Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Wed, 01 Jun 2005 21:45:06 -0500

Jim Witte wrote:

But doesn't this mean that if my email does get on a spam-list somewhere, and other people have challengebots, then I'll potentially be getting *lots* of challenges.  In which case, the 'challenge' email (initiated by the forged spam with my From address) becomes a form of spam in itself.  So I either 1) ignore ALL challenges, 2) answer them all, or 3) need some kind of filter to figure out which ones are from legitimate people as opposed to spam-bots.

The answer to this problems is simple (and also outlined on my website - although it does not describe a C/R system there are some structural similarities).  First of all any email system that dispatches bounces should only do so after the email has been completely filtered.  This will automatically eliminate something like 99% of the spam induced bounces, depending of course on the strength of the filter.

The next step is to have a special bounce filter on the other end to stop innocent people from receiving spam induced bounces.  The filter would recognize an incoming bounce and only pass it on to the user's inbox if that user had recently sent an email to the source of the bounce.  Enacting this bounce filter would be a simple one-time software upgrade.  There really is almost no reason why a person should receive a bounce in response to spam sent with a forged address once bounce generating ant-spam systems become prevalent.

Michael Kaplan

--

_______________________________________________

NEW! Lycos Dating Search. The only place to search multiple dating sites at once.

http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 2 Jun 2005 05:27:11 -0000

> The next step is to have a special bounce filter on the other end to
> stop innocent people from receiving spam induced bounces. The filter
> would recognize an incoming bounce and only pass it on to the user's
> inbox if that user had recently sent an email to the source of the
> bounce.

You've almost reinvented BATV there.  It puts a signature hash in the
bounce address in outgoing mail, and rejects bounces that don't have
the hash.  I've used this for a while and it works very well.  Trying
to match bounce sources is hopeless; if you write to
[email-masked] you're likely to get responses from
[email-masked] or [email-masked], with no
consistency at all to the addresses.

But I don't see what this has to do with challenges, since they don't
look like bounces.  They're ordinary mail, sent in bulk and (for the
majority due to forgery) unsolicited, i.e. spam.

R's,
John