Subject: RE: [Asrg] Hello- and my 2 cents

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 22 Apr 2003 10:31:49 -0700

Perhaps we could get to some minimal requirements for any proposed solution:

0A) MUST actually reduce the amount of spam.

0B) MUST NOT cause wanted messages to be lost.

1) MUST be acceptable to end users, both senders and receivers.

2) MUST be acceptable to all parties required to deploy infrastucture in
order to support it.

3) MUST be robust in the face of minimal effort couterstrategies on the part
of spam senders.

The 'minimal effort' clause meaning that a proposal need not be completely
foolproof but should certainly not increase costs for the defender that are
higher than those of the attacker. So proposals for legislative and
litgation based approaches are acceptable even though there is a well known
counter-strategy 'move abroad' since that is actually a high cost
counterstrategy.

So far the commonly proposed solutions that we keep seeing fail as follows:

Challenge/Response
	Fails criteria #1, this proposal is simply unacceptable to many
senders who receive unwanted messages. It is also unacceptable to many
receivers since the wanted mail loss rate is very high - at least on the
anecdotal evidence we have to date. I would like to propose that any further
proposals on this topic be acompanied by empirical measurement of that
point.
	Fails criteria #0B, This proposal is actually very unreliable when
both the sender and receiver deploy the same scheme. Challenges from one are
in turn challenged by the other, or silently discarded, or provide a way of
circumventing the scheme.
	Fails criteria #3, there is a simple couter attack that has been
used already, simply scan archives of mailing lists and forge the from
address and to address so that the messages appear to come from that list,
or from a list member.
	Fails criteria #3, another simple counter attack is to simply
install a responder tha automatically replys to to challenges. This can be
countered by use of a turing test type approach which then creates serious
accessibility issues. While these do not trouble many proponents they are a
concern to many, they are also a concern to the users of RIM and pocket PC
devices where this type of challenge is simply not possible to match.

Sender Pays,
	Fails Criteria #0, There is no evidence that suggests that the spam
senders have less motivation to send email than other parties. While it is
clear that spam becomes unecconomic at some price point it is far from clear
that this price point is lower fro spam senders than other senders.
	Fails Criteria #1, This proposal is unacceptable to the vast
majority of people who host IETF mailing lists or any other legitimate bulk
email solution.
	Fails Criteria #1, There is a built in incentive to cheat and be the
last to pay the sender charge since recipients are forced to accept email 
	Fails Criteria #2, There is no major ISP that is interested in
supporting such a scheme, in public or in private.
	Fails Criteria #2, Financial transfer systems are expensive to
maintain, whether or not the charge is convertible or not. The DNS system
currently costs 0.005 cents per read-only transaction, this amount is
several orders of magnitude less than those charged in the telephone system.
This charge is subject to a significant level of complaint. A transfer
system would cost at least double to maintain and likely an order of
magniture. The lowest realistic cost that could be charged for maintaining a
simple ledger based system is $0.05 cents, a level that would render many
existing Internet uses impossible. It would cost $350 a year to run a
mailing list with 100 subscribers with 20 posts a day.
	Fails Criteria #2, The above calculations are for a system that has
no protection against fraud. Digital signatures etc significantly increase
the cost of any solution, whether or not secure hardware is used. 
	Fails Criteria #2, There are well over 1 billion emails sent per day
to AOL alone. At the above chaging rate that would mean a cost of $180
million per year.
	Fails Criteria #3, There is a simple method of counterattack, simply
pay the money.
	Fails Criteria #3, Financial tranfer systems are likely to be the
target of fraud, both to obtain stolen credits and for direct financial
gain.

Blacklists
	These also fail, but we all know that, that is one reason that spam
has suddenly become a live issue again, the spam senders are simply to big a
problem and the scaling problems of blacklists are significant.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: <[email-masked]>
Date: Tue, 22 Apr 2003 14:04:21 -0400

Hey Phillip:

That looked kind of Asimovian to me.  

Without going into the kind of detail that bogs this list down everyday with
'angels on a pin' discussions:

There is no way that any solution will be created that doesn't place some
kind of burden on BOTH senders and receivers.  The lack of a burden on any
side is what has caused spam, ergo some burden should help.

