Subject: Re: [Asrg] How to defeat spam that uses encryption?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 1 Apr 2003 15:53:35 -0800

Can we discuss authentication approches that are actually being proposed
rather than straw men?

Whitelists in their own have limited value. Spam senders have shown that thy
will forge headers to bypass them. So een though I know hotmail has rate
limitting that makes it hard for people to spam through a whitelist to acept
all email with a hotmail from address would fail miserably.

Authentication on its own can have some effect. The spam senders are shy
types who have shown marked reluctance to disclose their identity. However
spam senders can get authentication redentials by setting up front
corporations.

So a combination of the aproaches is needed. Moreover you still need a way
of handling non authenticated mail which gets back to content filters.

 -----Original Message-----
From: 	mathew
Sent:	Tue Apr 01 15:36:14 2003
To:	[email-masked]
Subject:	Re: [Asrg] How to defeat spam that uses encryption?

On Tuesday, Apr 1, 2003, at 11:56 US/Eastern, Chuq Von Rospach wrote:
> as a friend of mine who's a computer security expert keeps reminding 
> me, authentication is not authorization.

Correct, and furthermore identification is not the same as either 
authentication or authorization.

This is why SSNs are such a problem. People try to use an 
identification number for authentication and authorization.

mathew

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 1 Apr 2003 19:37:40 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

>                                             ... The spam senders are shy
> types who have shown marked reluctance to disclose their identity ...

Once again, for the umpteenth time, that is clearly false for almost
all spam.  Almost all spam is some sort of advertising.  In very few
cases does it makes sense to advertise via mail to strangers products
or services without providing an identity of some sort.  That is why
almost all spam contains a URL, SMTP mail address, telephone number, or
post address at which a party responsible for the spam can be contacted.

The only shyness that almost all spam senders might have about their
identities involves their SMTP envelope or header From values.  That
spammers really are shy about those values is an article of faith not
supported by evidence.

I think there is clear and convincing evidence that most spam carries
From values that are owned by the spam sender and that would be properly
authenticated by any authentication protocol usable by free mail providers
and sloppy ISPs during at least the start of a spew of spam.

Free mail providers and sloppy ISPs would need to arrange authentication
without significantly more effort by users than is now required to
obtain a throw-away account.

All of this is why SMTP-TLS, SMTP-AUTH, SUBMIT, S/MIME, and PGP provide
authentication of about all of the flavors you might like, but have
had no effect on spam.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg