if not strictly required to) counts as spam-friendly in most
other contexts (ISPs, webhosters, etc); I don't see why it wouldn't for
domain registrars too.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 21 Mar 2004 17:50:08 -0500

> Now that I have -  so what?

  I was pointing out that you have no way of knowing *which* address
is the "real" one.  The fact that all of them are signed and certified
is irrelevant.  When you get email from "[email-masked]", and
"[email-masked]", and "[email-masked]", you still don't know
which one is real.  The others could very well be fraudulent.

> address to a example-canada.com email address? 

  I've never said that.  Stop trying to misinterpret me.

> I own royer.com, it does not mean that I own all businesses named 'royer'.

  You're missing my point, that's what.  How does *anyone* associate
the "royer" business they know in meat-space with a "royer" they see
on the net?  Heck, I can register 'the-real-royer.com", steal your
content, get certs signed for it, and announce that "royer.com" is
fraudulent.  How much time and money will you lose?  And you won't be
able to catch me.  The best you can hope for is to convince a
registrar to nuke the name.

> I'll reimburse you if you can get a fraudulent cert for 'royer.com' from 

  See, I say "fraudulent identities", and you say "fraudulent cert".
Do you understand that you're not talking about the same thing I'm
talking about?

  Alan DeKok.

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 16:07:01 -0700

>errors, to assume that bad guys (not all of whom are spammers) will

Oh goody - you have no constructive comments - guess what?
I can add you to my blacklist anyway.

If you don't like them, don't use them.

--

---

From: Mark Baugher <[email-masked]>
Date: Sun, 21 Mar 2004 15:10:35 -0800

At 12:13 PM 3/21/2004, Yakov Shafranovich wrote:
<...>
>This is a question to the entire group, not you directly.

If we get forgery under control, then it is possible to apply reputation, 
accreditation, blacklisting and other techniques to manage spam.  What am I 
missing?

Mark

---

From: Doug Royer <[email-masked]>
Date: Sun, 21 Mar 2004 16:33:54 -0700

>which one is real.  The others could very well be fraudulent.

If you get a signed message where the cert is signed by a trusted CA, then
it is not fraudulent. It is the 'From' address when the signature matches.

Are you claming that you want some way to tell if the content is fraudulent?

>  I've never said that.  Stop trying to misinterpret me.
Then you have failed to make your point as it can't be fraudulent if the
cert is valid from a trusted CA.

>on the net?
New flash: There are several 'royer.whatever' sites around the world. In 
case this
has confused you  - we are not related in any way with each other. The same
is true of MANY commercial establishments  in your telephone phone book.
Do you think that they are all related if they have similar names?  Did 
you think
that they can not commit fraud just because they are in the phone book
with a similar name to your favorite stores?

Did you think they were? If not - what is your point? If it is that
there is no way to do content fraud detection  then you are right
and it still has nothing to do with S/MIME.

>  Heck, I can register 'the-real-royer.com", steal your
>fraudulent.
No, you could send email claiming that it was fraudulent.
You could post on your web site claming that it was fraudulent.

My email would still be valid and the cert I used would still
be valid and traceable to royer.com.

The cert used by 'the-real-royer.com' would still be valid
and traceable to 'the-real-royer.com' .

Your talking about SITE  certs - not S/MIME.  Not spam.

Your talking about fraud detection by content  that just happened
to be sent in spam.

>  How much time and money will you lose?  And you won't be
Your missing the point. We are NOT talking about  site certs.

Content fraud is for the police when you track them down.

>Do you understand that you're not talking about the same thing I'm
Do you understand that "fraudulent identities" are extremely difficult if
the there is no "fraudulent cert"? Do you understand that it would require
some kind of mass conspiracy and bribing of a good CA to generate
a "fraudulent cert" that then could be used for "fraudulent identities"?

Or are you talking about fraudulent content detection?

--

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Mar 2004 18:35:39 -0500

Mark Baugher wrote:
> If we get forgery under control, then it is possible to apply 
> reputation, accreditation, blacklisting and other techniques to manage 
> spam.  What am I missing?
> 

Yes, you are correct. The trick question is how to apply them.

Yakov

---

From: "Tom Thomson" <[email-masked]>
Date: Mon, 22 Mar 2004 12:55:34 -0000

> This is a question to the entire group, not you directly.

It's rather a question of what you do if you can't establisj identity,
surely? Most of the spam I receive has forged From: address (822 header, not
821). If there was an easy way of determinig that an address was forged (a
way which would cater for mailing lists) I would use it and discard all the
mail with forged adresses.  I know this will raise howls of rage from the
undisciplined roamers but I don't care - if they can't be bothered to sort
out their roaming in a disciplined manner (for example From: wherever they
are, with a Reply To: header to identify their base; or secure tunneling to
their base from wherever they are; or use S-Mime; or whatever, depending on
what the authentication method is) then I don't care if I don't see their
mail.  I also know that (unless spammer practises change a lot) such a
mechanism would eliminate most of the spam I receive.

