Subject: Re: forged bounces, was [Asrg] A CAPTCHA that automatically

From: "Michael Kaplan" <[email-masked]>
Date: Thu, 02 Jun 2005 23:33:34 -0500

> Do we really have to figure out yet again why an automated C/R system
> is inferior in every way to a signature system like Domainkeys?

I'm not defending C/R systems as I believe they are not feasible for widespread adoption.  The system I've been promoting has some slight overlap but is markedly different and superior to C/R.

> DK in effect sends the answer to the challenge along with the original
> message.  The recipient does the "challenge" by validating the message
> checksum and and checking the singature against the sender's published
> key.  It doesn't triple the mail traffic like C/R does,

Triple the mail traffic?  As I've previously described (and outline on my website) with the use of filtering we should expect no more than a 1-5% increase in traffic, depending on the efficacy of the filter.

>it doesn't
> require that senders remember all the mail they've sent to know which
> challenges are to real mail and which to forged,

This 'remembering' in invisible and effortless as far as the sender is concerned.

>and as a free added
> bonus, it works today with several hundred million DK signed messages
> being sent and delivered every day.

I support DK, but its existence doesn't mean we don't need to seriously pursue additional venues.

Michael G. Kaplan

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 4 Jun 2005 01:25:41 -0000

>I'm not defending C/R systems as I believe they are not feasible for widesp=
>read adoption.  The system I've been promoting has some slight overlap but =
>is markedly different and superior to C/R.

If you say so.  I try to use standard terminology, so anything that
sends back a "send us something to persuade us to deliver your mail"
is C/R.

>> it doesn't require that senders remember all the mail they've sent
>> to know which challenges are to real mail and which to forged,

>This 'remembering' in invisible and effortless as far as the sender

Um, smoke alert.  Maintaining a database of sent mail for even a
moderately high volume mail server is a seriously hard problem.
High-speed updates are the hardest part of a database system, and this
is a worst case scenario because the info for a message needs to be
available as soon as the message has been sent, since we can expect an
automated C/R system to fire back a challenge immediately.  The usual
way to deal with large volumes of updates is to batch them, but that
adds delays.  I suppose you could batch the database updates and delay
the outgoing mail until the batch runs, but now you have another
locking problem to know when to release the outgoing mail.

> seriously pursue additional venues.

I'd like to pursue other topics as well, but surely we can find some
with better prospects than this.

The topic I keep hoping people will pursue is reputation systems.  If
you believe that anything like SPF, DK, or Sender-ID is going to be
useful, you need some way to decide what to do with a message once you
know the domain it's from.

R's,
John