Subject: [Asrg] RE:ASGR 8a Use of certificates

From: "Tom Thomson" <[email-masked]>
Date: Wed, 2 Apr 2003 16:47:18 +0100

Vernon wrote:

>It's discouraging that people are still saying that authentication
>would fix spam years after common MUAs (e.g. Netscape) can send and
>check signatures and/or keys and SMTP-AUTH, SUBMIT, and SMTP-TLS are
>universally available.

What I find discouraging is the conytinual dismissal of possible 
solutions based on little of no apparent logic (and usually by
people who have an alternative solution to push).

SMTP-AUTH is specifically desgigned for a closed trusted environment 
(read the RFC - the words it uses are "within a trusted enclave") so 
it's not at all surprising that it hasn't been deployed to solve a 
problem in a wide-open uncontrolled environment. Do SUBMIT or 
SMTP-TLS have relevance to our issue any more than SMTP-AUTH does?  I
think not!

Although some MUAs have signature/checking capabilities, rather a lot 
have no such capability.  Do any of the webmail systems have such 
capability?  Even where an MUA has the capability, is it usable by 
the average user?  Plainly and simply, the signature and checking 
capabilities of current MUAs are not designed to address our issue.

So the arguments quoted above are completely irrelevant to the 
solution they were used to attack.

Let's try to be constructive about the various proposals made, 
instead of destructive.  

Tom Thomson

Post Script:   I suspect vernon will be very unhappy if the group 
ends up supporting approaches other than one particular one;  but 
I'm not going to decry that particular one because it wasn't 
invented here, and I just wish he would show other members of this 
list that same courtesy. We are going to need to apply lots of 
partial solutions and not reject anything that is useful just 
because it will not solve more than 90% of the problem on day one.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Wed, 2 Apr 2003 06:18:25 -0800 (PST)

<rant>
Vernon is always critisizing (and not only on this maillist). In my review 
of March discussions (I'v at over 1,200 messages which is 50%...) he 
critisized anything and everything - some of his points are quite correct 
and he always tries to find as many bad points about every proposal as 
possible - this comes quite handy when I'm looking what to put in 
"Objections" section which I'm creating for every proposal. Hopefully if 
I'm done by the end of the week you'll see what I mean (I may not have 
enough time as I'm leaving for ARIN conference at the end of the week and 
have lots of other work keep my net up while I'm gone - and this ASRG 
review already took more then 20 hours... - if not I'll finish while at ARIN). 

However I do believe that while critisicism is in places usefull, a more 
constructive approach would be a lot better especially when someone wants 
to make good contribution to this group. And overall for March while it 
may seem that we have not achieved that much there were offered LOT AND 
LOT of ideas on the list, its really amazing how much an area we were able 
to cover. Anybode who have listened to the list should have picked up 
something (lot more then just something!) usefull over the month.

Still it was amazing finding Vernon critique on absolutly every thread...
</rant>

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 15:36:41 -0700 (MST)

> From: "Tom Thomson" <[email-masked]>

> ...

I think that caveat about SMTP-AUTH is merely a statement of the fact
that talk about authenticating strangers is nonsense.  Authentication
is only half of authentication and authorization.  Does it make sense
to trust everyone outside your trusted enclave?--of course not!  You
cannot know whether a stranger, whether authenticated or not, sending
you mail is also sending copies to 50,000,000 of your closest friends.
Authentication is meaningless outside "a trusted enclave."

> capabilities of current MUAs are not designed to address our issue.

I think that is wrong, because I think most people use Netscape, Outlook,
or Outlook express.  I know Netscape has long handled cert-signed mail,
because I've tried it.  I've not tried Outlook (Express), but I've the
impression they also can do it.

> because it will not solve more than 90% of the problem on day one.

Just for my own information, could you let me know which approach I
prefer?