The other useful thing about sender authentication is that it makes law
enforcement easier.  That will help reduce spam too.

Finally, there are plenty of blacklists out there which use email sender
lists (and MS of course provide a nice mechanism for dummies to blacklist
senders in their MUA offererings).  With sender authentication these
blacklists will cease to be a disaster (since they won't contain the forged
addresses).  Maybe they won't be useful, but they will at least be less
harmful than today so the mechanism will reduce the damage done by spam.

To me, that's a good enough reason to want some sort of easy and reliable
sender identification.

Of course it doesn't help with phishing spam, or with anuy sot of spam,
where the sender is using an address he owns - execpt that he might now be a
little easier to trace for law enforcement purposes.

Tom

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 22 Mar 2004 10:18:14 -0500

Doug Royer <[email-masked]> wrote:
> it is not fraudulent.

  <sigh>  You are being obtuse.  The cert is valid, the underlying identity the cert is alleging may very well be fraudulent.

> cert is valid from a trusted CA.

  No... you have failed to understand my pouint.  That's different.

> New flash: There are several 'royer.whatever' sites around the
> world. In case this has confused you - we are not related in any way
> with each other. The same is true of MANY commercial establishments
> in your telephone phone book.  Do you think that they are all
> related if they have similar names?  Did you think that they can not
> commit fraud just because they are in the phone book with a similar
> name to your favorite stores?

  It's easier to tell them apart in the physical world.  On-line,
there are fewer clues to tell them apart.

  Are you really that dense?

> and it still has nothing to do with S/MIME.

  Did I ever say it did?  You're the one getting all hot and bothered
over certificates.  I have no clue why, as my original point had
little to do with certificates.

  So you're either misunderstanding me, or trying to hijack the
conversation.  Either way, you're arguing against a position I've
never taken, so I don't know why I'm wasting my time trying to explain
myself to you.

> Your missing the point. We are NOT talking about  site certs.

  I know what I'm talking about.  I have no clue what you're talking
about, or why you think your conversation has anything to do with the
issues I raised.

  Bye.

  Alan Dekok.

---

From: Doug Royer <[email-masked]>
Date: Mon, 22 Mar 2004 13:54:51 -0700

>  <sigh>  You are being obtuse.  The cert is valid, the underlying identity the cert is alleging may very well be fraudulent.
No the identity matches the cert. Your talking about content fraud not 
identity fraud.
If the cert says its is user-x and the signature is valid then it is not a
fraudulent identity even when the content is a fraudulent.

>  Are you really that dense?
Are you always this rude?

--

---

From: Barry Shein <[email-masked]>
Date: Mon, 22 Mar 2004 13:28:07 -0500

> accreditation, blacklisting and other techniques to manage spam.  What am I 

That the USPS (and no doubt others) haven't been able to make much of
a dent in this in 200+ years?

There's a paradox here. Authentication etc costs money, even if just
microcents it adds up in some contexts. People want e-mail to be
essentially free.

I think we can probably find ways to prevent people from bringing fork
lifts into the all you can eat buffet. But fraud and authentication in
general is a huge topic which probably is best solved by someone
figuring out a model for a "charging for authentication business",
akin to registered or certified mail.

Put another way, it's one of those problems that seems to be easy on a
very small scale (exchange PGP keys with your friends), but becomes
very hard as you scale it up, particularly if the first criteria is
that it must not cost anything.

          -b

---

From: "George Ou" <[email-masked]>
Date: Mon, 22 Mar 2004 14:32:15 -0800

1.  This makes a great case for better verification at the time of the
certificate issuance.  Especially for code signing certificates from a major
software company.  Companies should be able to request extremely high
verfication standards for themselves from companies like VeriSign,
especially if you're Microsoft.

2.  This makes a good case for a defacto standard of built in HSMs on all
PCs.  I think the TCG "Trusted Computing Group" is pushing something like
that in their new standard.  Next month, the company I work for will release
our first notebook with a TPM built in.

George

----- Original Message ----- 
From: "Ken Hirsch" <[email-masked]>
To: <[email-masked]>
Sent: Monday, March 22, 2004 1:29 PM
Subject: Re: [Asrg] S/MIME

> From: "Doug Royer" <[email-masked]>
> Consider the following two scenarios.
> 1. A person lies to the CA about their identity, yet the CA issues them a
> certificate.
> E.g. http://www.microsoft.com/technet/security/bulletin/MS01-017.mspx
>
> 2. An email worm installs spyware which steals certificates off of PCs and
> installs keystroke logging software to steal the password.  A spammer uses
the
> thousands of certificates to send email.
>
> If either of these result in somebody sending mail claiming to be
> "[email-masked]", is this identity fraud or content fraud?
>
>
>

---

From: "George Ou" <[email-masked]>
Date: Mon, 22 Mar 2004 14:34:27 -0800

Isn't that what DNSSEC is suppose to address?  That certainly doesn't have
the scalability problems like PGP.

