Subject: Re: forged bounces, was [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Thu, 02 Jun 2005 17:31:20 -0500

> > The next step is to have a special bounce filter on the other end to
> > stop innocent people from receiving spam induced bounces. The filter
> > would recognize an incoming bounce and only pass it on to the user's
> > inbox if that user had recently sent an email to the source of the
> > bounce.
> 
> You've almost reinvented BATV there.  It puts a signature hash in the
> bounce address in outgoing mail, and rejects bounces that don't have
> the hash.  I've used this for a while and it works very well.  Trying
> to match bounce sources is hopeless; if you write to
> [email-masked] you're likely to get responses from
> [email-masked] or [email-masked], with no
> consistency at all to the addresses.
> 
> But I don't see what this has to do with challenges, since they don't
> look like bounces.  They're ordinary mail, sent in bulk and (for the
> majority due to forgery) unsolicited, i.e. spam.

What I've been referring to as bounces may more appropriately be called challenges.  Anyway, what I have been saying is that the challenge (which currently looks like an ordinary email) be standardized so that they can be universally recognized as a challenge.  I am proposing a filter that could recognize this challenge email.  The challenge email would contain the email address of the relevant email account in an easily parsable form so that the filter can make sure that the challenge is being received by the user who had just sent out the corresponding email.

Maybe we can agree on this:
Current anti-spam systems that issue challenges do so in a way that results in innocent people being bombarded with spam triggered challenges.

However...
A relatively simple one-time software upgrade to existing filters can easily prevent a standardized challenge from erroneously reaching innocent email users.  Ergo widespread adoption of a challenge generating anti-spam system is practical - at least in regard to the above mentioned issue.

Michael Kaplan

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 3 Jun 2005 03:26:25 -0000

>What I've been referring to as bounces may more appropriately be
>called challenges.  Anyway, what I have been saying is that the
>challenge (which currently looks like an ordinary email) be
>standardized so that they can be universally recognized as a
>challenge.  I am proposing a filter that could recognize this
>challenge email. ...

Do we really have to figure out yet again why an automated C/R system
is inferior in every way to a signature system like Domainkeys?

DK in effect sends the answer to the challenge along with the original
message.  The recipient does the "challenge" by validating the message
checksum and and checking the singature against the sender's published
key.  It doesn't triple the mail traffic like C/R does, it doesn't
require that senders remember all the mail they've sent to know which
challenges are to real mail and which to forged, and as a free added
bonus, it works today with several hundred million DK signed messages
being sent and delivered every day.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: der Mouse <[email-masked]>
Date: Fri, 3 Jun 2005 00:19:42 -0400 (EDT)

> What I've been referring to as bounces may more appropriately be called challenges.  Anyway, what I have been saying is that the challenge (which currently looks like an ordinary email) be standard…

Could you *please* not use huge single-line paragraphs?

To re-linebreak this and pick out the relevant part,

> Anyway, what I have been saying is that the challenge (which
> currently looks like an ordinary email) be standardized so that they
> can be universally recognized as a challenge.

Good luck.  We have yet to get even anything close to universal
adoption of the *existing* standard for bounces (see RFC 3462 - I
regularly get annoyed by blowback bounces not correctly formatted and
which thus aren't recognized as bounces by my software[%]).  I can't
see any reason to think that C/R challenges would fare any better.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B