Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Apr 2003 08:28:19 -0800

> Please point out those measurements and statements of mine that show
> that spam senders are shy about their identities.

You state that 8-% of spam comes from the free dialup account 
domains despite the fact that these all implement rate limiting.

So how can so much spam come from those domains? Answer it 
does not, the From addresses and routing headers are fake.

> > The software being 'sold' is stolen. The Nigerian schemes 
> > refer to telephone addresses and drop boxes.
> 
> Telephone numbers and drop-boxes can be and are routinely connected
> to the people responsible.

The success rate is not that high, the cost of the investigation
is high, unless you know the exact time the person is going to
collect the info the cost of a stakeout is prohibitive.

It is much harder for the bad guys to authenticate themselves
in advance to a specialist in the field with access to blacklists
of accomadation addresses, prisons etc. than it is to 'authenticate'
themselves to the customer.

> > Simply repeating the same old FUD about a business you don't 
> > understand does not add weight to your claim. You can say you
> > disagree but you have not substantiated any of your claims in
> > the past.
> 
>  !

Your arguments on this point appear to be religious in nature
rather than based on empirical observations. 

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 2 Apr 2003 15:25:17 -0500

>collect the info the cost of a stakeout is prohibitive.

Even a number of the high-profile ebay fraud arrests depending on 
serious detective work by people who had gotten nailed.  In at least 
once case all the police did was show up to make the arrest.  It's 
hard to find people willing to put that much effort into tracking 
down a spammer.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 14:12:55 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> domains despite the fact that these all implement rate limiting.

I can't find any words among my web pages that say anything lkke that.
Could you point them out specifically?  `find ... | xargs grep 8.%`
fails to discover anything relevant in web pages starting at
http://www.rhyolite.com/anti-spam/ I'm extremely careful to say things
like "much unsolicited bulk mail bears return addresses pointing to
these free providers" instead of "spam comes from the free dialup
account domains.

I don't talk about "free dialup accounts domains," because I do not
like the idea of the DUL or similar lists.  That might explain why
`grep dialup`  cannot find a relevant use of "dialup" in any of those
web pages.  Other people might talk about shy spammers and dialup
accounts, but I don't think I do.

I also don't see how rate limiting is at all relevant to whether
spam senders are shy about their identities, but that seems irrelevant.

> does not, the From addresses and routing headers are fake.

It is true that a lot and probably most current spam has header and
envelope From addresses that do not match the IP address of the SMTP
client, but there is only religous conviction and no evidence that
they all or even most can honestly be called "fake."  Contributors to
this mailing list have pointed out that they use such "fake" headers."
Of course, some such spam headers are not just "fake" but forged and
so against various laws.

What does this have to do with whether spammers are shy about their
identities?  The answer is clearly that spammers are not shy about
their identities (since they are advertising), but they are shy about
some of their ISP accounts or they use ISP accounts that would be
given digital identities/certs/signatures just as "throw-away" as the
username and password they already get.

> ...

All of that would apply equally to any plausible sort of digital
authentication.  Possession of a public/private key pair does not keep
one from moving around nor using the old sources of practical anonymity.
In fact, one of the neat things about digital systems is that they
can allow more mobility and anonymity.

> themselves to the customer.

I'm sorry, but I don't understand that.  It is certainly true that no
plausible mail authentication system will require more real world
authentication to get a cert or whatever than is now required to get
a ISP account, a telephone number, a web hosting account, or a post
office box.   If all of those are now insufficient to pin a spam
sender, then so will any new scheme based on the same foundations.
"Digital" is not magic pixie dust that changes the nature of this problem.

> rather than based on empirical observations. 

As far as I can tell, the enthusiasm for digital authentication of
email is religious or an expression of another aspect of human nature.
People have the sense that if only they could put a name on a spammer,
they could speak it three times, ring a bell, light a candle, and make
the spammer go Poof!

In fact, spammer identities are already quite available to anyone who
cares to look or sometimes serve legal papers.  It's just that the
screaming epithets at "Ralsky" doesn't stop any spam.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 15:02:51 -0700 (MST)

> From: Kee Hinckley <[email-masked]>

> hard to find people willing to put that much effort into tracking 

Yes, and digital authentication schemes would do nothing to reduce
the effort required to track down a spammer or to motivate people to
exert themselves track down a spammer.  Say something bad has happened,
whether spam, eBay fraud, or something else, and you have one of the
following used in the crime:

  1. an IP address
  2. a cert
  3. a telephone number

The effort to get the authorities to show up to make an arrest or
whatever is no less for the cert than for the other two.  In fact,
one might hope that privacy laws will make chasing the cert more difficult.

For completeness, contrast using a cert with one of:
  4. a URL
  5. a postal adddress
  6. a contact email address

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Wed, 02 Apr 2003 18:07:07 -0500

> ... digital authentication schemes would do nothing to reduce
> the effort required to track down ...

vernon,

rightly or wrongly, dan jaye and i set out on that path for changing the
way cookies are used, the way-expired draft is on the nic-naa.net public
ftp just now. the goal was to make bad cookies carry increassingly marginal
certs, and change the way privacy was managed.

our work intersected with the ie5.5 (early) cookie handling, and with
the p3p, which resulted in a withdrawal of one ie5.5 approach that was
detrimental to all 3rd-party cookies, and the inclusion of a form of
p3p policies on cookies (and eventually on other http methods).

in sum, we changed or participated in the complementary changes to both
ie5.5 (and mozilla) and to p3p, circa nov. 1999.

readers of keith moore and ned freed's work, also on the subject of the
http state management mechanism, are of course aware that they rejected
our work, or the notion of policy evaluation on cookies, other than the
form that was actually present in ie5.5 (early), and fortunately (imho)
withdrawn by the redmond policy and engineering teams.

where that line of work (attempted in provreg) differs from what i see
here (asrg), is we took/take care to understand 95/46/ec, as well as less
stringent or other-conceived policy frameworks.

for what its worth, spamcop v1.3.3 decided a note i sent to nanog was
"spam", so it isn't high on my list of things to buy.

eric