Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: mathew <[email-masked]>
Date: Fri, 10 Jun 2005 13:32:45 -0500

John Levine wrote:

>CAPTCHA's of any form have two other killer flaws.  One is that in the
>absence of widespread strong user authentication, which doesn't seem
>any closer now than it's been for the past decade, spammers can avoid
>your challenge by spoofing mail from someone on your whitelist.  The
>other is that significant numbers of people, through bafflement or
>exasperation, decline to respond to challenges so unless you never get
>mail from people you don't know (in which case a whitelist is all you
>need) CAPTCHAs will always lose real mail.
>

That's not really a CAPTCHA problem, it's more a problem with 
challenge-response systems in general. The CAPTCHA is just a bolt-on to 
make the C-R system less easy to spoof responses to.

So of course, this CAPTCHA-based system has all the other flaws of C-R 
systems. In particular, there's the killer problem that spam can be made 
to look like challenges, at which point the entire system falls apart 
because spam filters begin to delete most challenges, and very few 
people will load images, click links or otherwise respond to the few 
that make it to an inbox.

In fact, I wish one of the spam gangs would start their next major 
campaign by crafting their spam to look like challenges from common C-R 
systems. That way we could get rid of the endless supply of people 
proposing C-R as the solution to spam, and move on to something more 
productive.

mathew

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Danny Angus <[email-masked]>
Date: Mon, 13 Jun 2005 09:11:25 +0100

Michael,

> ... maintain a list of outgoing emails sent by each user ...

... some stuff snipped ...

> the info for a message needs to be
> available as soon as the message has been sent

... more snipping ...

> can be addressed by holding all incoming challenges
> and preventing them from reaching the user's inbox
> for 10 minutes (or whatever length of time).

This proposed "resolution" to the problem of C-R requiring a record and for
that record to be available straight away would be largely unacceptable to
any mail provider of any magnitude because of the cost of this recording
and buffering, not to mention the operating costs of a highly available
distributed system capable of reconciling the challenges with the
responses.

As I've pointed out to you before the problem of spam is the unacceptable
cost burden placed upon mail infrastructure providers, much more so that
than the inconvenience of individual users. You cannot solve the former if
your proposal has costs of a similar order of magnitude and the same set of
cost drivers, namely the volume of spam.

If the costs of managing genuine mail was high, but resource consumption
decreased because spam was removed from the picture then your solution
would be cost effective. However it still appears that the cost is directly
proportional to the volume of unwanted messages. Not only that but also you
are pushing some of the cost burden onto downstream systems, if a challenge
issued by your system increases costs for other people, people for whom
there is no benefit, it is doomed to failure.

Imagine that I am Yahoo and you are Joe ISP with 1000 mail accounts, how
can you possibly hope to accomodate the unpredictable number of challenges
I send you in response to forged mail? You can't. You are faced with high
running costs and potential DoS to you users, and the financial
consequences to your stock, caused by my legitimate use of your system as
designed.

I'm concerned that you seem hell bent on flogging a dead horse here.

A number of people have raised detailed weaknesses with your proposal.
You seem to prefer to address these in isolation rather than view the big
picture.

You seem to be making the fatal mistake of going round in circles.

d.

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************

---

From: Danny Angus <[email-masked]>
Date: Tue, 14 Jun 2005 10:13:03 +0100

Michael,

> Other email providers can briefly buffer incoming challenges
> if need be to update their bounce filter.
> I still have trouble seeing how this is a real difficulty,
> especially relative to Bayesian filtering.

I never said it would be difficult, I said it would represent a cost. Big
difference.

> Would you tell AOL, Hotmail, Yahoo, and every other major email provider
.. they should not use it

No. But I think they will tell you they can't afford to use it.
Unless you can show them how little it will cost or how much it will save.
ISP's don't care primarily about spam, they primarily care about profit.
To achieve their profit they have to be operationally efficient, and please
their customers.
Fighting spam is about both of those latter two, but any anti-spam system
you invent will have to satisfy the first one first.

> I disagree that a number of people have raised
> detailed weaknesses with my proposal that
>have gone unanswered.

I didn't say that either! I said that you seem to be addressing some of the
points in isolation, and re-introducing old issues in "solving" others.

> Well it goes on and on.  I was going to ignore the last round of posts

If you don't want people to examine and comment on your proposal I suggest
you don't keep bringing it up on this list, mate!

d.