As much as challenge/response is imperfect, its burden on both parties drops
as it is used by more people.  Initially C/R systems require some headroom,
but since I've been using one it has improved my email experience 100%.
Even my old newbie relatives can figure it out.  The first fax machine was
worthless, the second made the first valuable and now with the ubiquity of
faxes they are transparent.  Used a telex lately?

Filtering does not work, otherwise there would be no spam by now since all
major commercial efforts are filter-based.  And Paid Sender models have no
traction.  If C/R models can be simplified and sufficiently secure it would
seem that they are at least worth a try.

Understandably the folks who control the architecture are concerned that C/R
can be hacked, requires too much overhead, learning curve, some dropped
messages, etc.  However, could it possibly make it worse?  I don't think so.

Let's not assume that everyone is that incompetent that they can't make this
work.  And spammers don't respond and won't respond to auth requests.  If
you would like to check my logs I'll show you. 

dave
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hallam-Baker, Phillip
Sent: Tuesday, April 22, 2003 12:32 PM
To: 'Kee Hinckley'; Murali Krishna Devarakonda
Cc: ASRG @ IETF
Subject: RE: [Asrg] Hello- and my 2 cents

Challenge/Response

Sender Pays,

Blacklists

---

From: Dave Crocker <[email-masked]>
Date: Tue, 22 Apr 2003 12:03:00 -0700

apc> There is no way that any solution will be created that doesn't place some
apc> kind of burden on BOTH senders and receivers.

I found myself reading and re-reading this sentence.  On the one hand,
it seems blindingly obvious.  On the other hand, I think we have been
failing to see and discuss its implications very carefully.

Folks in the security world often cite the direct correlation between
strength of security and inconvenience to users.  I have mixed
feelings about that assessment, but at least it attends to a key point
in making any system practical.

We need to do the same.  Proposals need to includes discussion of the
effort and impact on the various participants in the service, such as
originators, recipients and operators of intermediaries.

(I'm not responding to the details of analysis in the rest of your
note, because I'd like us to focus on the importance of this
meta-issue first. It happens that I disagree with some of your
details, but am struck by the likely "efficiency" in a
discussion/debate about a proposal, if we focus on the perspective you
raise.)

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: J C Lawrence <[email-masked]>
Date: Tue, 22 Apr 2003 12:44:48 -0700

On Tue, 22 Apr 2003 12:03:00 -0700
Dave Crocker <[email-masked]> wrote:

>> There is no way that any solution will be created that doesn't
>> place some kind of burden on BOTH senders and receivers.

> in making any system practical.

I tend to think of this in simple terms:

  Email communication in trusted environments (eg a company) should
  remain as trivial and ad-hoc as it is today.

  Achieving trusted email in untrusted environments may require more
  pain and hassle.

--
J C Lawrence
---------(*)                Satan, oscillate my metallic sonatas.
[email-masked]               He lived as a devil, eh?
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 22 Apr 2003 22:56:26 -0400

>   remain as trivial and ad-hoc as it is today.

Does "within an ISP" count too?  I'm just wondering what percentage 
of email users work in companies (with internal email systems) 
compared to the personal users and people who don't have a corporate 
mail system.  My gut tells me the latter is larger, which could be a 
problem.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: J C Lawrence <[email-masked]>
Date: Tue, 22 Apr 2003 21:18:13 -0700

On Tue, 22 Apr 2003 22:56:26 -0400 

> Does "within an ISP" count too?  I'm just wondering what percentage of
> email users work in companies (with internal email systems) compared
> to the personal users and people who don't have a corporate mail
> system.  My gut tells me the latter is larger, which could be a
> problem.

I have dealt with a number of startups, small companies, traveling
executives, and even a local county government department who use
Yahoo/MSN/Hotmail for their organisational email.  In those cases the
fact that the addresses were "public" was an explicit and obvious
assumption with everybody from the secretaries on to the receptionist.
THis was usually expressed or talked of in terms of email to those
addresses being not quite so reliable, or timely, and more likely to be
lost or overlooked in the noise of spam and other personal messages.

  ObNote: I work in the Silly Valley (actually I don't, I'm looking for
  a job, but bear with me) and its possible that people are just
  different here, but I kinda doubt it.