Subject: RE: [Asrg] SMTP over SSL

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 1 Apr 2003 19:41:10 -0800

> Question 1:
>     The way that I had envisioned, individual servers would be issued 
> certificates (SSL, some new standard, etc.).  Those certificates 
> basically were used to state that "This server will not 
> broadcast spam".

No try, "The owner of this server has undertaken not to spam and
if they do not you can serve papers at this address"
 
>  The issue of DNS, at least in my mind, should not come up.  

You need to know that the owner of the domain has a policy of
using SSL.

> As long as 
> the IP address of the sending machine matches the IP address on the 
> certificate, and the certificate authority verifies it, 
> should be okay.

IP address can be included in certs, however DNS name is better.
The problem with IP address is that they tend to be variable,
in many data centers the mail server is behind a NAT in any case
and nothing the IETF says on this point is going to be taken 
notice of (and given previous statements, quite rightly)

Another problem is that in the really big data centers the
machine can be on multiple IP addresses and they can change 
over time. We have separate feeds from at least two ISPs
into each of our datacenters. You want to minimize the number
of dependencies if you switch.

> Question 2:
>     This seems to be an issue for the administrator of the 
> outgoing SMTP 
> server.  It is up to him to make sure that only authorized 
> persons can 
> relay mail through it, and that those authorized people are not doing 
> bad things (i.e. spamming).  Failure to do so could cause his 
> server's 
> certificate to be revoked.  If you are an ISP, this could be 
> a very bad 
> thing, indeed.

There can be a range of policies with this regard, all of which
are essentially don't spam but indicate the specific actions they
undertake not to do. A corporation can probably be much more
specific here than an ISP could since they have much more 
control over their users.

It need not be one size fits all. 

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 1 Apr 2003 21:37:18 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> ...

We already have as much of that as is possible without legislation
in domain name and IP address whois records.  Take the IP address
of the SMTP client delivering the spam to your SMTP server, 
find the responsible party, and launch lawyers....or serve papers
on the post office for the owner of the advertised post office box,
the HTTP hosting bureau for the advertised URL, or the telco for 
advertised phone number.

With legislation to make serving papers less unlikely to yield
money, we would still have those addresses and still wouldn't need
cryptographic help.

> ...
> undertake not to do. ...

Yeah, right, like all of the terrible things that happen to outfits
displaying the TrustE logo but not exactly respecting any privacy
but that of their own management.

In the real world, such a system would be exactly like the TrustE
system.  Microsoft would promise "we'll terminate the account of anyone
accused of spamming," and do it.  UUNET would promise "we'll investigate
any reports of spamming," and no one would be able to prove otherwise.
Some outfit would make a mistake and promise "we won't send spam,"
hire or sell to a rogue user, send spam, promise to do better next
time, and change its promise to UUNet's.

In other words, see current news about Habeas, Topica, and Harris.

In still other words, if you ran an ISP or a company and promised
to pay damages should your outfit ever send spam, your board of
directors or other boss would or should fire you on the spot.
Assuming such a liability voluntarily would be grossly incompetent.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 03:12:51 -0600

>Assuming such a liability voluntarily would be grossly incompetent.
I agree and acknowledge the fact that no one will voluntarily assume any 
liability... to do so would undoubtedly place anyone's employment in 
jeopardy.  It's my assertion that liability (in some form) will have to 
be forced on everyone.  I realize that one goal of this group is to find 
a solution that will be accepted by the greater Internet community. 
 Forcing liability down people's throats is a good way to get an idea 
killed off... unless the potential "pay off" is great enough that they 
take the risk.  In this case, relieving the burden that spam places on a 
large network may be a great enough prize that people are willing to 
accept the imposed liability.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 08:02:23 -0700 (MST)

> From: "Eric S. Imsand" <[email-masked]>

> accept the imposed liability.

The trouble with that reasoning is that:

 - the technical costs of dealing with spam are trivial per user except
  in rare cases.  All email is on the order of 5% or 10% of HTTP traffic.
  Thus, the CPU cycles, disk space, and bandwidth are insignificant
  compared to other services that are considered too cheap too meter.

  - the non-technical costs of spam are significant, but like the
   non-technical costs of HTTP.  Wasted employee time (or your own) is
   hard to value in dollars.  However, time wasted on spam is being
   controlled by filters.  My mailbox receives less spam today than it
   did years ago, but 20 or 50 times as much is sent toward it.

  - the smallest liablity for sending spam would be enormous.  Paying
   $25 to small fraction of the spam targets of a single use of a
   50,000,000 address CDROM would bankrupt any but a large business.
   The existing anti-spam laws have shown $25 is too small to motivate
   spam targets.  Even the $500/$1500 cost of a junk fax imposed by
   the TCPA is a fraction of the cost of going to court.  If you file
   in a local small claims court and collect and you value your time
   at much more than minimum wage, you'll lose money.  What business
   would consider assuming a potential liability of $500 for each of
   a few million spam targets?

  - the larger the network, the larger liability.  By the time you are
   talking about a network large enough for the technical costs of
   spam to be significant, the potential liability is too large
   for my calculator to handle.

  - your pay off from the liability comes from others assuming it.  You
   cannot benefit by promising to pay for your spam unless you are
   already widely blacklist, and even then you won't assume a significant
   liability.  Why are the only major outfits we've heard of signing
   up with Habeas the widely blacklisted Topica and Harris?  How much
   liability have they assumed?

You might fix all of that a law that caps the liability, is enforced
by state attorneys general or the FTC, and so forth.  (Never mind how
to pass a law, motivate attorneys general to care, or the many other
problems with laws.)  Such a law would not need cryptographic proofs
of identity any more than they have been needed by the FCC against
the junk faxers.  Just as in TCPA actions, you can either use the
sending telephone number/IP address or the name, address, or telephone
number advertised in a junk fax or spam to collect.

Cryptographic authentication can do nothing about spam.  It's only
potential is to provide a new revenue stream to struggling commercial
PKI vendors and some interesting and profitable work for programmers
like many of us here including me.

  ....

I sometimes feel guilty about repeating all of this stuff to each new
defense of authentication as The Cure for Spam.  I rationalize away
the guilt by telling myself it would be a bad thing for someone point
Congress or the FTC to the archives of this mailing list for the
consensus view of the IRTF/IETF that a law requiring commercial certs
on mail would not only stop terrorism and child pornography but also
control spam.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 2 Apr 2003 16:21:48 -0500

>    up with Habeas the widely blacklisted Topica and Harris?  How much

Keep in mind that in order to use Habeas, Topica has to do confirmed 
opt-in.  That's a pretty significant way to cut the liability.

The other side of that, of course, is that I assume Topica hasn't put 
Habeas headers on most of their lists.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg