Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: Danny Angus <[email-masked]>
Date: Wed, 1 Jun 2005 09:12:19 +0100

> My policy is to answer all of them

Whereas I never reply to any of them concluding, rather egotistically, that
it is their loss not mine.

d.
(Actually thats not 100% true. A close friend of mine implemented a
challenge-response filter for his mail before high-tailing it to Mexico, I
responded to his one because he's a nice guy.)

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 1 Jun 2005 13:53:24 -0000

>it is their loss not mine.

My goal here is to minimize annoyance -- once you answer someone's
challenge, his challengebot shuts up.  If you don't, every time he
gets another forged spam with your address in it, you get another
challenge.

[ insert standard info on abusiveness and futility of C/R ]

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: der Mouse <[email-masked]>
Date: Wed, 1 Jun 2005 14:19:59 -0400 (EDT)

>>> My policy is to answer all [C/R challenges]
>> Whereas I never reply to any of them concluding, rather
>> egotistically, that it is their loss not mine.

I "minimize annoyance" by simply blocking chronic offenders outright.
(Strictly, this doesn't quite minimize annoyance; I accept slightly
increased annoyance potential in the hope of actually fixing the
problem.  But anyone who continues after three or four complaints to
the site's postmaster, or which challenges postmaster mail, gets
blocked entirely.)

> [ insert standard info on abusiveness and futility of C/R ]

Exactly.  I'm willing to deal with a little annoyance in the hope of
getting the actual problem - the futile abusive behaviour - stopped.

But not more than a little.  It doesn't take too many challenges
without action before the blocks go up.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Jim Witte <[email-masked]>
Date: Wed, 1 Jun 2005 20:16:30 -0500

> gets another forged spam with your address in it, you get another

(I'm switching the second-person 'you' in the quoted text to first- 
person here..)

   But doesn't this mean that if my email does get on a spam-list  
somewhere, and other people have challengebots, then I'll potentially  
be getting *lots* of challenges.  In which case, the 'challenge'  
email (initiated by the forged spam with my From address) becomes a  
form of spam in itself.  So I either 1) ignore ALL challenges, 2)  
answer them all, or 3) need some kind of filter to figure out which  
ones are from legitimate people as opposed to spam-bots.

   Situation 3 is just what we have now, except it's harder because  
there's less information in a challenge on which to decide whether  
it's legit.  In situation 1, challenges become useless (for anyone).   
In situation 2, challenges also becomes useless.

   So unless there's a hole in my logic here (there probably is), if  
C/R systems are widely used, the will become useless, unless some way  
of keeping forged email from being sent is found - which is one of  
the big problems with spam..

Jim <back to lurk-dom>

"KILL THE BOTS!!"

---

From: John Levine <[email-masked]>
Date: 2 Jun 2005 02:13:05 -0000

> [ insert standard info on abusiveness and futility of C/R ]

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I shook hands with Senators Dole and Inouye," said Tom, disarmingly.

---

From: der Mouse <[email-masked]>
Date: Wed, 1 Jun 2005 23:45:40 -0400 (EDT)

> But doesn't this mean that [in certain circumstances] the 'challenge'
> email [...] becomes a form of spam in itself[?]

Yes.

Now if only all the people who run naive C/R systems (and even far too
many of the not-quite-so-naive C/R systems) were to realize that....

> So I either 1) ignore ALL challenges, 2) answer them all, or 3) need
> some kind of filter to figure out which ones are from legitimate
> people as opposed to spam-bots.

Or (4) treat them as you would spam: complain about them, and block
repeat (or otherwise egregious) offenders.  That's generally what I do,
when I can't easily identify a message that provoked the challenge.
When I can, I usually tune the complaint a bit.  There was even once
when I jumped through the challenge's hoop - special circumstances.

> So unless there's a hole in my logic here (there probably is), if C/R
> systems are widely used, the will become useless,

Bingo.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 3 Jun 2005 02:31:26 +0200

> many of the not-quite-so-naive C/R systems) were to realize that....

Lets design an easy C/R system that all MUAs can automatically send
challenges and replys for without user interaction with a special MIME
type that can easily be identified (and filtered).
This will change the behaviour of spammers to use real addresses and use
their zombie armies to accept challeges and respond to them thus making them
easier to control find and it also shows that C/R systems only "work" because
so few people use it.

    \Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"