Subject: RE: [Asrg] RE:ASGR 8a Use of certificates

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 08:31:02 -0800

> 21st Century and the later American BlastFax junk faxes were less
> traceable than any spam.  With spam you always have the IP address of
> the SMTP client and.  Unless your fax machine does caller-ID, you have
> paid your telephone company for caller-ID, and the junk faxer is not
> using any of the several tactics that turn off caller-ID (e.g. a PBX),
> you will have no idea from where a junk fax comes.

This is not actually the case. The AID information can be retreived
after the fact. its not like the days of the old Strouger exchanges
where you had to get to the relay before the call ended.

Caller-ID blocking does not stop the AID information and the information
is in the SS7 network in any case. there is no difficulty tracing
back junk faxes, even if they come from a pbx which does not have
an outgoing line number, the fax can be traced to the T1 line by 
the SS7 switching ID. 

Of course you can take Vernon's word over the advice of someone who
has done that type of stuff and whose company is in the SS7 switching
business. It is pretty interesting though that every time someone 
menti0ons some form of authentication Vernon comes out with a categorical
statement that is completely untrue. Then he repeats it again and again.
Either this is a theological point for Vernon or he is a troll.

		Phill 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 10:44:35 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> an outgoing line number, the fax can be traced to the T1 line by 

Of course there are ways to trace calls, but in practice they are not
available to the target of a junk fax.  The operator of a FAX machine
has no practical way to obtain any idea of the geographical or telephone
network location of the FAX machine that sent a FAX.  Even when the
fax header is valid and contains the telephone number of the sending
fax machine, it is impractical for most targets of junk faxes to trace
that number to the source.  When I've tried, I've quite understandably
been told by telcos to get a subpoena.  Given the $500/$1500 limit on
TCPA fines, that makes even a present and correct telephone number
effectively untraceable.

> Either this is a theological point for Vernon or he is a troll.

What is untrue about my claim that in practice, the operator of a FAX
machine has no practical way to trace a junk fax to the sending machine?

What is inaccurate about my main point that the practical untracability
of junk fax senders's fax machines does not prevent tracing junk faxes
to the responsible party and convincing that party to stop even when
it is nominially overseas?

The relevance of this point is that it shows that email authentication
is not required to trace almost all spam to the responsible party.

Email authentication cannot tell you whether an incoming mail message
from a stranger is spam.  This fact is related to the fact that perfect,
unforgable, always present caller-ID bits would not stop junk faxes
and are not necessary to whack junk faxers such as 21st Century and
American BlastFax.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: matthew richards <[email-masked]>
Date: Thu, 3 Apr 2003 10:36:23 -0800

all of what you say i'm sure is true, but look at what you are saying 
from the average joe's perspective- i've never even heard of SS7... 
ok, i've just received a junk fax and i have no idea where it came 
from... how do "i" find out. the answer is i don't because i don't 
have access to the SS7 switching ID? or how to use it, because i have 
no idea what AID information is, because i've never heard of a 
Strouger exchange? so would you still say that there's "no 
difficulty" in tracing junk faxes?

ps. and what in gods name is a pbx? ;)

-------------------------------------------------------------------------
there is a point in every persons life where they become 
overqualified at something.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 3 Apr 2003 12:54:39 -0700 (MST)

> From: matthew richards <[email-masked]>
>

> nb idea what AID information is, 

I don't recall that one, and Google doesn't help.  I wonder if it was
a typo for AIN.

Assuming it means "magic and comprehensive information easily available
anyone with a clue about SS7 and access to a CO," it does not affect
my point that it's all irrelevant to the useful and practical traceability
of junk faxes.

>                                  because i've never heard of a 
> Strouger exchange? 

Older than ancient mechanical telephone switching equipment that
required people to physically look at things to trace a call.   THis
required keeping the caller talking for a long time while people
scurried around central offices (COs).
Today, if someone is prepared to trace incoming calls, they've got you
before the instrument rings.

But this is also irrelevant to tracing junk faxes, because (almost)
no one has the FBI or even just a pen-trace sitting on a fax line
merely to trace the source of junk faxes so that they can file a TCPA
action at $500 or $1500 per fax.

> ...

Private branch exchange or a chunk of a telephone switch commonly used
in businesses with mroe than a small handful of phone lines.
It turns out that caller ID information for a call can be the
responsibility of the originating PBX.  For some strange reason, the PBXs
used by telemarketers sometimes don't offer good caller-ID information.

This is relevant to the claims that authentication has anything to do
with stopping spam.  (Some) theory says that the central administrated,
heavily controlled (compared to the Internet) telephone system ought
to be able to label every call with its origin and reliably deliver
that label to the recipient of the call.  "In theory there is no
difference between theory and practice, but in practice there is."

Wouldn't it be swell if we could limit consideration of spam solutions
based on bunches of assumptions that are dubious or false?

Does someone have a box score of spam "solutions"?  I've been lazy with
my scorecard and have only these contenders

  - Verisign certs
  - DNS records
     -- saying the SMTP client is virtuous.
     -- saying the SMTP client is a properly configured MTA.
     -- containing some sort of cert or key proving virue.
  - word filters/scorers (e.g. "Bayesian")
  - aggregate characteristic scorers (e.g. SpamAssassin)
  - body filters (e.g. Postini, Brightmail, DCC, Razor/Pyzor/Cloudmark)
  - headers asserting virtue (e.g. Habeas)
  - challenge/response systems
  - IP address, domain name, cert or other whitelists
  - IP address or domain name blacklists
  - opt-out lists

My scoring says that some representatives of six of those classes
might do some good, but other representives of those six and all of
the other classes are variously useful only when double digit false
positives are ok, hopeless, or snakeoil.