Subject: RE: [Asrg] Turing Test ...

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 2 Apr 2003 19:54:34 -0800

A paper I am writing addresses these schemes:

The problem with schemes of this sort is that they reduce the spam problem
for the user by increasing it for everyone else. Each time someone who is
not on the 'whitelist' of approved senders tries to send an email to the
user they will receive a message that according to the definition used here
is spam. The challenge message is indiscriminate and unwanted. It is also
unnecessary and not that effective, as we shall see later this type of
simple challenge/response scheme is easily evaded and there are much better
methods of checking who sent a message.

The thing I find most objectionable about the users of these schemes is the
smug manner in which they will loudly proclaim that they have never had
anyone complain. Of course there are no complaints when the people who find
these schemes objectionable can't talk to you without using them.

I recently got a message from a student asking me for some information on a
protocol I had designed. While I rarely have time to respond to these
requests in this case I did and spent ten minutes or so answering the
question, even though the student could easily have found the information
themselves by using the Web and reading the specification for themselves.
After taking this trouble however I received a message from the student's
mail service asking me to prove I am not a spam sender by answering a
challenge, this after she was the person who had originally asked for help!

If someone sends an email they should accept a reply from the same person
without this type of performance. Equally nobody should ever be asked to
respond to a challenge the second or third time they send a message to the
same person.

These challenge/Response schemes are a minor irritation today when few
people use them but expect resistance to them to grow if the number of users
increases. After receiving the fifth spam challenge I was irritated enough
that my policy now is to never respond to them in any circumstances. If
someone I need to get in touch with uses this type of scheme I send them a
fax or a Fed-Ex, making sure to put in a covering note, 'Tried to send this
by email but you need to fix your email'.

> -----Original Message-----
> From: Claus Assmann [mailto:[email-masked]]
> Sent: Wednesday, April 02, 2003 9:48 PM
> To: [email-masked]
> Subject: Re: [Asrg] Turing Test ...
> 
> 
> On Wed, Apr 02, 2003, Art Pollard wrote:
> > 
> > Why not allow the e-mail client to pose a Turing test to 
> anybody that is 
> > not in its whitelist?
> 
> Depends on your whitelist.
> 
> A group of people is supporting some open software so we get a lot
> of questions via e-mail. A reply can come from various sources.
> Which of the sources do you whitelist? Whenever I get a "TMDA"(?)
> challenge as a response to my reply I delete it. If I knew in advance
> that the person who asked the question uses such software I wouldn't
> waste my time to provide free support for them.
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 09:13:41 -0800

> Cryptography isnt everything and digital signatures is hardly 
> the only 
> alternative to challenge/response and as has been pointed out 
> many times, 
> certificates do not provide much more then that somebody went 
> into trouble 
> of getting it, 

And so you should not presume to put them to the trouble of
taking special measures to get an authentication credential
just for you...

The authentication provided by web issued certificates is limited,
but it is a lot less limited than that provided by challenge response
which is very easily bypassed. Just set up a bot to reply to the other 
bot.

		Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Apr 2003 09:52:22 -0800

> On Thursday, April 3, 2003, at 06:55  AM, [email-masked] wrote:
> 
> > Cryptography isnt everything and digital signatures is 
> hardly the only
> > alternative to challenge/response
> 
> it is if your company sells encryption stuff and digital 
> certs... (grin)

It might be if that is the ONLY thing your company does.

I tend to look at what the customer wants, which in this case
is to stop spam, rather than what we might be starting with.

		Phill