Subject: [Asrg] 3b. SMTP Verification - Reputation/Accreditation Services - Problem Statement

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Mar 2004 07:54:09 -0500

After the much heated discussion on the topic, I want to back track and 
ask all of you a simple question:

What aspects of the spam problem do these services 
(reputation/accreditation) propose to solve? What types of spam messages 
specifically do they address?

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 10 Mar 2004 15:44:26 -0000

I think they are attempting to address the problem of recognizing non-spam
as non-spam.  They don't address any particular sort of spam, they merely
tell us that certain people are accredited as non-spammers according to yhe
service managers definition of non-spammer..

Given that mailboxes that have been used for mailing lists (like ASRG) which
expose addresses in their archives and/or for posting to newsgroups tend for
a long time will tend to receive more spam than non-spam, anthing that helps
make the distinction is potentially useful.

We are going to have to put up with vast quantities of spam for the
forseeable future, especially since US Federal legislation has provided the
spammers with the right to send as much spam as they like provided they
conform to some fairly trivial rules, and also prevented the ordinary
victims of spam from suing spammers who don't follow even those rules, so
accreditation services may be useful.  On the other hand, they may be about
as useful some of the RBLs we currently suffer from (ie no use at all).

It's a pity the US legislature has again, as it so often does, chosen a
model that supports the providers of campaign funds instead of a model that
protects the ordinary Joe. Maybe we can get can-spam canned and siome
sensible legislation in its place (adopting the EU directive might be a good
start) but I doubt it - the "legitimate" advertisers have an axe to grind
and provide too many pennies to the election candidates to be ignored.

Tom.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Yakov
Shafranovich
Sent: 10 March 2004 12:54
To: ASRG
Subject: [Asrg] 3b. SMTP Verification - Reputation/Accreditation
Services - Problem Statement

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 10 Mar 2004 15:04:22 -0500

The problem is that these definitions vary as we have seen with
blacklists, and if we go that way, we'll end up with the same problems.
That's what worries me in particular regarding reputation systems and 
blacklists. In regards to whitelists and accreditation, what worries me 
is how they are used.

Yakov

---

From: Philip Miller <[email-masked]>
Date: Wed, 10 Mar 2004 17:30:11 -0500

Tom Thomson wrote:
> tell us that certain people are accredited as non-spammers according to the
> service managers' definition of non-spammer.

That would be a broken reputation system. Any honest reputation system 
should have hard, definite rules for inclusion, with no element of 
subjectivity. This will quite intentionally include 'legitimate' spammers, 
who can then be filtered by a blacklist that references some well-known 
accreditation system. Any spammer who registers his mail immediately becomes 
identifiable and filterable. Any spammer (or non-compliant regular sender) 
who doesn't register gets filtered out because they have no reputation on 
record anywhere.

> make the distinction is potentially useful.

It's too bad groups like this don't exclusively use newsgroups instead of 
email. Unfortunately, although it sounded like a great idea when it was 
discussed here, it never really jelled.

> as useful some of the RBLs we currently suffer from (ie no use at all).

Although I don't like the law either, that doesn't sound like a fair 
characterization of CAN-SPAM. I don't recall it specifically denying any 
private right of action, although it did preempt some state laws that 
provided for that right.

> protects the ordinary Joe. Maybe we can get can-spam canned and some

Legislation is not within the scope of this group, and with good reason: the 
Internet is international, and so must be any _technical_ solution to the 
spam problem. There is no possibility of an international convention 
defining and outlawing spam any time soon.

> Tom.

Philip Miller

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 11 Mar 2004 18:43:04 +0100

> specifically do they address?

IMHO the idea behind a reputation/accreditation works like that:
w1) gain a good reputation for the system by getting some people
   with a good reputation to work for or give their name for it.
w2) depending on the type of reputation system (whitelist
   / blacklist / neutral list) they try to use this information and
   e.g. in case of whitelists try to hand down their reputation.
   It works like a web of trust: I trust the system so I trust
   their statements.
w3) the problem arising is the quality of the system and the time and
   effort they put on the validation process and keeping the information
   uptodate.
   There are also external influences like legislation and political
   pressure.

