Subject: [Asrg] RE: TitanKey and "white lies"... (Faking SMTP hard errors "improves" C/R utility?)

From: "Peter Kay" <[email-masked]>
Date: Thu, 29 May 2003 09:42:14 -1000

You raise a really good point: do we break SMTP compliance by lying?  

We think that the fact that SMTP tells the truth is the heart of all the
spam problems in the first place.

Peter

> -----Original Message-----
> From: Bob Wyman [mailto:[email-masked]] 
> Sent: Thursday, May 29, 2003 9:35 AM
> To: Peter Kay
> Subject: FW: TitanKey and "white lies"... (Faking SMTP hard 
> errors "improves" C/R utility?)
> 
> 
> 
> 
> -----Original Message-----
> From: Bob Wyman [mailto:[email-masked]] 
> Sent: Thursday, May 29, 2003 3:19 PM
> To: 'Peter Kay'; [email-masked]'
> Subject: TitanKey and "white lies"... (Faking SMTP hard 
> errors "improves" C/R utility?)
> 
> 
> TitanKey (mentioned by Peter Kay, it's President in an 
> earlier mail concerning IPR) seems to be employing a slight 
> twist on the Challenge and Response process that is commonly 
> used by many others. (see:
> http://www.titankey.com/)
> 	While the process of generating challenges in response 
> to "unknown" senders is normal, TitanKey claims that they do 
> something unique in that in addition to the challenge mail, 
> they also respond to the original mail by issuing a permanent 
> "user unknown" SMTP error. They have filed at least one 
> patent application for this process.
> 	TitanKey claims that this tiny modification to normal 
> C/R procedure results in a "massive" improvement in the 
> utility of challenge and response systems since spamming 
> software won't be able to distinguish between real "user 
> unknown" errors and the fake ones issued by TitanKey. Since 
> spamming programs typically respond to a permanent SMTP error 
> by removing that email address from the list of active 
> emails, you shouldn't ever receive more than one email from 
> any one spammer... Given that the "reply-to" addresses used 
> by spammers are usually false, the spammer will never see the 
> challenge message which is sent after the SMTP error is 
> generated, thus, they can't do any analysis of the challenges 
> to determine which "user unknown" errors were "faked" and 
> which were real. 
> 	Whether or not this works, it is somewhat disquieting 
> to think that the "solution" to the problem is to have our 
> servers violate the SMTP protocol by sending false status 
> codes. (Note: This would seem to call into question the claim 
> on the TitanKey website that "The Titan Key follows all SMTP 
> standards.") On the other hand, if it works, it works...
> 	Should we add "prevaricating servers" as one of the 
> methods in the taxonomy of potential solutions? I can imagine 
> the marketing slogans
> now: "My server lies. Does yours?" Or, "Our server lies 
> better than yours does." "Honesty will get you nowhere..."
> 
> 		bob wyman
> 
> Note: You can find the TitanKey patent online at: 
> http://l2.espacenet.com/espacenet/viewer?PN=WO0116695&CY=ep&LG
=en&DB=EPD
Click on the link at "Requested Patent" to see the images.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Richard Rognlie <[email-masked]>
Date: Thu, 29 May 2003 15:52:38 -0400

> spam problems in the first place.

by "lying" you've now broken any existing application that relies on 
bounces for automated clean up.

Suddenly, anyone using your solution for mail sent from an email list
will be removed from that list the first time they get mailed and
you respond with the 550.  now they have to resubscribe again.  

lather.  rinse.  repeat.

-- 
 /  \__  | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/rrognlie/    <[email-masked]>
 /  \__/ | Today is the first day of the rest of your life.  Of course,
 \__/    |    so was yesterday, and look how you screwed *that* up...
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Bob Wyman" <[email-masked]>
Date: Thu, 29 May 2003 16:19:36 -0400

Richard Rognlie wrote: (re TitanKey)
> Suddenly, anyone using your solution for mail sent 
> from an email list will be removed from that list the 
> first time they get mailed and you respond with the 550.

	The TitanKey guys would probably say that when subscribing to a
mailing list you should provide one of their "Virtual Private Email
Addresses" which are basically single user email addresses (sender +
recipient are hashed to generate the "virtual" address). If a message is
received addressed to a valid "virtual" inbox, then a C/R sequence is
not initiated.
	These "Virtual Private Email Addresses" appear to be very much
the same method which I've discussed in a few earlier notes, is used in
TDMA, or is claimed in the Xircom patent that Intel now owns. (see:
USPTO 6,356,935).

		bob wyman