Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Tue, 31 May 2005 14:26:39 -0500

> > I think we can now embrace the concept that we can create CAPTCHA
> > that are = beyond any practical attack that a spammer can generate.
> 
> Hmmn.  I gather you're not familiar with the free porn proxy attack:
> spammer puts up a web site offering free porn with access granted by
> solving the CAPTCHAs that it proxies through from its spam runs.  I'm
> not sure if I've seen this used yet, but it would not be hard to do.

I am very familiar with the concept of the free porn proxy attack.  I address this issue specifically on my website:
http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

The response is under the "Critique Questions and Answers" section.  After my website was featured on Slashdot there was a deluge of criticisms concerning the porn proxy attack by people who did not completely review my website, so near the end of my website I expounded once again on the futility of this attack (basically the small number of CAPTCHA that can be solved would be irrelevant within the context of my anti-spam system).

I will also mention that I attended the Second International Workshop on Human Interactive Proofs this month at Lehigh University http://www.cse.lehigh.edu/prr/hip2005/index.html
Everyone was aware of the concept of the porn proxy attack but no one was aware of it being in current use.  The organizers of the conference asked if anyone could provide a website where this was taking place but no one could.  If you know of such a website then please let me know and I will forward it to the organizer of the conference.

> CAPTCHA's of any form have two other killer flaws.  One is that in the
> absence of widespread strong user authentication, which doesn't seem
> any closer now than it's been for the past decade, spammers can avoid
> your challenge by spoofing mail from someone on your whitelist.  The
> other is that significant numbers of people, through bafflement or
> exasperation, decline to respond to challenges so unless you never get
> mail from people you don't know (in which case a whitelist is all you
> need) CAPTCHAs will always lose real mail.

You criticisms refer to a conventional C/R system but do not apply to my anti-spam system.  The whitelist system as described by my anti-spam system only contains personal contacts and individuals to whom you have sent email.  There is no way for a spammer to determine who is on your whitelist.  Even if spammers learned the identity of one or two contacts on your whitelist then it wouldn't matter; you would remove these names from the whitelist but you would still be able to receive mail from these individuals as they will just use a valid sub-address like everybody else.

Thank you for you input,
Michael G. Kaplan

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Robert Raisch <[email-masked]>
Date: Tue, 31 May 2005 16:31:57 -0400

Michael Kaplan wrote:

> There is no way for a spammer to determine who is on your whitelist.  
>
Other than say, loading your computer with malware and firing off your 
whitelist to other, malware infected SPAM-spewing zombies?

Michael, while I have, in the past, admired the passion with which you 
make your arguments,  I think you'd greatly benefit from a copy editor 
who lacks the umm... "unshakable confidence even in the face of 
inconvenient facts" you appear to enjoy.

/rr

-- 
"The Senators and Representatives before mentioned, and the Members 
of the several State Legislatures, and all executive and judicial 
Officers, both of the United States and of the several States, shall 
be bound by Oath or Affirmation, to support this Constitution; but 
NO RELIGIOUS TEST SHALL EVER BE REQUIRED as a Qualification to any 
Office or public Trust under the United States."
U.S. Constitution Article IV; Clause 3

---

From: Seth Breidbart <[email-masked]>
Date: Tue, 31 May 2005 17:20:39 -0400 (EDT)

> whitelist to other, malware infected SPAM-spewing zombies?

If your computer is infected, wouldn't it be easier to have the
malware drop the spam (not SPAM, that's Hormel's product) directly
into your inbox without worrying about any filters (such as your
ISP's)?  For that matter, why bother with mail at all; why not just
show it to you via popups?

Oh, some malware does that already.

Admittedly, your address book is a list of victims who likely have
_you_ whitelisted; but again, having the malware send directly from
your computer works even better, because then the spam's headers all
match the real mail you send.

Seth