Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 1 Apr 2003 19:46:15 -0800

> > From: "Hallam-Baker, Phillip" <[email-masked]>
> 
> >                                             ... The spam 
> senders are shy
> > types who have shown marked reluctance to disclose their 
> identity ...
> 
> Once again, for the umpteenth time, that is clearly false for almost
> all spam. 

Not according to our measurements and the statements on your
own site.

> Almost all spam is some sort of advertising.  In very few
> cases does it makes sense to advertise via mail to strangers products
> or services without providing an identity of some sort.

It does if you are an outright criminal, which according to the
FTC 70% of spams are.

The software being 'sold' is stolen. The Nigerian schemes 
refer to telephone addresses and drop boxes.

You cannot obtain a cert to a drop box or telephone. Well not
from a CA that actually does authentication (sometimes the
authentication is on the honour system with less known CAs).

Simply repeating the same old FUD about a business you don't 
understand does not add weight to your claim. You can say you
disagree but you have not substantiated any of your claims in
the past.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 1 Apr 2003 21:47:52 -0700 (MST)

> Not according to our measurements and the statements on your

Please point out those measurements and statements of mine that show
that spam senders are shy about their identities.

> It does if you are an outright criminal, which according to the

Except for a few scams such as stock pump-and-dump, if the suckers
can't contact you or your fellow conspirators, then you can't defraud
or otherwise cheat anyone, and you have nothing to fear from the FTC.
(A minor detail is that the SEC not the FTC cares about pump-and-dump.)

> refer to telephone addresses and drop boxes.

Telephone numbers and drop-boxes can be and are routinely connected
to the people responsible.

> authentication is on the honour system with less known CAs).

You don't need a cert for a drop box or a telephone.  You need only
launch lawyers at the provider of the drop box (an ISP or post
office) or telephone company.

> disagree but you have not substantiated any of your claims in

 !

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 2 Apr 2003 17:09:30 +0200

> disagree but you have not substantiated any of your claims in

You give such good advices, why don't you stick to them yourself.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg