Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 1 Apr 2003 11:20:49 -0500

On Tuesday, April 01, 2003 8:31 AM, [email-masked] [SMTP:[email-masked]] 
wrote:
> There is nothing stopping spammers from generating new keys and certificates
> for their mail servers, so we can have servers exchange certs, but really
> not authentication there as far as who is who.
>
> Slightly better is if server must have a public certificate verifyable
> though DNS, then whatever name is at EHLO, it can be checked at DNS and
> then you know who it is. This does not stop spammers from adding their
> certs into dns either, but at least then we are requirying them to have
> valid dns record for mail server and they really do not like that idea...
> (but they can still just get new domain for $6 which is real cheap as far
> as preventing abuse and changing domains all the time - to stop some kind
> of ip block verification has to be done or DCC like system).

I think this is a primary requirement (authenticity of origination - in some 
form), do others feel that authenticity will add to the efficacy of any 
approach or a majority of approaches?

-e
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Tue, 01 Apr 2003 13:04:56 -0500

> approach or a majority of approaches?

Whole-heartedly. If we can make them be who they claim they are, then there
is SOME increased accountability, and with that countermeasures become more
effective. At current, I only need a bunch of emails, and I can spam.
Require me to spend money and time on a domain, or cert, or physical system
makes the whole deal less appetizing. Not to mention that you made me leave
a trail that could then be traced back to me. In light of state laws against
spam (even one state is bad), this is something that I DON'T want to have
happen, because I can't tell where my receiver is from...