Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Fri, 10 Jun 2005 21:51:49 -0500

> So of course, this CAPTCHA-based system has all the other flaws of 
> C-R systems. In particular, there's the killer problem that spam 
> can be made to look like challenges, at which point the entire 
> system falls apart because spam filters begin to delete most 
> challenges, and very few people will load images, click links or 
> otherwise respond to the few that make it to an inbox.

> mathew

This is a readily addressable issue.  I previously stated that an email service provider could maintain a list of outgoing emails sent by each user.  Incoming challenges could then be filtered out if they did not correspond to the outgoing email.

A previous objection to the feasibility of this filter was: "High-speed updates are the hardest part of a database system, and this is a worst case scenario because the info for a message needs to be
available as soon as the message has been sent."

This can be addressed by holding all incoming challenges and preventing them from reaching the user's inbox for 10 minutes (or whatever length of time). The challenge is passed to the user's inbox once it is clear that the database in up-to-date.

These challenges will be relatively infrequent for the vast majority of people and a slight delay in receiving them should be very tolerable.

Spammers obviously can't send spam masquerading as a challenge with the aforementioned system.

Michael Kaplan

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Fri, 10 Jun 2005 22:54:05 -0500

>This is a readily addressable issue.  I previously stated that an email service provider could maintain a list of outgoing emails sent by each user.  Incoming challenges could then be filtered out i…
If it was that simple to match up received e-mail to sent e-mail, 
everyone would be doing it already as a whitelisting mechanism. 
Unfortunately, there are things like mailing lists, aliases, people who 
use multiple e-mail service providers, and so on.

mathew

---

From: John Levine <[email-masked]>
Date: 11 Jun 2005 06:15:49 -0000

>A previous objection to the feasibility of this filter was:
>"High-speed updates are the hardest part of a database system, and
>this is a worst case scenario because the info for a message needs to
>be available as soon as the message has been sent."

Right.

>This can be addressed by holding all incoming challenges and
>preventing them from reaching the user's inbox for 10 minutes (or
>whatever length of time). The challenge is passed to the user's inbox
>once it is clear that the database in up-to-date.

Even assuming this synchronization is practical (in a large system
with many MTAs, it probably isn't) this makes no sense whatsoever.  

If the MTA can tell what incoming mail is a challenge, and it knows
what's in the database (it must, if it knows when all of the updates
have been posted), why is it delivering the challenge to the user at
all rather than just answering it?

But the more important question is why bother to create the expensive
giant database and the complex synchronization and the special purpose
challenges when remotely verifiable message signatures a la DK solve
the problem much better, with no database and no challenges.

R's,
John

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 11 Jun 2005 10:58:12 +0200

> all rather than just answering it?

It can't, because the challenge contains a CAPTCHA, so only the user can
answer it correctly (at least if the CAPTCHA works as intended).

> the problem much better, with no database and no challenges.

Do they? I think DK, bounce-verification systems and C/R systems solve
different problems. 

DK (and similar systems) answers the question "was this mail sent by
somebody authorized to use this domain".

The question "was this bounce triggered by by a mail sent by one of our
users or by a mail with a faked return-path?" can be answered by DK-like
schemes only if the bounce contains the information needed to verify the
signature. For DK in particular, this is often not true, because it
signs the body (which is a good thing, IMHO) and the body is often
omitted or trunkated in bounces (which is also a good thing, IMHO). So
to verify if a bounce was triggered by a legitimate mail you need to
include something in your mails which is typically included intact in a
bounce. About the only thing which is guarantueed to work is the
envelope sender. 

Finally, C/R systems answer the question "was this mail sent by somebody
who cares enough about the mail to answer my challenge?" which is a
stronger version of question 1.

	hp

-- 
   _  | Peter J. Holzer    | Ich sehe nun ein, dass Computer wenig
|_|_) | Sysadmin WSR       | geeignet sind, um sich was zu merken.
| |   | [email-masked]         |
__/   | http://www.hjp.at/ |	-- Holger Lembke in dan-am
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Sat, 11 Jun 2005 05:02:12 -0400 (EDT)

> Finally, C/R systems answer the question "was this mail sent by
> somebody who cares enough about the mail to answer my challenge?"
> which is a stronger version of question 1.

