Subject: [Asrg] Turing Test ...

From: Art Pollard <[email-masked]>
Date: Wed, 02 Apr 2003 15:49:41 -0700

Why not allow the e-mail client to pose a Turing test to anybody that is 
not in its whitelist?

Many websites are turning to Turing tests to prevent automatic bots from 
crawling their sites or otherwise providing data to or from their site.  I 
am sure we have all been presented at one time or another with a Turing 
test in the form of a graphic with some munged characters in it that we 
need to identify.

If the e-mail client were able to pose a Turing test to whoever sent it 
mail, then it would be easy to identify spammers and to simply not process 
their mail.

 From an end-user point of view, if I had to identify a series of 
characters, animals, or other items in a graphic, the first time I 
contacted someone I don't believe I would consider it 
obtrusive.  Subsequent contacts from me from my original e-mail address 
would not need to have a turning test applied as one could safely assume 
that it is not an automated system sending the mail as is the case with 
spammers and I would have been added to their client's whitelist.  (The 
client could maintain the whitelist automatically in addition to providing 
tools for managing the client's white and blacklists manually.)

With the now common use of the browser on any desktop and for that matter 
graphics programs everywhere from where one would want to send e-mail -- 
even cell phones, I believe that the tools are in place to make it a 
relatively painless transition.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Claus Assmann <[email-masked]>
Date: Wed, 2 Apr 2003 18:48:27 -0800

> Why not allow the e-mail client to pose a Turing test to anybody that is 

Depends on your whitelist.

A group of people is supporting some open software so we get a lot
of questions via e-mail. A reply can come from various sources.
Which of the sources do you whitelist? Whenever I get a "TMDA"(?)
challenge as a response to my reply I delete it. If I knew in advance
that the person who asked the question uses such software I wouldn't
waste my time to provide free support for them.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Wed, 02 Apr 2003 22:14:30 -0800

On Wed, 2 Apr 2003 18:48:27 -0800 

>> Why not allow the e-mail client to pose a Turing test to anybody that
>> is not in its whitelist?

> A group of people is supporting some open software so we get a lot of
> questions via e-mail. A reply can come from various sources.  Which of
> the sources do you whitelist? Whenever I get a "TMDA"(?)  challenge as
> a response to my reply I delete it. If I knew in advance that the
> person who asked the question uses such software I wouldn't waste my
> time to provide free support for them.

Thus revealing, quite succinctly why challenge/response systems are
fatally flawed for interpersonal correspondence.  Its worth my time
going thru a challenge response (once) to get a post onto a mailing
list -- that's a large audience, it reflects publicly on me, and the
message tends to have greater significance than one sent to an
individual stranger.

Likewise, I don't bother with whitelist challenges in personal mail.
Not worth my time, and unjustified by personal interest.  I will however
suffer and handle whitelist challenges for list posts, and for
formalised role addresses where I am the initiator (eg postmaster,
listadmin, list-owner, etc) as they are special cases that predefine a
level of interest on my part.

ObAdmission: I use, like, and recommend TMDA, just not for personal
addresses.  I use it in front of role addresses and in front of mailing
lists.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 08:44:04 -0500

At 3:49 PM -0700 4/2/03, Art Pollard wrote:
>Why not allow the e-mail client to pose a Turing test to anybody 
>that is not in its whitelist?

This has all been discussed before.
1. People will do it.  People *are* doing it.  Some are doing it 
right.  Some are doing it extremely wrong.  (Anyone who posted any 
message to this list last week has first hand experience with that.)
2. You need to deal with people who are blind.  (Not an issue, but 
some tests don't.)
3. You need to deal with senders who aren't people (e.g. your bank, 
Amazon, eBay...).  That means that to be handled correctly you need 
to know who to whitelist before they send you email.  That turns out 
to not be quite as easy as you might think.  I've proposed that 
someone come up with a standard for whitelisting URL's, but nobody 
has picked up on it.
4. You need to deal with people who don't have web access but do have 
email access.  This includes large numbers of people at big 
companies.  Outbound web access at some companies is considered a 
restricted privilege for security and other reasons.
5. You need to accept that you are going to annoy the hell out of a 
lot of people, some of whom (including potential customers, bug 
reporters, people doing you a favor...) won't bother to response. 
Challenge response implicitly says that your time is more important 
than that of the sender.  That's not polite, and very often it's not 
true.  Most of the non-spam messages I receieve from strangers are 
ones I care more about getting than they care about giving.  But 
reports.  Potential clients.  The people I least want to annoy.
6. You need to deal with vacation messages and other types of 
auto-responders (I've header of at least one challenge/response 
system that blacklisted anyone who responded incorrectly--that's a 
bummer if the response was a vacation program).

If you have a solution for #3, and you don't care about #4 and #5, 
then go ahead.  But personally the only time I think 
challenge/response is at all acceptable is as a way of dealing with 
messages you already think are spam.  In other words--only use it as 
a mechanism for detecting false positives.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: matthew richards <[email-masked]>
Date: Thu, 3 Apr 2003 09:56:12 -0800

it's also a possibility that the Turing Test will eventually fail due 
to technological advances, so in the long term i don't think it's a 
practical solution to anything. actually its already been proven to 
be of limited use and by no means invincible.

>someone come up with a standard for whitelisting URL's, but nobody 

maybe that's because a simple url forgery would make a such a feature 
inconsequential. without a reliable way to authenticate addresses 
whitelists will be useless.

>4. You need to deal with people who don't have web access but do 
>have email access.  This includes large numbers of people at big

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 15:12:38 -0500

At 9:56 AM -0800 4/3/03, matthew richards wrote:
>>as you might think.  I've proposed that someone come up with a 
>>standard for whitelisting URL's, but nobody has picked up on it.
>
>maybe that's because a simple url forgery would make a such a 
>feature inconsequential. without a reliable way to authenticate 
>addresses whitelists will be useless.

I'm not sure we're talking about the same thing.  I'm talking about 
something that can go on any web site that asks for your email 
address.  At the sametime you give your email address, you also click 
on the "Whitelist" link, and it notifies your whitelisting software, 
which prompts you with the information--thus ensuring that whatever 
address the site you just signed up uses, it will get past your 
filter.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society