Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 05 Dec 2004 11:31:04 -0500

In that case this system is a real blessing since it would become instantly obvious that your friend's address book was being harvested by spammers and the problem can be rectified, and of course the compromised addresses would be instantly nullified.

Michael Kaplan

> 
> interesting solution.
> 
> But what is with this:
>   - a friend often send news with my and others mail-addresses in
>     the To:-header.
>   - she also have viruses in the past, that sends mails to all
>     addresses in her addressbook.
> 
> How can your system hide my address from spamers?
> 
> Regards, Reinhold
> 
> --
>                           Reinhold Jordan
> WWW: http://reinhold.bachrain.de         Mail: [email-masked]
> qmail-spam-protection with intelligent-greylisting, reverse-smtp...
> qmail.spamfilter.041129.017.tar.bz2 actual rejects 99.78% of spam!!
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 05 Dec 2004 13:10:16 -0500

> 
> > To my knowledge this system is unique.
> 
> It is almost identical to SpamKiss:
> 
> http://www.spamkiss.com/
> 
> and it shares the same problems.

I strongly disagree.  Spamkiss appears to be almost identical to www.Zoemail.com.  I already contrast my system with Zoemail.  With Spamkiss acquiring a new sub-address (or "token") is cumbersome.  It is also very easy to automate a bot to request new "tokens" from spamkiss.  My CAPTCHA is extraordinarily resistant to bots, and senders who do not use a proper sub-address are instantly sent the sub-address within a CAPTCHA (this is infinitely more convenient of course).

Michael G. Kaplan

---

From: Matt Schneider <[email-masked]>
Date: Sun, 5 Dec 2004 18:28:10 +0000 (GMT)

Hello, there is a standardized reply form out there for these sorts of 
things, but I couldn't find it right away.

Anyway, I see several problems with this:

- the sub-address doesn't add anything, it's no different than making up a 
new email address

- without using this system, you can already set up an autoresponder on old 
addresses to let people know where to find you

- I don't like that you're supposed to spam everyone you know and they're 
supposed to immediately drop everything and go change you in their address 
book (and this expects that grandmothers that are just getting the hang of 
their AOL will be able to figure this out or even understand what this all 
means).

- white listing is nothing new

- challenge/response is nothing new

- if you want to not burden your friends with an initial challenge.. 
instead of spamming them to change the email address they have for you 
(still a burden) then why not add everyone in your address book to the 
"already passed the challenge procedure" list ?

- CAPTCHA assumes everyone using this system speaks English.

- As soon as a spammer starts getting CAPTCHA responses, they will fire 
these off to a sweatshop in China or India to have them solved, then they 
will have live, valid e-mail address, with complete sub-address, that they 
can now sell to other spammers at a premium.

- Nobody's going to upgrade their own SMTP servers to process bounces from 
every anti-spam system out there.

So, this is just plain old challenge response, with a CAPTCHA (the actual 
mechanism of the CAPTCHA is irrelevant), with the added bonus of spamming 
all your friends on a regular basis and expecting them to perform extra 
work to keep up with your latest e-mail address.

Let's say I send out 2 inquiries to sales departments about buying 
something.  If one of them sent back this CAPTCHA thing, I probably 
wouldn't even bother jumping through all the hoops, I'd just go buy from 
the other place.  The moral of this story is, this system can't be used by 
anyone who places any sort of value on receiving email from non-spammers.

  - Matt

---

From: Matt Schneider <[email-masked]>
Date: Sun, 5 Dec 2004 22:25:40 +0000 (GMT)

At 04:04 PM 12/5/2004 -0500, Michael Kaplan wrote:

>I had imagined a scenario such as what would happen if AOL or some other 
>large provider made this system standard.  Spammers already have a large 
>bounce rate and they still spam, but what would happened if more than 95% 
>percent of the emails sent to AOL addresses started to bounce?  I suspect 
>that at this point there would be a financial incentive for spammers to 
>weed out the invalid addresses.  I have read articles how many big time 
>spammers already routinely weed out invalid addresses, but I am unable to 
>cite these articles off-hand.  I accept that for now I am only able to 
>make reasonable speculation concerning this point.

