Subject: idea for spam protection

From: "Johan Henriksson" <[email-masked]>
Date: Sat, 12 Mar 2005 15:55:12 +0100 (CET)

hi,
I didn't find a suitable working group so I post it here. I hope
it isn't a too inappropriate list.

I haven't really been following the debate regarding spam protection
and had rather hoped that the issue would be resolved on its own
but it seems it won't. I have had an easily realizable idea (oh well)
for spam protection for a while:

the reason spam gets sent is because obviously someone is making money
at it. if it suddenly becomes expensive to send emails, it will stop.
my idea is to use encryption (for now - better alternatives might exist);
if it takes up to 1 minute to encrypt a mail, the cost per mail is
increased greatly.

this would be realized through an extension to the SMTP-protocol,
allowing the server to request that (say) some message is to be encrypted
with a key (which is horribly large, or a more expensive algorithm is
requested). when the sender gives the encrypted message, the server
verifies correctness and lets the email through.
obviously, the algorithm should be chosen as to create much work for
the sender and little work for the verifying receiver. instead of
encryption (which government hates so much), an NP-hard problem could
be used instead.

an extension on top of that is a feature to let trusted mails through,
which is needed for mailing lists to still work. this could be solved
with assymetric keys (signing).

so, first off, has anyone looked at realizing this? if not, how do
I get around to get things started? should I publish some RFC-draft
and, if so, where?

thanks,
Johan Henriksson

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Bill Sommerfeld <[email-masked]>
Date: Sat, 12 Mar 2005 10:18:28 -0600

> if it takes up to 1 minute to encrypt a mail, the cost per mail is

this is not new.  variants have been proposed under a number of names for 
years (see "hashcash").

IMHO, this one's a bad idea on a number of fronts;
	- bad for the environment due to excessive energy consumption.
	- bad for battery life on portable/mobile devices.
	- discriminates against older/low powered senders.
	- doesn't actually help stop spam because the black hats today use
	  use viruses, etc., to recruit insecure systems into their zombie
	  armies of open proxies.  
	  these insecure systems are probably idle most of the time and 
	  could easily be reprogrammed to burn cycles on proof-of-work 	 
          functions.

where's that Final Ultimate Solution to the Spam Problem scorecard?

						- Bill