Subject: Re: [Asrg] SMTP AUTH

From: [email-masked]
Date: Wed, 8 Dec 2004 02:37:25 +0000 (GMT)

>> Well, if we keep working to make SMTP mail unusable by more people, more
> people
> might be FORCED into using Web mail, more often.  I don't think that's a
> very
> bright thing to do, in part because Web mail (just as accessing ANY Web
> sites)
> comes with its OWN whole new set of risks and dangers (malicious
> scripting,
> ActiveX, decryption of obscured content, text-as-image, cookies, etc etc),
> which
> if anything are MORE difficult to deal with and secure than SMTP mail is.

> Let me refresh ur memory that even MUAs can display HTML and hence we face
more or less the same problem in MUAs too.

Yes, although at least when we're dealing with (let's agree that we're talking 
mostly about POP3 here) E-mail, we can easily enough filter the message before 
the MUA gets it to block certain forms of potentially malicious (or at least 
"very dubious") HTML content, and we can do that with the knowledge of who (at 
least we believe that) the E-mail in question is coming from.  That makes the 
problem easier than handling the same things when they are coming into a Web 
browser, which probably doesn't give us a good intercept point and in any case 
doesn't provide any standardized way for us to determine who sent the E-mail (or 
whatever) that's on the Web page being viewed.

As I've said, Web-based stuff is a different (and harder) problem that we'll 
have to deal with eventually, but at the moment that's mostly just a diversion 
and distraction from what we need to deal with HERE.

> The idea is to send mail with
authentication and if a secured webmail does that one should prefer that
rather than banging their head against the wall just because we need
SMTP/POP to do the job which is done better by some other thing. 

Authentication proves NOTHING regarding legitimacy because a zombie spambot can 
trivially send what it sends using the authentication belonging to the hijacked 
system.

Authentication is also at least VERY problematical in cases like airport or 
cruise ship Internet access terminals/kiosks, where people need to use their OWN 
E-mail addresses but have absolutely **NO** control over which SMTP E-mail 
server will be used by the kiosk software.

> We should remember that our goal is to stop spam by whatever means possible,
protocol is just a medium.

Authentication does **NOTHING** to "stopping spam".  It only adds a few, 
relatively minor, restrictions on the technologies that spammers (and worms and 
viruses) use.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 8 Dec 2004 04:13:54 -0000

>> Well, if we keep working to make SMTP mail unusable by more people,
>> more people might be FORCED into using Web mail, more often.  I
>> don't think that's a very bright thing to do, in part because Web
>> mail (just as accessing ANY Web sites)

I realize what's wrong with this argument.  In the early days of
cybercafes and Internet access at places like airports, the cafe or
airport always provided a computer since the computers of the time
were large enough and expensive enough that few people lugged their
own computers around.  Furthermore, getting your computer hooked into
someone else's network was a pain and usually involved some black art
manual configuration.

But now, everyone brings his own computer.  Laptops are cheap, and for
the most part network connections are self-configuring.  Around here,
one of the ISPs has lots of public hotspots, all of which are no more
than a WiFi access point.

This makes the port 25 issue much less important, since if you have
your own computer, you have a lot of reasonable options.  You can send
mail using port 587.  You can tunnel back to your home network and use
port 25 through the tunnel.  (That's what I do, using ssh to provide
the tunnel.)

How many people really send mail from public places using someone else's
computer?  Not many that I've seen.

-- 
John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711
[email-masked], Mayor, http://johnlevine.com, 
Member, Provisional board, Coalition Against Unsolicited Commercial E-mail

---

From: "Mark Wilson" <[email-masked]>
Date: Tue, 7 Dec 2004 21:33:15 -0800

>>computer?  Not many that I've seen.

In my travels to Europe and Russia I've discovered the internet cafes are
HUGELY popular and everyone is sending email from public places using public
computers.  I would say the amount of people in the world doing that is
quite large.

Mark
[email-masked]

---

From: [email-masked]
Date: Wed, 8 Dec 2004 06:27:27 +0000 (GMT)

>than a WiFi access point.

While that's true for some folks, it is CLEARLY not universally true.  

First of all, it is categorically **NOT** true that "everyone brings his own 
computer".  Public libraries, schools, cruise ships, and many other public 
access points use kiosks or regular PCs to provide public Internet access.

There ARE nowadays SOME cruise ships which ALSO offer "hot spots" for those who 
do bring along their portable computers, but I'm not aware of ANY cruise ships 
which presume that ALL passengers will bring their computer along... EVERY 
passenger ship I'm aware of which offers public Internet access also supplies 
the computers (at least as an alternative) for that purpose.

>port 25 through the tunnel.  (That's what I do, using ssh to provide

And this whole thing is TYPICAL of those who try to DENY that there is a problem 
with this whole stupid SPF nonsense... by simple denial.  "Oh, that doesn't 
matter... I have my own computer, and the places I go offer hotspots, so you can 
send mail other than through the publicly provided mail server."  Fine for such 
people, but that is BY NO MEANS universal.  

>computer?  Not many that I've seen.

I suggest that you open your eyes a little bit.

For starters, go to your nearest public library and tell me that they don't have 
normal PCs there for their public Internet access.  Try to find a cruise ship 
(that DOES offer public Internet access onboard) that doesn't have PCs onboard 
for the passengers to use for sending their E-mail.  

I guess some people figure that the users that don't cart around their own 
computers everywhere somehow just don't matter, or something.  

But that's part of why their approaches to solving this problem tend to be SO 
incredibly misguided and wrong-headed, too.  They simply prefer to ignore those 
people whose needs and requirements aren't the same as THEIRS are.

---

From: Bill Cole <[email-masked]>
Date: Wed, 8 Dec 2004 08:06:20 -0500

>computers.  I would say the amount of people in the world doing that is

Wrong metric. There are a lot of very popular behaviors that should 
be discouraged whenever possible, NOT accommodated and lubricated. A 
sizable fraction of mail users will open any attachment they get, so 
the approach of making the popular act slick brought us mailers that 
auto-open attachments.

Using the Internet from a public access Windows machine that is 
administered with an eye to keeping costs down is unsound, unsafe 
behavior. It might be acceptable if all of those machines were 
managed by a skilled team of professionals and/or were running 
systems designed to shield themselves and their overall user 
population from the recklessness of one user, but that's generally 
not so.

Breaking that sort of behavior in a consistent standard way would be 
a very good thing.

-- 
Bill Cole
[email-masked]