Subject: RE: [Asrg] Turing Test ...

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 08:10:44 -0800

> Guys, havent we all seen good example of what robots do last 
> week with 
> that mailkey bot?
> 
> I agree with Vernon - the challenge/response roboots are last 
> resort and 
> if you already determined its a spam and just want to make 
> sure its not 
> false positive. 

I would add one caveat, it should say WHY the email is being
bounced. otherwise it looks like an indiscriminate bounce.

I don't think folk have problems with a response saying
that the message had spamwords in it.

> If we do any challege-response system it must be automated in 
> a way that 
> humans do not get annoyed and that all systems can recognize 
> its a bot and 
> since its automated some kind of authenticaiton would be 
> necessary to not 
> let spammers participate in it.

We should not accept second rate authentication over cryptographic
authentication though. The mailing list attack that I described
earlier is real and has occurred on several occasions to me,
the IETF lists appear to be common targets. Challenge/Response
has a well known couterattack, we should not accept it in preference
to digital signatures.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Thu, 3 Apr 2003 06:55:41 -0800 (PST)

Cryptography isnt everything and digital signatures is hardly the only 
alternative to challenge/response and as has been pointed out many times, 
certificates do not provide much more then that somebody went into trouble 
of getting it, there just no way any certificate authority can make clear 
one-one comparison between real person and digital persona that somebody 
else can serious trust (except maybe if they had the person take dna
test and converted his dna profile into digital signature...). For 
websites, in reality its not the certificate that makes the difference 
its the use of SSL that protects the information being transmitted.

I'm not saying certificates aren't usefull as way of signing things, but 
not every email is some legal document that requires a signature and I'd 
rather its stay that way.

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 3 Apr 2003 09:34:05 -0800

On Thursday, April 3, 2003, at 06:55  AM, [email-masked] wrote:

> alternative to challenge/response

it is if your company sells encryption stuff and digital certs... (grin)

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 3 Apr 2003 09:46:38 -0800

> it is if your company sells encryption stuff and digital certs... 

And now that I realize how little sense of humor some folks on this 
list have, let me point out I'm not ripping Phill here. But there's an 
awful lot of "I like hammers, so everything's gonna be treated like 
nails" running around this list from a bunch of folks, only everyone's 
favorite hammer is different.