Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Mon, 13 Jun 2005 12:02:41 -0500

> Michael,
> 
> > ... maintain a list of outgoing emails sent by each user ...
> 
> ... some stuff snipped ...
> 
> > the info for a message needs to be
> > available as soon as the message has been sent
> 
> ... more snipping ...
> 
> > can be addressed by holding all incoming challenges
> > and preventing them from reaching the user's inbox
> > for 10 minutes (or whatever length of time).
> 
> 
> This proposed "resolution" to the problem of C-R requiring a record and for
> that record to be available straight away would be largely unacceptable to
> any mail provider of any magnitude because of the cost of this recording
> and buffering, not to mention the operating costs of a highly available
> distributed system capable of reconciling the challenges with the
> responses.
> 
> As I've pointed out to you before the problem of spam is the unacceptable
> cost burden placed upon mail infrastructure providers, much more so that
> than the inconvenience of individual users. You cannot solve the former if
> your proposal has costs of a similar order of magnitude and the same set of
> cost drivers, namely the volume of spam.
> 
> If the costs of managing genuine mail was high, but resource consumption
> decreased because spam was removed from the picture then your solution
> would be cost effective. However it still appears that the cost is directly
> proportional to the volume of unwanted messages. Not only that but also you
> are pushing some of the cost burden onto downstream systems, if a challenge
> issued by your system increases costs for other people, people for whom
> there is no benefit, it is doomed to failure.
> 
> Imagine that I am Yahoo and you are Joe ISP with 1000 mail accounts, how
> can you possibly hope to accomodate the unpredictable number of challenges
> I send you in response to forged mail? You can't. You are faced with high
> running costs and potential DoS to you users, and the financial
> consequences to your stock, caused by my legitimate use of your system as
> designed.
> 
> I'm concerned that you seem hell bent on flogging a dead horse here.
> 
> A number of people have raised detailed weaknesses with your proposal.
> You seem to prefer to address these in isolation rather than view the big
> picture.
> 
> You seem to be making the fatal mistake of going round in circles.
> 
> d.

Thanks for the feedback,

I will say that I am surprised that so many on this list are perseverating over the issue of erroneous challenges.  I suspect that some of the people on this list, as opposed to the general public, have very high profile email addresses and it is possible that you have been selectively targeted by spammers given your role in the anti-spam community.  Some have described responding to hundreds of erroneous challenges.  I personally have never received a single erroneous challenge and I suspect (but I don't have data) that most email users have not either.

I also disagree with the burden that my system will cause to networks.  On average email providers will receive a 1000:1 ratio of spam to challenge email if 99% of spam is filtered before a challenge is sent, and if 10% of spam uses a forged address.  The cost of buffering the challenges will likely be trivial relative to the cost of dealing with routine spam.

Many email providers, such as Yahoo and Gmail, routinely keep a copy of every outgoing email in your sent message folder.  Thus the data for the challenge filter is instaneously available.  A trivial software update can prevent any erroneous bounces from ever becoming visible in a user's inbox.  Other email providers can briefly buffer incoming challenges if need be to update their bounce filter.  I still have trouble seeing how this is a real difficulty, especially relative to Bayesian filtering.

I will concede that when the system is initially introduced there will be specific individuals and specific small ISP that will be transiently disproportionately impacted until they upgrade their software.  Ultimately not a single person should ever receive an erroneous bounce.

Would you tell AOL, Hotmail, Yahoo, and every other major email provider that there is a convenient system that would result in the near total elimination of spam for their users but they should not use it because it would result in an average 0.1% increase in spam-like email sent to ISPs that haven't upgraded? Yes, some will be affected disproportionately.

I disagree that a number of people have raised detailed weaknesses with my proposal that have gone unanswered.  Rather what I do is respond to a legitimate query once or twice and then I stop responding when the issue is repeatedly brought up.  Examples include:

     The porn proxy attack-  I've had to respond to the practical impossibility of this form of attack on two different locations on my website, as well as repeatedly on this list.  Please, think about it yourself.  Crunch the numbers.  It is beyond trivial.

     Spammers will just pretend to be someone on your whitelist- This is again confusing my system with a C/R system, as my system relies on sub-addresses.  The whitelist as I describe it is of a very personal nature and spammers cannot determine it's contents.  If spammer's did determine one or two addresses that were on the whitelist then you would just remove those addresses from the whitelist and have those correspondents rely on using a sub-address as everyone else does.

     Malware will foil this system- As I've described here and on my website the existence of malware is an argument for my system as my system is uniquely resistant to it.

     I would never bother responding to challenge- If you cared about the email then you would.  I think what is trying to be said is that routinely answering challenges is too burdensome.   My system would likely only issue challenges with no more than 5% of the frequency that a C/R would.  I suspect that the vast majority of people would find this acceptable if they could live without spam.

Well it goes on and on.  I was going to ignore the last round of posts as they did not contain any criticisms that I had not answered.  I'm only responding now because I was addressed directly.  I only re-initiated corresponding on this list to describe an innovation for web-page based CAPTCHA, but we took a quick tangent away from that topic.

