Subject: IAB policy on anti-spam mechanisms?

From: [email-masked]
Date: Wed, 26 Feb 2003 19:49:15 -0800

I would like to propose that the IAB consider drafting and adopting a
position statement on the highly deleterious effect that certain
anti-spam mechanisms have on legitimate, efficient uses of the
Internet.

I am thinking mainly of the MAPS DUL (Dialup User List), a remarkably
ill-conceived mechanism that complicates life considerably for those
who prefer not to use their ISP's mail servers for reasons of
efficiency, latency and security while doing remarkably little (or
nothing) to actually combat spam.

Here's a page that says better than I can why MAPS DUL is such a bad idea:

http://homepages.tesco.net/~J.deBoynePollard/FGA/maps-dul-is-wrong.html

Other widely deployed but similarly misguided anti-spam mechanisms
include blanket blocks on incoming or outgoing TCP connections to port
25. I've even encountered on ISP that transparently and silently
redirected my outbound SMTP connections to their own mail servers!

All these mechanisms force users to relay outbound or inbound mail
through ISP-run mail servers. This increases latency, decreases
reliability (sometimes substantially), and totally precludes the
effective use of some very useful SMTP security features such as the
AUTH and STARTTLS commands.

There is precedent for the IAB taking a stand on this sort of
thing. In particular, RFC2775 on "Internet Transparency" expresses the
view that the end-to-end principle that underlies the Internet
architecture is still vitally important and worth preserving. Although
RFC2775 spoke mainly to the problems introduced by the widespread use
of NATs, spam filtering is mentioned in passing.

Another relevant precedent is RFC2804, "IETF Policy on Wiretapping",
in which the IETF formally rejected calls to design Internet protocols
to facilitate wiretapping. Yet anti-spam mechanisms that block direct
end-to-end SMTP transfers effectively disables the routine use of
STARTTLS, an automatic, transparent and highly effective
anti-wiretapping mechanism, and makes it a trivial matter for an ISP
to log every email sent or received by its users. At a time of
unprecedented threats to personal privacy and security, the widespread
use of mechanisms like STARTTLS should be encouraged, not discouraged.

As everyone knows, there are many different ideas and approaches to
the spam problem, yet none of them has proven to be a silver
bullet. There is plenty of room for innovation and experimention in
this area, and I certainly wouldn't want to dampen these activities.

However, I believe the IETF and IAB should state some basic principles
that should be observed by everyone working on the spam problem. And
the most basic principle of all should be that no anti-spam mechanism
should ever block email between consenting end-parties without giving
those parties the ability to disable those blocking mechanisms.

As currently implemented, however, end users rarely (if ever) have
such control. They are the "collateral damage" of the spam war, and
are shrugged off just like foreign civilian casualties in most
wars. But a formal policy statement by the IAB or IETF just might give
them something to defend themselves.

Comments?

Phil

---

From: "Theodore Ts'o" <[email-masked]>
Date: Thu, 27 Feb 2003 00:55:38 -0500

> redirected my outbound SMTP connections to their own mail servers!

Yup, some 802.11 wireless "hotspot" networks block port 25 as well.
Very annoying.  My personal workaround to this is to have a personal
server tucked away at a colo facility, which among other things, runs
a SMTP server listening on port 2025 (to get around the port 25
blocking insanity).  This SMTP server will relay e-mail on my behalf,
no matter when I am in the Internet, after my laptop uses STARTTLS and
AUTH to authenticate myself to my SMTP server.

> them something to defend themselves.

Well as we know, in war, everything is justified, including bombing a
village to save it....   :-(

In any case, if friends/colleagues in the IETF needs a point-defense
against being cannon fodder in the war against SPAM, I can set up
something so they use my forwarding SMTP server when they find
themselves on a subnet being blocked by a silly ISP or on the MAPS DUL
list.  Just let me know so I can set you up with a username/password
pair that will be accepted by my SMTP server.