I can't think of anything that might qualify as a solution to spam
except what I think is inevitable legislation that will tax or license
bulk mail.  That will not really solve the spam problem but only change
the spammers and limit the total spam in most mailboxes.  I do hope
that the DCC might help with spam after that legislation, but it does
not qualify as a solution now or then.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric S. Imsand" <[email-masked]>
Date: Wed, 02 Apr 2003 16:45:24 -0600

>not qualify as a solution now or then.
How will legislation help anything?  As soon as you do that, all of the 
spammers will move to other countries, removing themselves from 
US/Canadian/British/Whoever's jurisdiction.  In other words, unless 
everyone is prepared to cut off China and Russia from the rest of the 
Internet, legislation will not solve the problem.

Eric

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 2 Apr 2003 18:53:42 -0700 (MST)

> From: "Eric S. Imsand" <[email-masked]>

> US/Canadian/British/Whoever's jurisdiction. ...

Do you really think that the people who would be subject to legislation
would move offshore?  

If using foreign computers would be a shield, then a new American
Blastfax could use FAX machines (computers) in China and VoIP to dial
U.S. fax machines and escape the FCC and the TCPA.

Have you been following the FCC's efforts against the "survey" junk
faxer named (I think) 21st Century?  It was supposedly located in
England, but that didn't stop the FCC from getting large judgements.

(I wouldn't say legislation will "help", but that it will change things.
I think only the DMA would say that legislation will help because it
will make spam usable for the Fortune 50,000.)

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 3 Apr 2003 14:35:09 +0200

> U.S. fax machines and escape the FCC and the TCPA.

Traceability is the keyword.
If I can hunt down the originater I can sue him. (Ab)using FAX machines
anonymously is rather hard, hacking a few workstations is easy.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 08:18:21 -0700 (MST)

> From: Markus Stumpf <[email-masked]>

> anonymously is rather hard, hacking a few workstations is easy.

Yes, traceability is the keyword, but the rest of that is mistaken.
It is just as easy to abuse a fax machine as a mailbox.  In either
case, the abuse consists of sending junk.

21st Century and the later American BlastFax junk faxes were less
traceable than any spam.  With spam you always have the IP address of
the SMTP client and.  Unless your fax machine does caller-ID, you have
paid your telephone company for caller-ID, and the junk faxer is not
using any of the several tactics that turn off caller-ID (e.g. a PBX),
you will have no idea from where a junk fax comes.  In practice, at
least one of those conditions is not met, and so you have no idea of
the source of any fax.

The fact that junk faxes are much less traceable to the originating
computer than spam does not affect success of the FCC or various
private organizations in tracing them to their sources.  That an
unsolicited bulk email message comes through an open proxy is as
irrelevant to its useful traceability as the fact that even with
legitimate faxes you probably have no clue about the telephone number
of the sending fax machine.  It might not even have a telephone number.

The traceability that matters is that the 21st Century junk included
their name and 1-900 numbers that suckers were supposed to call.  The
relevant traceability of the ABF junk was in the names, addresses,
and telephone numbers of the businesses that hired ABF to advertise
them.  That is why ABF is out of business and the last I heard,
21st Century was fighting 6 or 7-figure fines, despite their lack
of technical traceability.

This illustrates a major problem with this and similar efforts to deal
with spam.  Most of us are interested in hammering computer nails,
and so we see the spam problem purely in those terms.

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 3 Apr 2003 17:47:38 +0200

> least one of those conditions is not met, and so you have no idea of

Maybe your problem is that the USA is not the world (at least not yet).

And also in the USA it should be possible to trace down a caller
with a calling trap.
In countries where you have a more telco centric (i.e. one telco)
infrastructure hunting down callers is rather easy.
So spammers may have no interest to change location to countries where
they can be more easily hunted down.

Abusing an open proxy in Korea (e.g.) is almost secure from any backtraces.
Besides the ISPs don't answer to anyone chances that they log/keep
IP connections and still have the data after a few weeks are zero.

	\Maex