George

----- Original Message ----- 
From: "Barry Shein" <[email-masked]>
To: "Mark Baugher" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, March 22, 2004 10:28 AM
Subject: Re: [Asrg] S/MIME

>  > If we get forgery under control, then it is possible to apply
reputation,

---

From: Doug Royer <[email-masked]>
Date: Mon, 22 Mar 2004 16:11:25 -0700

>E.g. http://www.microsoft.com/technet/security/bulletin/MS01-017.mspx
Yes  - and that CERT was REVOKED before most people knew of the fraud or 
error.
Try to use it and all receiving systems tag it as an invalid revoked 
signature because
the revocation list for that CA lists that serial number as revoked.

Problem solved and that fixed the problem.  So in effect the CERT was 
blacklisted
by all sites even when they do not use blacklists. Because it works to 
use certs.

>installs keystroke logging software to steal the password.  A spammer uses the
As soon as the blacklist sites detect it as spam, that cert is 
blacklisted. Problem solved no
matter how many variations or password protected zip files it sends, it 
is stopped
once that cert is blacklisted. In many cases within minutes of the start 
of the spamming
when they spam some sites. Because certs work.

Now the owner of that cert can contact their CA and say it was stolen, 
and have
that serial number revoked. Now it is invalid to all sites even to sites 
that do not
use blacklists.

>"[email-masked]", is this identity fraud or content fraud?
Try to buy an email cert from a CA that I trust for royer.com. Same 
thing I told
the other guy - I'll pay you twice their fee if you can get an email 
cert for a
royer.com email address.

If the content of the email says I am 'Royer Real Estate' (royer.ca) and 
I am
not and I then I sign it [email-masked], then it is content fraud and 
not identity
fraud because my identity is [email-masked]' and that is what the valid
signature says.

--

---

From: Doug Royer <[email-masked]>
Date: Mon, 22 Mar 2004 16:36:29 -0700

Barry Shein wrote:

> dent in this in 200+ years?
>
I do not think they have that task and as they also do not require that 
the sender sign
the postal mail with a 3rd party verified signature it is not a valid 
comparison.

>microcents it adds up in some contexts. People want e-mail to be
An email cert from your ISP could be free or included in your sign up fee.
In fact your ISP could interpose on port 25, check the 'from' values
and sign it for you - for free (for those that use the ISPs email 
addresses) if
the ISP is a CA.

>akin to registered or certified mail.
You can send registered and certified postal mail without showing any ID 
at all. Not
the same model. The recipient of the registered or certified mail has to 
show
identity, not the sender.

If you think that stopping spam will require a fork lift to a buffet, 
then I can
make money selling your competitors digital signatures real cheap :-)

I do not think that it is heavy weight at all. It is implemented by most 
(all?) of
the GUI MUAs that I have seen over the last few years.

>that it must not cost anything.
Yes - PGP will not work. I am talking S/MIME, it does not have that scaling
problem as the number of CAs is MUCH lower and does not require a 4th
hand he said she said you can trust that person problem.

--

---

From: Eugene Crosser <[email-masked]>
Date: Tue, 23 Mar 2004 12:35:28 +0300

> established, what happens then?

I beleive that authentication and reputation services can and should be
separated.  Authentication services (that include protocols like LMAP
and certification authorities) establish solid facts about senders, and
thus are policy agnostic.  On the contrary, reputation services may
differ greatly in their listing/delisting policy, "level of certaintly"
etc.

Thus, mail system administrators can use a single way to authenticate
senders, or one of limited number of ways.  Once sender identity is
established, it can be checked against a subset of potentially very
large number of reputation services, selected in accordance with local
policy/preferences.

Eugene

---

From: David Maxwell <[email-masked]>
Date: Tue, 23 Mar 2004 15:44:49 -0500

> a dent in this in 200+ years?

I bet that if USPS did want to do this, the first
thing that they would do is to close down public mailboxes, and only
pickup mail from a locked box.

You and USPS would be the only entities with keys to your box. USPS
picking up mail there would know it was from you.

However, USPS has a goal of 'convienience', so that you can drop mail
into any mailbox anywhere, and (For a fee) have it go to anyone.

Sounds a lot like SMTP, hmm? (except for the fee)

-- 
David Maxwell, [email-masked][email-masked] -->
(About an Amiga rendering landscapes) It's not thinking, it's being artistic!
					      - Jamie Woods

---

From: Mark Baugher <[email-masked]>
Date: Mon, 29 Mar 2004 09:10:45 -0800

>a dent in this in 200+ years?

ietf-mxcomp is addressing this issue.

Mark

---

From: "Ken Hirsch" <[email-masked]>
Date: Mon, 22 Mar 2004 16:29:56 -0500