Of course, this won't help the "little people", but I suppose I'm less
optimistic than you that a recommendation from the IAB will be
effective.  After all, if represenatives from nearly every single
organized religion has signed petitions urging against the war in the
Iraq can be ignored by the George Bush, what makes you think that
anything the IETF or IAB might say will dissuade misguided sysadmins
who hates SPAM more than Bush hates Saddam Hussein....

					- Ted

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Thu, 27 Feb 2003 00:41:41 -0600 (CST)

On Thu, 27 Feb 2003, Theodore Ts'o wrote:

> Yup, some 802.11 wireless "hotspot" networks block port 25 as well. Very
> annoying.  My personal workaround to this is to have a personal server
> tucked away at a colo facility, which among other things, runs a SMTP
> server listening on port 2025 (to get around the port 25 blocking
> insanity).  This SMTP server will relay e-mail on my behalf, no matter
> when I am in the Internet, after my laptop uses STARTTLS and AUTH to
> authenticate myself to my SMTP server.

Many sites, including my university, support STARTTLS+AUTH on the
Submission port (587, RFC 2476), which I believe is the recommended
service for clients to use to submit mail in any case (though not
well-supported among MUAs, to my knowledge), and also is effective at
getting around ISP blockage of port 25.  Of course if it becomes very
popular the misguided ISPs will block it too.

 - RL "Bob"

---

From: "Theodore Ts'o" <[email-masked]>
Date: Thu, 27 Feb 2003 09:33:06 -0500

> popular the misguided ISPs will block it too.

Yup, the problem with well-known ports is that well-known port numbers
get either (a) blocked by misguded ISP's, or (b) transparently proxed
by misguided ISP's.  Since I have no idea what sort of stupidity I
might encounter at various different hotel, conference, or 802.11
hotspot networks, it's more convenient for me to use a non-standard
port.

The MUA issue isn't important in my case, because I run a local MTA on
my latop (exim), which is configured to do the STARTTLS and AUTH, so I
can use any MUA I wish.

						- Ted

---

From: "Mike O'Dell" <[email-masked]>
Date: Thu, 27 Feb 2003 12:13:28 -0500

i think you'll find that port 25 is blocked going anywhere except
the operator's outgoing MTA

this is to require authentication to send email, exercise rate
limiting, and other anti-spam-sending strategies

if the ISP is going to be held responsible for the behavior of
their clients, then the ISPs are going to take some action to
police that behavior

note i'm not suggesting this is a good idea, just that it's what has
happened given the current reality

there is a huge disconnect here.  one camp claims that mail sending
should not be allowed by just "anyone", since that ability is
instantly abused by Bad Guys.  another camp claims that forcing email
through alien MTAs is a violation of the end-to-end principle,
privacy, assorted other good ideas.

both are right at some level

there *is* no notion of "strong identity" in the network world today
and i know of no serious attempt to create one, probably for good
reasons

this means that actions on the Internet are inherently anonymous, or
at least unaccountable because the only "identity" arises from a
contractual business relationship between a person and an access
provider.  the access provider is therefore held to be a proxy for
the individual since he does (or at least should, at some level)
have a role in allowing that individual to take various actions.

one major source of the problem is the ease in which Internet access
is available.  one can get a dial-up account quite readily and the
credentials required are trivial to acquired, especially for someone
determined to acquire them.  

so if a Bad Guy acquires access, he can do a lot in the amount of
time required for the business feedback loop to deny access and
cancel the account.  in the mean time, the Bad Guy has acquired
numerous other accounts and when one fails, he just starts using
a new one.  

This is essentially a "disposable identity". The identity is the
binding inherent in the business relationship with an access provider,
and when it becomes worthless, it is discarded and a new one is used.

A consequence of the ease with which credentials can be acquired is
the ease with which new accounts, and hence new identities, can
be acquired.  

To fix this at the "source", so to speak, it would require
making access *much* harder to get.  simply matching credit cards,
etc, is insufficient (credit cards are easy to get), so this leads
to a world where some kind of background check would be required.

I don't think anyone wants to pursue that. (at least seriously)

So what's left?  