The problem these kind of systems try to solve are IMHO
1) authentication
   with the worth of their own reputation they try to build a trust
   situation for the sender by providing some kind of certificate
   like "this sender is really the sender he pretends to be".
   This could also be done with TLS/CERTs but would require such
   a cert for each and every mailserver (like we now have it with
   most HTTPS server that want to offer authentication).
   They kinda run a central authentication service instead of a
   decentralized one and solve the problem for the admins to have their
   MTAs talk TLS which is not widely deployed currently.
2) policy
   while the authentication information per se is neutral with regards
   to good or bad, white or black it is important for some receivers
   to get a clue about policies the sender adopts to.
   There have been proposals to allow the sender to communicate his
   policies, however I don't know of any sending MTA communicating
   policies. (Some receiving MTAs express policies in the initial
   greeting like "220 mail.example.com no spam/UCE allowed").
   There is something (roughly) similiar for HTTP that are called P3P
   and PICS (Platform for Internet Content Selection)
       http://www.w3.org/P3P/
       http://www.w3.org/PICS/
   The problem that still exists, even with publishing policies, is again
   trust. Receivers wish to know whether they can trust the policies
   published by the sender or if the sender simply is a liar.
   This is the second area reputation/accreditation try to help with,
   they publish policies that senders promised to stick to and they
   certify that the sender is not a liar.

But with w3) above there are problems with the correctness of this
information.

IMHO the problems these systems try to solve is not only spam but mainly
provide values for a rating system (like spamassassin uses) to reduce the
number of false positives by allowing to apply rather high scores and
thus work like white/blacklists.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: "Tom Thomson" <[email-masked]>
Date: Fri, 12 Mar 2004 15:46:53 -0000

> who doesn't register gets filtered out because they have no reputation on

What do you mean by "subjectivity"?  Are you are saying that there are
greater elements of subjectivity if the service manager publishes a
definition than if he fails to do so?  I can't see what else what you wrote
can mean, but I also can't actually believe you really meant that.

Why is the system broken if the person running it publishes definitions?
Surely it would be more broken if there were no definitions provided?

Why does an accreditation service have to include all emailers?  If I have
have hard rules for inclusion, surely those hard rules can exclude people?
If they can't, the "hard rules"  you say the system must have are actually
impotent and there's no point in having them.

[snip]
> defining and outlawing spam any time soon.

depends what you mean by "international".  There have been attempts to get
US/EU agreement on the topic, but they have failed because the US side
doesn't want to do anything that might actually stop the spammers from
spamming.  The EU seems to be quite successful in promoting bilateral
agreements on this topic with countries other than the US.  Agreements
withing the EU and bilateral agreements between the EU and other parties are
"international" by most definitions of the term.

Tom

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 12 Mar 2004 20:25:25 +0100

> can mean, but I also can't actually believe you really meant that.

I don't know if it is what Philip meant, but I understood it that way that
such a system has to have hard rules and only these rules decide about
inclusion or not. Addons like "but we may not include you if we don't like
the name of your company, even if all the other rules are fulfilled" in
inacceptable.

> impotent and there's no point in having them.

The rules should not separate spammers from non-spammers per inclusion
but allow inclusion of all and thus provide authentication. You then can
have blacklist based on the authenticated data.

Think SSL/TLS: Everyone can buy a certificate signed by a CA as long
as the domain/server he wants to buy it for is theirs and they can
authenticate themselves via official documents like a company register
or something like that. This authenticates the host, but it does not
rate him good or bad.
However it is easier and safer for e.g. the receiver to build a blacklist
based on this authenticated data.
So the reputation/accreditation system should be open to everyone.

> "international" by most definitions of the term.

*lol*
The EU doesn't even manage to get the agreement ratified by all it's
member countries. Sad to say that but even my government hasn't ratified
the EU directive whose deadline has been sometime last year.
I haven't yet seen any agreements of the EU with other non-EU countries
regarding spam.
And sorry, providing a link for opt-out is not a solution to spam.
And IANAL but IMHO the demand for providing a opt-out possibility does
not include that a spammer must honor the request.

What the governments try is to kid all joe users because the pressure
from the indutry and their clueless marketing departments is so strong
that they will never decide something that will cause them disprofit.
And some companies that cry out loud and complain about spam are
spammers themselves.

So it is better not to trust on political help to solve the problem.

	\Maex

---

From: Philip Miller <[email-masked]>
Date: Fri, 12 Mar 2004 22:36:40 -0500

> the name of your company, even if all the other rules are fulfilled" in

That's exactly what I meant. It was an echo of sentiments expressed by 
others here.

> have blacklist based on the authenticated data.

Exactly my point. I didn't say a list has to include all email users, but 
all those in compliance with the rules for inclusion, spammer or not.

> So the reputation/accreditation system should be open to everyone.

My personal opinion is that there are much lighter-weight ways to do 
authentication for this purpose, but I figure that if people are going to 
make these lists, then they should be on sound technical footing, and hard 
rules are one facets of that.

> So it is better not to trust on political help to solve the problem.

Thank you Markus, you made that point much more effectively than I could.

Philip Miller