That's not what C/R systems answer.

C/R systems answer "has the entity who apparently sent this mail gotten
my challenge and answered it?".

This differs from your phrasing in three important ways: (1) the
distinction between the entity which sent the mail and the entity which
apparently sent the mail; (2) the assumption, or lack thereof, that
challenge-answering, when it occurs, is based on a level of caring
about the mail getting through (as opposed to, say, a desire to throw a
monkey-wrench into the C/R system - I've heard from people who
deliberately answer challenges resulting from mail they didn't send, to
do that); and (3) the realization that a failure to answer may be
because the challenge was not delivered, because its recipient is
unable to answer it (eg, a blind man I know getting a vision-based
challenge), or the answer didn't make it back.

(1) is relevant in any network carrying a lot of forgeries.

(2) is relevant to any scheme that assumes everyone, including those
whose identity is forged into messages, will cooperate in making the
system work as it is designed to.

(3) is relevant to...well, pretty much anything even vaguely C/Rish.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: John Levine <[email-masked]>
Date: 11 Jun 2005 11:24:36 -0000

>answer it correctly (at least if the CAPTCHA works as intended).

Oh, right, it's a CAPTCHA.  That ensures that you'll never get any
transactional mail, while spammers can route it directly to the web
site that says (in Hindi or Tagalog) "solve this to see free porn."

Thanks for clarifying.

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 11 Jun 2005 18:56:28 +0200

der Mouse wrote:

> I've heard from people who deliberately answer challenges
> resulting from mail they didn't send

Yes, I solved several hundreds of the UOL puzzles, before
submitting to spamcop.  The only system allowing to report
spam directly was IIRC "mail blocks" - now a part of AOL.

Based on an SPF PASS (or whatever, but not a FAIL) I've no
problem with answering challenges about _my_ mail.  But if
it's spam I try to hurt them as badly as I can manage.

> eg, a blind man I know getting a vision-based challenge

It sounds stupid, but most systems are really that FUBAR.

With one of these systems I needed sometimes ten attempts
to "confirm" the spam.  But I was patient, after all the
criminals _sell_ their "system".  It was coupled with an
MLM scheme.  "Abuse" doesn't cover it, I mean "criminal".
  
                             Bye, Frank

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 11 Jun 2005 20:01:13 +0200

> site that says (in Hindi or Tagalog) "solve this to see free porn."

You're welcome ;-)

	hp

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 11 Jun 2005 20:40:14 +0200

> my challenge and answered it?".

"... and did I receive the answer?" Yes. Obviously. I should have
phrased that differently: C/R systems are designed to answer the
question ...
They fall a bit short of their design goal.

> apparently sent the mail;

I thought about mentioning this explicitely, but didn't: Somebody who
forges the sender address is obviously not interested in getting DSNs or
challenges.

> (2) the assumption, or lack thereof, that challenge-answering, when it
> occurs, is based on a level of caring about the mail getting through
> (as opposed to, say, a desire to throw a monkey-wrench into the C/R
> system - I've heard from people who deliberately answer challenges
> resulting from mail they didn't send, to do that); and

While I don't doubt that there are people who do that I doubt that there
are enough of them to matter.

> (3) the realization that a failure to answer may be

There are two subproblems here:

1) The challenge or the response may be lost in transit. True and mostly
   beyond the influence of the sender. This is where the implementations
   fall short of the design goal.

2) The ability to answer the challenge. This is mostly a question of
   effort. A blind man can ask a seeing person for help, if he thinks
   the message was worth the effort. If I receive a challenge in Tagalog
   I can hire a translator to translate it (and presumably also my
   answer). But that would have to be an exceptionally important
   message (and I probably wouldn't have sent it by mail in the first
   place). So the degree of caring necessary to answer the challenge
   will vary wildly between different senders, not only because of
   different abilities, but also because of different levels of
   aversion against C/R systems. But the phrase "cares enough to answer"
   covers that. (Of course that may mean that the design goal wasn't a
   particularly useful one in the first place)

   	hp