Subject: RE: [Asrg] RE:ASGR 8a Use of certificates

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 8 Apr 2003 10:29:59 -0700

> From: Vernon Schryver [mailto:[email-masked]]
> > From: Kee Hinckley <[email-masked]>
> 
> > Okay.  Let me try and say this in less words.
> >
> > A junk fax or junk pre-recorded phone message can be traced, using 
> > information provided by a clueless user, in half an hour.
> 
> Have you never received a junk fax with a bogus banner, without
> a knowable source telephone number, and advertising a web page?
> I have.  How would I trace the junk faxer?

You get a court order. All the information is kept for a
minimum of 30 days under CALEA by the telco.

> How do I trace a junk pre-recorded phone message that asks me to
> record my number or push some touch tone keys to be called back?
> I received many of those before July, 2002.

Ypu get a court order. All the information is kept for a
minimum of 30 days under CALEA by the telco.

> Spam that does not carry an IP address of someone complicit in the
> crime cannot exist.  You can always identify the IP address of the
> SMTP client.  If it's not overseas, you can launch lawyers.  If it's
> foreign, you can at least firewal it.

The issue is cost. It costs $350 retail to get your identity 
authenticated. An investigation costs thousands. Just pulling
the telco records costs thousands, Internet investigations 
cost dramatically more.

Deterrence and law enforcement is of major utility in increasing
the effectiveness of security measures. It is not a substitute 
however.

There is not a police dept in the world that does not advise 
that people buy locks and secure things properly (well not an
honest one).

>  - it is easy as to identify spammers as is to identify junk faxers
>       and pre-recorded phone callers

Actually this is empirically not the case. There is no analogue 
of CALEA and the spam senders have the ability to hide behind
offshore machines. Junk fax senders typically do not have that
type of option on the telco network which is highly regulated.

>  - it is sufficiently easy for those who are motiviated to spend
>      more than half an hour pointing and clicking on the web.

Untrue.

>  - it cannot be improved.

Untrue.

> The same applies (or not) to 1-800 and 1-900 phone numbers.  You can
> rent a 1-900 or 1-800 phone number and disappear into the night when
> you think it's time, with little few more traces than renting hosting.

That is no longer quite as easy since the charges collected fraudulently
are being reversed leaving the hosting cos who factor accounts they
don't have adequate knowledge of with the loss.

> My vendetta against authentication snake oil is my main point.  

Good to see you admit that is what you are up to. I think your 
main point is that you really can't stand all the people who 
have come late to the net and don't give the old timers the
respect and privilleges they feel their seniority is due.

You make idiotic statements like 80% of spam comes from free 
email providers yet you never answer the point that free email
providers will in almost all circumstances have rate restrictions
in place so what you are really up against is spam that attributes
itself to free providers.

This has a simple answer, authentication. So why are you against
the idea? I suspect it is because you dont want a solution, you
really want to be able to turn back the clock to the 1980s before
all the unworthy unwashed hordes came to the Internet and there
were businesses and such.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 8 Apr 2003 13:00:01 -0600 (MDT)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> ...

> ...

Versign demonstrated the low value of affordable authentication when
it sold the identity "Microsoft Corporation" for about $350 to to an
individual who fraudulently claimed to be a Microsoft employee.  
( http://www.cert.org/advisories/CA-2001-04.html ) On the other hand,
$350 can rent a little space and a phone line on which you can install
a PC with software to send junk faxes or makes pre-recorded calls and
collects the numbers of interested consumers.  It is easy for the bad
guys to disappear in either case.  In both cases, court orders, credit
card trails, other standard tools can often find the bad guys.

> ...

Empirically that's not the case.  America Blastfax's Denver satellite
could have been as anonymous and slippery as any spam amplifier.  ABF
evidently rented local space to plaster the local calling area with
junk faxes from their Texas offices.  They could have paid cash for
the space and the phone lines and moved to new space and phone lines
once a month or before things got hot.

The importance of the TCPA, junk faxes, and junk pre-recorded phone
calls is not that dealing with them is easy.  That world illuminates
the nature of the unsolicited, objectionable advertising problem, and
shows that finding spammers is not now and never will be either
impossible or trivial.

> ...

As Phillip Hallam-Baker knows, I have never said "80% of spam comes
from free email providers," because we both know that is not true.
We both know that rate limiting by free providers is irrelevant.

If certs were required for mail, then free providers would issue certs
along with usernames and passwords, and for the same price and with
the same due diligence in checking that the applicant is not really
Alan Ralsky that they now excerise.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 8 Apr 2003 15:32:48 -0400

>were businesses and such.

Phill, you were doing so well.  Reasonable arguments and the like. 
Then you blow it with this.  Let's try and keep the personal stuff to 
a minimum.  *I'd* sure as hell like to turn back the clock to the 
1980's in that respect as well.  (Although I do think that having 
newsreaders that let you read Usenet on a per-group basis, instead of 
with all the groups jumbled together, probably was a reasonable 
improvement.)
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg