Subject: SPAM harvesting: RE: opt-in and consensus

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 6 Apr 2003 05:46:37 -0700

> this may come as a surprise to phill, though not to ed. the 
> provreg wg and
> the iesg, in my own personal view, are divided by this very 
> question, and
> a non-trivial potential motivation for both camps there is 
> the rasion d'etre
> for this irtf tf -- spam (via whois:43 server data mining).

It will probably come as a surprise to most to find that WHOIS
turns out to not be a major target of address harvesting attacks.
At lest in empirical studies rather than anecdotes.

The FTC did research in this area. 100% of the emails used
in chat rooms, 85% used on mailing lists, usenet or the Web
were harvested, none of the addresses in whois were harvested.

http://www.ftc.gov/bcp/conline/edcams/spam/pubs/harvestchart.pdf

I know, I did not expect that result either.

Of course an effective way to solve the problem would be to 
look at the specific purposes for which whois email listing
was required (domain reg challenges, etc) and to require
that the registrars or the registry run a forwarding mail
server that only forwardsw mail authenticated as being sent 
for that purpose.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sun, 06 Apr 2003 10:05:14 -0400

<ritual line eater food>

the result (spam arising from whois:43 mining non-dominant, from http:80,
from smtp:25, from irc:6667 mining, dominant), is ... er ... not registry
provisioning protocol- and/or ICANN-deck-chair-migration-centric.

having worked for an ad network line-of-business (engage, 2000) on the
issues of pii acquisition, policies and mechanisms relevant to same, the
FTC result cited is consistent with my understanding of the problem.

jumping to niche-specific cure (not a discussion of phill's pre-coffee, mine
at least, purpose-specific, authenticated-relay, authenticated-envelope fix)
is not an exhaustive examination of whether it is useful to the problem at
hand for collector evaluation mechanisms to augment existing mechanisms.

eric