As I said earlier, the alternative is to provide the ability to
intercede in network behavior fast enough to have any effectiveness.
This generally means preventing sending email without some form
of vetting.  This usually means authentication and then some
additional behavioral control on top of it.  Rate-based models seem
to be the least intrusive.  They allow people doing "real people"
things to proceed with essentially zero interference while spam
senders are thwarted to some significant effect.  If a client
has a real need to have the behavior limits altered, the provider
can enter into an addendum to the service agreement.  this still
provides for a degree of behavior monitoring to police the impact
on the rest of the network.

I will end by noting that many people are in both of the camps
described above - they want a "throat to choke" proxy for individual
behavior, but they want unimpeded ability to send email themselves.

while I agree with the desire, it is self-contradictory.

	-mo

---

From: Pete Resnick <[email-masked]>
Date: Thu, 27 Feb 2003 13:13:50 -0600

On 2/26/03 at 7:49 PM -0800, Phil Karn wrote:

>I would like to propose that the IAB consider drafting and adopting 
>a position statement on the highly deleterious effect that certain 

It seems to me that this is a perfect topic to be discussed at the 
Thursday morning Anti-Spam IRTF group meeting.

pr
-- 
Pete Resnick <mailto:[email-masked]>
QUALCOMM Incorporated

---

From: Michael Richardson <[email-masked]>
Date: Thu, 27 Feb 2003 14:33:48 -0500

-----BEGIN PGP SIGNED MESSAGE-----

The "nicest" solution that I can see is for the ISPs to transparently
proxy port 25 to their MTA. They should offer STARTTLS.

If the client selects STARTTLS, their proxy should immediately connect
directly to the intended destination, permitting the connection to go
through. May well let the clueful through.  This could be open to further
abuse, as you can't tell what the client/server are doing now.

However, the ISP still gets to rate limit the number of connections
that the client makes. This in itself is probably very powerful.

Things that IETF clueful road warriors can do, and I do:
       1) use IPsec to your mail relay.	I do this automatically.
       2) use IPv6 (always configure 6to4 on your notebook)

I then, as Ted does, do authenticated relaying with STARTTLS. 

So, my packets look like:
    SMTP/TLS/TCP/IPv6/IPv4-encap-v6/IPsec/IPv4.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Richard Shockey <[email-masked]>
Date: Thu, 27 Feb 2003 16:18:39 -0500

At 01:13 PM 2/27/2003 -0600, Pete Resnick wrote:
>>anti-spam mechanisms have on legitimate, efficient uses of the Internet.
>

I agree ...but for those of you who live in the United States, The Federal 
Trade Commission is holding a 3 day workshop on combating spam.

http://www.ftc.gov/opa/2003/02/spamforum.htm

For those of you more politically inclined as well as technically 
knowledgeable about the subject I would encourage you to participate.

I have personally had some dealings with the FTC on privacy related issues 
as it relates to ENUM and in general I have found the Commission staff to 
be most grateful for knowledgeable, professional, technical opinions from 
folks like us.

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 314.503.0640,  Fax: +1 815.333.1237
<mailto:[email-masked]> or <mailto:[email-masked]>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Feb 2003 10:42:36 +0100

In your previous mail you wrote:

=> I don't understand the word "transparently" here (:-). If one of
my ISPs does such things, I'll sue it immediately: we have laws in
France to protect the secrecy of private mails. I'll be surprised
if there is none in USA.

=> yes, the protocol 50 will save us from them (I'll put this on a T-shirt :-).

Thanks

[email-masked]

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 28 Feb 2003 09:29:22 -0500

>AUTH to authenticate myself to my SMTP server.

May I add running this through SSH?  That is what I do.  All my outgoing 
SMTP and incoming POP is through SSH to my home server, protecting me from 
such nefarious operations.

I even found one 802.11 hotspot (WISPer), that did not have the SSH port 
blocked and I could have done all my work without paying (did anyway, as I 
want to encourage hotspot deployments).