Subject: [Asrg] Community proposal alert...Vendor Proposes Open E-mail Standards To Fight Spam

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 2 May 2003 16:28:13 -0400

Here is another for the pile and an interesting side-bar.

-e

Vendor Proposes Open E-mail Standards To Fight Spam

The Trusted E-mail Open Standard proposed by ePrivacy Group could help
fight spam by adding verifiable sender identification and content
assertions to e-mail.

http://computerworld.com/newsletter/0,4902,80902,00.html?nlid=AM

Wireless Spam On Its Way To The U.S.

Text-based ads, already common in Japan and Europe, are coming to cell
phones and PDAs in the U.S. And some of those messages will almost
certainly be spam.

http://computerworld.com/newsletter/0,4902,80912,00.html?nlid=AM

-----
Eric Williams, Pres.
Information Brokers, Inc.    Phone: +1 202.889.4395
http://www.infobro.com/        Fax: +1 202.889.4396
mailto:[email-masked]      Pager: +1 301.303.8998
           For More Info: [email-masked]
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789
----------------------------------------------------------------
The information in this message is confidential.  It is intended
solely for addressee(s).  Access to this message by anyone else
is unauthorized.  If you are not the intended recipient, any
disclosure, copying, distribution or any action taken or omitted
to be taken in reliance on it, is prohibited and may be unlawful.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Fri, 2 May 2003 20:07:10 -0400

>http://computerworld.com/newsletter/0,4902,80902,00.html?nlid=AM

Looks to me like a warmed over rehash of PGP signing maybe with some
SSL/TLS kind of stuff thrown in.

It mostly deals with knowing that "MAIL FROM:<[email-masked]>" or
similar is actually coming from someone at bigco.com because their
certificate (&c) can be checked in the SMTP conversation.

But this, to me, is a tiny part of the spam problem.

I agree that a fair amount of spam forges something like [email-masked]
so you're either more likely to read it or it passes through any
filter which might otherwise block another address or both.

But a ton of spam we block here really is from bigco.com, or more
specifically bigisp.com (e.g., DSL blocks from comcast.com seem to be
a huge source of pain lately, not to mention our friends across the
pacific) so it doesn't help with any of that.

And then there's the whole (legitimate) forwarding problem which is
probably better solved by PGP signing because no matter how much it
bounces about you can still verify the final message as having
originated from who it says it's from with a high degree of
confidence.

But for that an MUA could just mark whether the SMTP conversation was
with a server actually within bigco.com's netblock and accomplish much
of the same thing as this proposes.

And, even better, add some way to get bigco.com's list of outgoing
mail server's ip addresses and verify it came from one of those,
something similar to a reversed RBL or DNSRBL. That info is already
very reliable and in the Received headers.

So, apparently well-intentioned, but mostly redundant and orthogonal
to the actual problem it claims to have been designed for.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 2 May 2003 18:34:48 -0600 (MDT)

> From: "Eric D. Williams" <[email-masked]>

> Here is another for the pile and an interesting side-bar.

"pile" has some of the right connoations.

> http://computerworld.com/newsletter/0,4902,80902,00.html?nlid=AM

Chasing links in that I ended up at the imfamous old stories, announcments
and press releases:
    http://www.computerworld.com/securitytopics/security/privacy/story/0,10801,61475,00.html
    http://www.postiva.com/
    http://www.truste.com/about/TrustedSenderReleaseFINAL.html

The last says:

  } Every email sent by a Trusted Sender-certified company will
  } display a unique seal in the top right corner of the email message, by
  } which consumers can verify that the message is: 

and never mind minor complications including:

   - S/MIME, PGP, SMTP-AUTH, and STARTTLS already exist and are widely
      implemented.

   - It often does not make sense to talk about dislaying seals in
        top right corners of email messages.  (Hint: SMTP is not HTTP)

   - The list things the seal assures has nothing to do with not being
       spam, unless your definition of spam is the DMA's.

   - TrustE has earned is reputation as the guardian of whatever privacy
       policy an outfit wants to set, unless it wants to change it
       without warning, in which case that's ok too.

http://eprivacygroup.net/teos/TEOSwhitepaper1.pdf starting on page 14
defines as other than spam as any bulk mail, even if unsolicited, that
has more or less honest headers.  This notion is distinctly similar
to TrustE's notion of a web site that protects privace provided it
doesn't lie about violiating it.

That white paper has all kinds of cryptographic gunk that makes sense
only if you assume S/MIME, PGP, and SMTP-AUTH do not exist and that some
outfit should be paid to verify the identities of spammers.

In other words, it's a high class version of the so called spam
defenses from such as Stu Sjouwerman's Sunbelt Software.
See 
http://groups.google.com/groups?q=iHateSpam++group%3A*abuse.sightings
or
http://groups.google.com/groups?q=%22e-bla.%2Bcom%22+group%3A*abuse.sightings
and note that news.admin.net-abuse.sightings consists of copies
of spam.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 2 May 2003 20:34:28 -0600 (MDT)

> From: Barry Shein <[email-masked]>

> ...

Plus content labeling.

> ...

It's as well intentioned as TrustE's other effort.  

Their whitepaper got me thinking about content labelling.  Perhaps I
now understand why it sounds wrong to me.  Let's assume that all mail
were properly labelled as "transaction," "advertising," "non-profit,"
"political," "personal and confidential" and any other categories you
like.  Never mind how you prevent lies or whether a message saying
something like the following is transactional or adveritising: 
    "The gift certificate your aunt sent you will expire in one
    week.  The following 100 KBytes of ads are about books you
    might buy if you add some money to the gift certificate...."

The problem is what would you do with content labels?  Would you
really set your MTA or MUA to accept
   - transactions but not ads from Amazon,
   - transactions as well as ads from Powells,
   - political mail from the Greens, Socialist Workers, and Republicans
      but not the Democrats or Libertarians
   - personal mail from your mother-in-law but not your children,
   - non-profit mail from the NRA but not the ACLU,
and so on for the hundreds of senders that might send you something in
the next 12 months?  

At first you might configure things to accept everything except ads
from everyone and everything including ads from a few senders.  After
the third "non-profit" message from your local PBS station selling
movie tickets and books as "fund raising" or "transactional" notice
from Amazon warning that a free offer is about to expire, you would
change that configuration.  You would accept mail from outfits you
trust to not send anything you don't want to see no matter category,
reject all mail from spammers like your local PBS station, and start
building white- and blacklists for the rest.  You would care about
the sender but not the content labels.

That's why something like the Habeas mark makes more sense.  You don't
care whether a message is "transactional" or "political."  You only
care whether you can trust the sender to send only mail you want,
and non-bulk or solicited bulk mail is close enough to that.