Subject: RE: DEPLOY: Sender-ID provides little or no defence against adapt ive threats

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 3 Sep 2004 16:42:41 -0700

Even if we end up with spammers using disposable domains it will
mean a major switching cost for every message variant. In effect
the use of hash busters will be completely negated.

Saying that Sender ID will not work because of the throaway domain 
problem is like saying that it is pointless putting locks on your
doors because a burglar can break a window. In the real world breaking
windows creates noise and leads to burglars being caught.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anne P. Mitchell,
> Esq.
> Sent: Friday, September 03, 2004 4:55 PM
> To: IETF MARID WG
> Subject: RE: DEPLOY: Sender-ID provides little or no defence against
> adaptive threats
> 
> 
> 
> 
> > Anne P. Mitchell wrote:
> > >cf. CipherTrust's study released this week in which >50% of the 
> > sources
> > >for all email surveyed which published SPF records were spammers.
> > >
> > >http://www.infoworld.com/article/04/08/31/HNspammerstudy_1.html
> >
> > Just so there is no confusion... this is good news for SPF, not bad 
> > news.
> >
> 
> Absolutely, completely agreed!  I should have elaborated.  As I have 
> said in various public posts (elsewhere), if spammers want to tie 
> themselves to their sites by authentication, that's a *good* 
> thing.  My 
> points are that a) spammers will adopt whatever is out there, and in 
> this instance b) spammers are stupid - by adopting what they 
> *think* is 
> an anti-spam protocol to help get their spam through, they 
> are actually 
> raising their hands and saying "here I am!"
> 
> Anne
>

---

From: "Chris Haynes" <[email-masked]>
Date: Sat, 4 Sep 2004 08:18:55 +0100

"Hallam-Baker, Phillip" commented:

> doors because a burglar can break a window.

I don't think anyone is listing this as a weakness of  Sender-ID - certainly
no-one on this thread.

All anti-forgery schemes which force the bad guys to have to make themselves
visible are ultimately helpful.

We seem to have a violent agreement for once!

>In the real world breaking
 Chris

---

From: Dean Anderson <[email-masked]>
Date: Sat, 4 Sep 2004 04:51:12 -0400 (EDT)

> windows creates noise and leads to burglars being caught.

There is no point in putting a lock on a free-standing doorframe when the
burglar can simply walk around the door. And that is the situation we
face.  Spammers can still forge email, even without disposable domains.  
They can forge email from the domain (any domain) serviced by their ISP.
There are infinitely many user addresses to the left of the @ sign.  Since 
there no walls, there is no point in having doors with locks.

If the abuser just doesn't want to give an email address they use, they
can forge an address at their ISPs domain. Or they can use a disposable
address.  One still has to contact the ISP with the IP address and time of
use of the abuser.  Same as one would without sender-id/SPF/RMX.

If the abuser is interested in harrassing a particular email address (a
joe job), they can just forge email to their ISP's relay. That relay will
then bounce the message to the target.  The target then has to contact
each ISP to report the abuse. But they had to do that before
sender-id/SPF/RMX. The problem is the same.  

At great expense, you've accomplished nothing.

		--Dean

---

From: <[email-masked]>
Date: Sat, 4 Sep 2004 09:04:48 -0400

Not "accomplished nothing" but we would have accomplished the need for the next step:  SMTP AUTH
that incorporates spoofing prevention.

Terry Fielder
Manager Software Development and Deployment
Great Gulf Homes / Ashton Woods Homes
[email-masked]
Fax: (416) 441-9085

> [mailto:[email-masked]]On Behalf Of Dean Anderson
> Sent: Saturday, September 04, 2004 4:51 AM
> To: Hallam-Baker, Phillip
> Cc: 'Anne P. Mitchell, Esq.'; IETF MARID WG

---

From: Dean Anderson <[email-masked]>
Date: Sun, 5 Sep 2004 12:00:39 -0400 (EDT)

> that incorporates spoofing prevention.

Oh, SMTP AUTH needs to be changed now.  

And you still have SMTP AUTH passwords that can be stolen.

And you still have disposable accounts.

And you still have disposable domains.

Etc, etc, etc.

The user _still_ needs to do just what they did before.

At even greater expense, you have _still_ accomplished nothing.

		--Dean