Subject: Re: [Asrg] New take on emerging idea. (yet another C-R system?)

From: "John Constantinescu" <[email-masked]>
Date: Mon, 07 Apr 2003 19:01:59 -0600

>John Constantinescu <[email-masked]> wrote:
> > The minor change which I proposed shifts the burden of challenge
> > formation from the server to the user. the challenge has become not
> > just a challenge, but a first return COMMUNICATION from the user. And
> > anyone seeking COMMUNICATION with the user will have no problem
> > responding to the challenge.
>
> > I guess the other major problem with Challenge-Response systems is
> > handling lists(not sending challenges to them, yet not blocking them
> > either), but I think I have that solved as well. I will update the
> > plan as soon as I am sure.  www.pontifier.com -John

>You need to look at TMDA more -- it covers, addresses, and exceeds these
>areas.
>J C Lawrence

I had never heard of TMDA brefore, but I can tell you now why it will not 
work, and mine will:

TMDA (Tagged Message Delivery Agent) seems not to address 3 main advantages 
of my system.
1. The confirmation messages are auto generated. (versus user created in my 
system)
A thousand different types of user generated tests would be *almost* 
impossible for a spammer to create an automated response to. the sample test 
I got from the TMDA site could be circumvented with just a simple automated 
reply.
2. TMDA is a program, not a philosophy (like mine is), and thus has limited 
potential to achieve the near 100% penetration into varios systems(hotmail, 
yahoo, aol, etc)needed to SOLVE the problem.

3. This seems like a complex system, not very usable for a new internet 
user. wheras my system would be easy for a new internet user to understand. 
(www.pontifier.com/example2.html)

As for the mailing list deal. here is what I had alredy writen when I saw 
the TMDA site. it is similar, yet less complex, and possibly just as 
effective as the Dated Address system they employ:

At the service provider when I want to add a mailing list, I use a slightly 
different address(auto generated giberish, or a number added to my main 
address), that will only be used for that mailing list. the address is fully 
functional(can send and recieve), but is protected by only content based 
filters, that look at from, to, cc, and subject lines to create a content 
based filter for that list (if wanted).

If I want to stop recieving the list I just cancel the new address at the 
provider. this is painless if I only use this new address for this list, and 
still prevents people from EVER seing their blocked email.( see bf skinner)

It has the added advantage of sorting many lists from each other.

I realy think I have the solution. does anyone know of a system that works 
like mine does?:
user customizable challenges, philosophicaly grounded(could be applied cross 
platform, webmail, etc), easy for a newbie, no Spam box, and can handle 
mailing lists.

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John Constantinescu" <[email-masked]>
Date: Mon, 07 Apr 2003 21:02:07 -0600

Thank you Everyone.
I have leared a lot today.
If I learned this much everyday my head would explode.
Thank you.
John

---

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 11:57:06 -0600

>From: Chuq Von Rospach <[email-masked]>
>On Thursday, April 10, 2003, at 10:24  AM, John Fenley wrote:
>
>>Why give someone a key at all?
>>A consent token is like a temporary whitelist(with the obvious diference 
>>that a token can be used by a different sender), so why not do temporary 
>>whitelisting?
>
>the address you send the consent to may not be the address the reply comes 
>from. Think about mailing lists, responses from amazon.com or other online 
>services, etc. You want the consent in the token, not in the address. You 
>may very well not know the address when you give consent.

I think my choicelist system works very well under this situation.
www.pontifier.com/database.html

John Fenley

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.  
http://join.msn.com/?page=features/virus

---

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 13:24:26 -0600

>From: J C Lawrence <[email-masked]>
>On Thu, 10 Apr 2003 00:38:28 -0700
>Brad Templeton <[email-masked]> wrote:
> > Easiest solution -- all private mail comes from an unfiltered address.
>
>People get attached to their email addresses.  JoeSixpack humans have
>real problems with the mental distinction between role addresses (which
>is essentially what you are advocating) and their personal identity.
>I'd rather not go down that path if we don't have to.
>
> > You want to rescind consent to somebody or mail containing some token?
> > Just program your mailer to reject their mail.  The rest of the world
> > does not need your consent to mail you, at least not for person to
> > person mail.  This is a hard truth that some people in the anti-spam
> > community don't wish to embrace, unfortunately.
>
>Excellent point.

I totaly agree!
John Fenley

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online  
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

---

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 14:00:03 -0600

>sorry, I couldn't read the entire documents. The click ads at the top were 
>giving me freaking headers with their flashing and gibbering.

sorry- free host- get what ya pay for-

>But it looks to be a central repository. Any central database is going to 
>be subject to attack and subversion, because it's a single point of access 
>-- crack the database, you get access to all that stuff.

The database is designed to be public.
each entry is the responsability of the person who made it.
Multiple backups are part of the system. there are special provisions for 
hijacked accounts/ unusual behavior.

>You also have to worry about scaling. Even if these things are done on an 
>organizational level, it builds quickly -- what works for my home machine 
>may not work for one with 1000 users, or 10000, or 100000. It gets nasty 
>quickly.

I'm sure that it could be done. perhaps it couldn't run on my home pc, but I 
cant beat garry kasparov with my pc either.

>And finally, you create a huge issue of authentication and authorization. 
>Which, given this system is about authentication and authorization, makes 
>it seem somewhat sideways. The user is going to have to keep 
>authorization/authentication info so they can go and generate 
>authorization/authentication info? And what if it leaks? If my MUA 
>maintains my whitelisting data and someone cracks my machine, I'm screwed 
>(but I'm screwed anyway). If someone cracks a server with 10,000 users 
>worth of data on it....

Your Mail User Agent only stores the info for you.
like you say if it goes down youve got bigger problems.
John Fenley

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*.  
http://join.msn.com/?page=features/featuredemail

---

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 15:47:41 -0600

>On Thursday, April 10, 2003, at 01:43  PM, John Fenley wrote:
>
>>If a system works well to begin with: Stops spam, ignores mailing lists, 
>>allows personal contact, and uses a single address with no modification. 
>>why would you need customisation features.
>
>because things like "allow personal contact" or "ignores mailing lists" are 
>complexities that are going to need flexibility to implement. Because some 
>users are going to want it to work the way they want, not the way we think 
>they should use it.

I say "Offer it and see if people are happy with it."
Flexibility comes from seeing problems and adapting.

"You can't please all of the people all of the time."

>I really think there's going to be a tool here with two modes, a simple 
>mode and a wizard mode. In simple mode, it does a few things easy and well. 
>Users who want more control can flip a switch and see other options to use.

That could be, but does not affect the validity(if any) of a particular 
solution.

>
>>In my mind customization features are a symptom of loose thinking: "I 
>>don't know exactly how this should work,
>
>none of us know exactly how this works yet, actually, but more important, I 
>see it instead as a way to handle a wide variety of needs and requirements 
>the way users want them handled. I try to force software to do waht 
>customers want the way customers want it done, not force customers to do 
>things in ways that make it easy for the software...

I have had the system in mind for 5 days now, and known exactly how it will 
work. Each time I have updated it, it is because I know what it can do, and 
what it can't. I adapt the idea.

I think I have fixed weaknesses mentioned in previous versions. This system 
does not force anyone. now it merely gives the option of updating the 
whitelist easily (with some feedback to list operators).

If you could press 1 button to update your whitelist would you do it?
Would you add that button to your MUA?
John Fenley