Subject: [Asrg] Blacklisting email accounts?

From: "Jason W." <[email-masked]>
Date: Tue, 30 Aug 2011 18:08:40 -0400

(Maybe my google-fu isn't up to par and this has been discussed
previously - if so, my apologies)

With PCs being owned and email accounts being owned, has anyone
considered blacklisting individual email accounts? Within the past
month, I've gotten an influx of spam from people who I have
communicated with. Given the content, I doubt these people would be
sending me random links to foreign websites designed to own my PC.
Some of these senders are people who I haven't communicated with in
years, but my email address is probably in their email box or address
book. It's all been consumer-grade email (Comcast, AOL, Yahoo, etc.)
from people for whom it would not be a stretch to imagine them getting
owned.

Considering that some of these providers don't seem to be interested
in cleaning up their outbound mail, has anyone considered blacklisting
email accounts like we do IPs/hostnames? I do this for my personal
mail stream, and it scales - get a spam from an owned person I don't
need email from, drop 'em in the local BL. But for this to be
effective, there'd have to be some kind of DNSBL'ish thing to query.

I do understand that there are an infinite amount of email addresses
for freemail domains ;)  So this wouldn't stop spammer-created
accounts.

But if Aunt Tilly has to change her email address (or go through some
removal-from-blocklist stuff - possibly go through some education),
that could have the necessary impact to change her behavior so she
wouldn't get owned again. This could be use a strong password, don't
run an insecure OS, don't use insecure wiifi, whatever is deemed good
information to better their understanding of what they've done.

Or am I giving people too much credit in hoping they'd change after
they meet the clue by four?  For some, the aversion to getting another
email address might outlive the desire to be lackadaisical..

-- 
HTH, YMMV, HANW :)

Jason

The path to enlightenment is /usr/bin/enlightenment.

---

From: Graeme Fowler <[email-masked]>
Date: Wed, 31 Aug 2011 09:45:05 +0100

On Tue, 2011-08-30 at 18:08 -0400, Jason W. wrote:
> But for this to be effective, there'd have to be some kind of
> DNSBL'ish thing to query.

Whilst it's at a finer level of detail than you might require, there is
the APER (Anti Phishing Email Reply) list which spun out of HE being
targetted and is maintained by a decent group of volunteers:

http://code.google.com/p/anti-phishing-email-reply/

At work we've found this of tremendous use.

Graeme