I will respond to any criticism that I have not answered.  I appreciate it when people point out flaws in the answers I've given, but I'll need more convincing before I concede that the difficulties in enacting a challenge filter are so great that a system that would otherwise eliminate spam should not be considered.

Thank you,
Michael Kaplan
http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Mon, 13 Jun 2005 13:40:11 -0400 (EDT)

> I also disagree with the burden that my system will cause to networks.  On average email providers will receive a 1000:1 ratio of spam to challenge email if 99% of spam is filtered before a challen…

Please stop using one-long-line-per-paragraph.  If you can't even
follow rudimentary mailing list etiquette, why should we pay attention
to your opinions on any other email matter?

> I also disagree with the burden that my system will cause to
> networks.

Have you run - or even worked at - a large (or even small!) email
provider?  I don't recall your saying anything to indicate that you
have; until you have, I think you should, maybe, just maybe, listen to
the people who have - who seem to be unanimous in the opinion that the
difficulties will be excessive.

> On average email providers will receive a 1000:1 ratio of spam to
> challenge email if 99% of spam is filtered before a challenge is
> sent, and if 10% of spam uses a forged address.

(1) What is your basis for choosing those numbers?  Personally, it
    seems to me that more probable numbers would be 75% and 99+%.

(2) Even if so, this makes your position "but my spam is OK because
    it's such a small fraction of the total spam", as far as I can
    tell.  That's certainly not acceptable to _me_, at least.

> The cost of buffering the challenges will likely be trivial relative
> to the cost of dealing with routine spam.

Possibly.  Possibly not, too.  Do you have implementation experience to
back your opinion up?

> Many email providers, such as Yahoo and Gmail, routinely keep a copy
> of every outgoing email in your sent message folder.  Thus the data
> for the challenge filter is instaneously available.  A trivial
> software update can prevent any erroneous bounces from ever becoming
> visible in a user's inbox.  Other email providers can briefly buffer
> incoming challenges if need be to update their bounce filter.  I
> still have trouble seeing how this is a real difficulty, especially
> relative to Bayesian filtering.

Maybe that's because you've never done it.  Go on, implement it.  Run
it at an ESP with at least two widely separated mailhosts.  Heck, run
it at even an ESP with only one but at least a few thousand users.

Maybe you're right that it's trivial to do this.  The opinion of people
who've actually worked with such systems seems to disagree with you.
Maybe you have something new that will cure this, but if so, you
certainly haven't convinced us.  Go on.  Demonstrate it.  Show us.

> I disagree that a number of people have raised detailed weaknesses
> with my proposal that have gone unanswered.  Rather what I do is
> respond to a legitimate query once or twice and then I stop
> responding when the issue is repeatedly brought up.  Examples
> include:

>      The porn proxy attack-  I've had to respond to the practical
>      impossibility of this form of attack on two different locations
>      on my website, as well as repeatedly on this list.  Please,
>      think about it yourself.  Crunch the numbers.  It is beyond
>      trivial.

I don't see why.  Do you perhaps mean "it would be beyond trivial if
most mail used this system"?

>      Spammers will just pretend to be someone on your whitelist-
>      [...]  The whitelist as I describe it is of a very personal
>      nature and spammers cannot determine it's contents.

Why not?  Why can't they scrape it with malware on the user's machine
the same way they scrape everything else in sight?

> I appreciate it when people point out flaws in the answers I've
> given, but I'll need more convincing before I concede that the
> difficulties in enacting a challenge filter are so great that a
> system that would otherwise eliminate spam should not be considered.

The difficulties of implementing it, such as demanding some kind of
saved information for every outgoing mail - you haven't answered this;
simply expressed your opinion that it is not a significant problem,
contrary to the opinions of those with direct experience in the area.
Given a choice between numerous informed opinions which agree and one
uninformed opinion which disagrees... :-/

Eliminate spam - it eliminates spam only for people "protected" by it.
It increases spam for everyone else.  That is an unacceptable tradeoff
for me - and apparently for numerous other people too.

Perhaps you're right and we're all wrong.  Go on - convince us.  Show
us an implementation that won't spam non-adopters.  That works fine
across multiple widely disparate mailhosts.  That works for the blind.
That isn't vulnerable to the free-pr0n proxy attack.

To put it bluntly: put up or shut up.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: John Levine <[email-masked]>
Date: 13 Jun 2005 19:33:19 -0000

> I will say that I am surprised that so many on this list are
> perseverating over the issue of erroneous challenges.

Perhaps that's because we have actual experience with the problem.  I
have a bazillion e-mail addresses, some of which are well known, and
some of which aren't, and I get lots of challenges to addresses that
aren't well known at all.

Since the vast majority of mail is spam, the vast majority of
challenges are responses to spam.  Please don't wave your hands and
say how wonderful spam filtering will make this problem go away.
Everyone has spam filtering now, and I'm still getting a hundred spam
challenges to random addresses for every real challenge.

I have to agree with Mouse here, we've pointed out a set of
significant problems based on a whole lot of experience running real
mail systems, any of which we believe dooms a C/R system.  So go prove
us wrong.  I look forward to the results of your experiments.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com