Subject: [Asrg] What is new about SAVE?

From: Hadmut Danisch <[email-masked]>
Date: Sat, 6 Aug 2005 17:40:34 +0200

Hi,

unfortunatley I didn't find the time to attend the IETF in 
Paris, not even to follow discussions in Jabber etc.

But I read in a german computer magazine's newsticker that a 
'brandnew' proposal was made by german University of Karlsruhe 
(newsticker says it "circulated", whatever this means), which is 
called "SAVE" (Spam Protection by Using Sender Address Verification
Extension). Slides at http://www.tm.uka.de/itm/publications.php?id=112

If I read the slides correctly, their idea is to increase the cost of
sending e-mails with mathematical puzzles, which is seen as acceptable
for a few e-mails, but not for mass e-mails. Mails from an unknown
(=not-yet-whitelisted) sender are put in a 'holdbox', and the
receiving MTA sends a challenge consisting of a puzzle back to the
sender. The sender then has to proof his sincerity by solving the
puzzle, either a mathematical one by automatically expending costly
computation time, or by solving a puzzle made for a human (an image
which you have to read numbers from, like on some web registration
forms). 

As far as I can see, this looks almost exactly like the e-mail stamp
proposal Bill Gates made on several conferences and several interviews
before Microsoft came up with CallerID/SenderID. They also proposed to
increase costs by challenging the sender with mathematical puzzles
with the assumption, that this is not a burden for regular e-mail but
a barrier for spammers. The only differences I can see are 

- If I remember well, Gates was talking about mathemtical puzzles
  only, not human-solvable ones. But I guess if such human-solvable 
  puzzles are made on a large scale base with standard software, it
  won't take long time until the software to automatically solve them
  will appear. 

- I've never seen precise specs about Gates' proposal, but I
  always thought that they immediately rejected messages with the
  challenge in SMTP. In contrast, SAVE proposes to first accept the
  message, then drop it in the hold box and send a separate mail with 
  the puzzle back to the sender, in order to challenge and sort of
  authenticate him/check existence of sender address. 

  That is a difference, however, it appears to be highly
  questionable. The authors themselves propose to give the recipient
  read access to the holdbox (of course, without explaining how
  recipients are to have access to the receiving MTA), just in case
  the recipient was waiting for an expected or important e-mail. So it
  puts the burden on the recipient to continuosly watch all that spam
  folder for important but still kept back e-mails. Requiring the
  recipient to manually walk through the complete spam folder
  regularly is not exactly what I consider an anti-spam-solution.

  Furthermore, this appears to be unlawful under german law. As you
  might have heard, a german higher court recently decided that even
  at a university it can be crime to suppress or delay someone else's 
  e-mails. Ironically, the SAVE proposal comes from the very same
  faculty of the very same university the court decision was about. So
  I am kind of surprised that they still come up with such a
  proposal. 

But beyond these two minor differences, SAVE looks pretty much like 
Gates' proposal. Can anyone give me a hint why this is said to be 
'brandnew' ? Has this been a talk in a IETF session?

regards
Hadmut

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 6 Aug 2005 21:54:03 -0000

>Extension). Slides at http://www.tm.uka.de/itm/publications.php?id=112

As we all know, anyone can show up at the IETF and talk about
anything, which is both part of its charm and part of why it can be so
frustrating.  SAVE looks to me like a combination of hashcash and
CAPTCHA, and I agree that combining two bad ideas doesn't make a good
idea.

At last year's CEAS I talked to Cynthia Dwork who invented
computational challenges in about 1992 and she agreed that zombie
armies make them useless.  Bill Gates got all excited about them when
MS hired her away from IBM.

But Hadmut, they're right there in Germany.  Why not give them a call
and ask if there's something else in their paper that we're missing?

R's,
John

---

From: Hadmut Danisch <[email-masked]>
Date: Sun, 7 Aug 2005 12:54:18 +0200

I just googled a little bit:

http://www.cnn.com/2004/TECH/internet/03/05/spam.charge.ap/
http://www.usatoday.com/money/industries/technology/2003-06-25-gates_x.htm
http://www.usatoday.com/tech/news/2003-06-29-gates-spamhow_x.htm
http://www.webmastervault.com/tip-pay-per-spam.shtml
http://www.windowsitpro.com/Article/ArticleID/41582/41582.html
http://www.internetweek.com/showArticle.jhtml?articleID=18201111

  Citation from that last URL: 
  For small companies, Microsoft proposes computer- and human-solvable
  puzzles that can be used to distinguish legitimate senders from
  spammers. If a computer user receives an e-mail from a sender not on
  a safe list, the recipient's PC would send out a puzzle that the
  sender or the sender's computer would have to solve. For someone
  sending just a few messages, the puzzles could be solved
  quickly. For a spammer sending thousands or millions of messages,
  the burden would be a disincentive. 

Two years ago Microsoft made exactly the same proposal (computer-
_and_ human-solvable puzzles) and widely announced that the problem
with spam would be gone within two years. 

Now, two years later, we all know that they failed. And a university
is now coming up with repeating the very same proposal? Strange...

BTW: Isn't it time to remind Microsoft to their 2003's promise to have
solved the Spam problem within two years?

regards
Hadmut

---

From: Dave Crocker <[email-masked]>
Date: Mon, 8 Aug 2005 07:16:28 -0700

>  called "SAVE" (Spam Protection by Using Sender Address Verification

1. I am reasonably certain that this was not presented at any IETF Paris 
session. There was only one session that related to spam, and that was our 
Mass/DKIM one and it certainly was not presented there.

2. I do not recall hearing any mention of this proposal during the week.  Any 
discussions about it must have been well-hidden.

3. As folks on this list know, anti-spam gets proposals at a regular rate.  
The mere existence of a proposal has ceased to be interesting.  Gaining 
support is the interesting part.  At that part it becomes work public 
discussion time, IMO.

  d/
  ---
  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 8 Aug 2005 19:16:01 +0200

On Mon, Aug 08, 2005 at 07:16:28AM -0700, Dave Crocker wrote:
> 2. I do not recall hearing any mention of this proposal during the
> week.  Any discussions about it must have been well-hidden.

I've asked the journalist to comment on your statements, and now she
clarified that 'circulated on the IETF in Paris' here means that the
proposal has been passed to "several people" with request to comment. 
She didn't say who these people are and whether and what they
commented. Apparently, just sending some private e-mails is all it
takes to get mentioned with full name and details under the headline
"IETF's new attempt against Spam". 

I also had asked the authors what's new with this proposal and how it
differs from the Microsoft proposal made about 2 years ago. One of the
authors explained the main three differences between 'SAVE' and
Microsoft's proposal: 

- The Microsoft approach ("Black Penny") would not support manual
  puzzles.

- Both sides would be required to use "Black Penny".

- It required an additional external Server. 

Beyond the fact, that Microsoft's proposal is named "Penny Black" and
not "Black Penny", these statements are questionable. Under 
http://research.microsoft.com/research/sv/PennyBlack/
you can see, that the Microsoft proposal indeed included puzzles for
humans and even used the same term 'Turing Test' as in the SAVE
slides. I've sent the authors this link, but didn't get any answer
anymore. 

I start to wonder, whether this is a hoax, fake, or any kind of
fraud. Don't need to invent anything or present at IETF, just find a
journalist who writes about a new proposal under the headline "IETF's new
attempt against Spam" and claim it has "circulated". 

(Article at http://www.heise.de/newsticker/meldung/62500 )

Strange. 

regards
Hadmut