(no, most spammers don't really care if an address is valid or not, it's 
easier for them to just pump out more spam in the hopes of hitting more 
valid ones eventually).

Except AOL, Hotmail, Yahoo, etc, all have their own proprietary systems and 
the very idea of a sub-address would not go over very well on these 
systems.  Sub-address for matt@AOL?  How about matt.sub@AOL?  Already 
taken?  matt.sub1.sub2@AOL then?  Now try explaining this to their 
customers.  And start paying for the support calls.

Also these large systems have no incentive to handle bounces from some 
non-standard system in a certain special way.

So, anybody running their own mailserver can throw up all kinds of barriers 
to receiving mail from normal people, spammers, whatever.  Your system 
might work great for people that want to use it, they can go sign up for a 
"captchamail.com" account and use web based email there.

But, you can't expect large providers to adopt any sort of system like 
this.  Maybe 1% of the population would be savvy enough to understand 
it.  On the other hand, if everyone in the world started using SBL+CBL, 
that would stop over 90% of the spam to everyone, immediately, with no 
effort and very few false positives.

The point is, I personally don't want to create any extra effort for myself 
or for my friends in trying to get e-mail to me.  If a few spams slip 
through, great.  But it's not worth me or my friends jumping through a 
bunch of extra hoops to avoid it.

---

From: Danny Angus <[email-masked]>
Date: Mon, 6 Dec 2004 09:31:10 +0000

I may have misinterpreted it but your proposal looks like a refinement of
many others, in that it combines authorisation, captcha, and whitelists,
with the exception being the variable address and address mapping element.

My issues on this would be
 1 -  actually administering a medium to large mail domain requiring each
account to have a very large or bounded infinite set of  potentiel "user"
parts for each address would be a headache or require new technology

2 - someone somewhere will need to pay for the extra capacity required to
handle all the extra traffic this system would generate

3 - it is not clear how this solution avoids address harvesting, if
spammers have abandoned harvesting from SMTP because simpler more effective
means are available they can return to it if tak up of your system made
that necessary and effective.

Also the investement in upgrading MUA's would be extreme, making it
unlikely to hapen quickly and therfore we'd see a lot of manual
intervention required by users, and a lot of extra traffic caused by
bounces being a fundamental requirement. In other words for every spam mail
sucessfully identified by your system your proposal generates another
message.
This violates "Danny's principle" in which I reckon that; In any messaging
system any component dealing with unwanted messages should, when operating
sucessully, create conditions in which no other parts of the system
experience an increase in resource consumption as a direct consequence, and
should tend to reduce consumption in some components as a consequence of
removing unwanted messages.

d.

|---------+---------------------------->
|         |           "Michael Kaplan" |
|         |           <mkaplansolution@|
|         |           lycos.com>       |
|         |           Sent by:         |
|         |           asrg-bounces@ietf|
|         |           .org             |
|         |                            |
|         |                            |
|         |           05/12/2004 03:31 |
|         |           PM               |
|         |                            |
|---------+---------------------------->
  >-------------------------------------------------------------------------------------------------------------------------------|
  |                                                                                                                               |
  |       To:       [email-masked]                                                                                                 |
  |       cc:                                                                                                                     |
  |       Subject:  [Asrg] Please critique my anti-spam system                                                                    |
  >-------------------------------------------------------------------------------------------------------------------------------|

I have developed a system to eliminate spam.  You are the first group
to whom I have publicly presented it to so I would appreciate any
criticism you might have, and after that any support.  To my
knowledge this system is unique.  A colloquial description of my
method is detail at the following link:

http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

Sincerely,

Michael G. Kaplan
New York, New York

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************