Subject: Re: [Asrg] RE:ASGR 8a Use of certificates

From: "Tom Thomson" <[email-masked]>
Date: Mon, 7 Apr 2003 16:14:36 +0100

Vernon Schryver <[email-masked]> wrote:

>> Although some MUAs have signature/checking capabilities, rather a lot
>> have no such capability.  Do any of the webmail systems have such
>> capability?  Even where an MUA has the capability, is it usable by
>> the average user?  Plainly and simply, the signature and checking
>> capabilities of current MUAs are not designed to address our issue.
>
>I think that is wrong, because I think most people use Netscape, Outlook,
>or Outlook express.  I know Netscape has long handled cert-signed mail,
>because I've tried it.  I've not tried Outlook (Express), but I've the
>impression they also can do it.

Sure they have the capability.  But it's an unusable nightmmare, maybe
usable for you or for me or for most asrg list members, but usable by the
average email punter (the one who may fall for the spammer's scam)? - No
way.
Anyway, we have to question whether certificates and signatures are the best
method of authentication for the spam reduction job (I'm fairly neutral).
The chain of IP addresses in Received From headers is not much different in
principal from the chain of signatures in a certificate chain. Rejecting
mail with a clearly forged certificate and rejecting mail with a clearly
forged Received From header are not much different. Currently no-one does
either.

>> Post Script:   I suspect vernon will be very unhappy if the group
>> ends up supporting approaches other than one particular one;  but
>> I'm not going to decry that particular one because it wasn't
>> invented here, and I just wish he would show other members of this
>> list that same courtesy. We are going to need to apply lots of
>> partial solutions and not reject anything that is useful just
>> because it will not solve more than 90% of the problem on day one.
>
>Just for my own information, could you let me know which approach I
>prefer?

A combination of DCC plus arbitrary blacklisting based on apparent
unverified source address, if
http://www.rhyolite.com/anti-spam/freemail.html is a reliable indication.
Now that many free providers implement rate limiting (I wish go.com would
implement it too - I get too much spam with authentic go.com email
addresses), it must be clear that the blacklisting them is not going to
block much spam if the source is verified - looks as if verification would
reduce rejection of non-spam at any site following rhyolite's advice.  (It's
noticeable that your site is careful to talk about "spam claiming to be from
them", apparently accepting the position that some spam is designed to
conceal its source, a point that you have consistently argued against on
this list).

>I can't think of anything that might qualify as a solution to spam
>except what I think is inevitable legislation that will tax or license
>bulk mail.  That will not really solve the spam problem but only change
>the spammers and limit the total spam in most mailboxes.  I do hope
>that the DCC might help with spam after that legislation, but it does
>not qualify as a solution now or then.

I suspect legislation is indeed inevitable and is an esential component of
any solution to the spam problem.  The current EU directive on spam
(basically: "member nations are required to bring in legislation effective
before 1 Oct 2003 to make commercial email without prior opt-in a serious
offence") is a first step. Getting China, Indonesia, Russia, and the US to
join in would help a lot since that would cover today's largest sources of
spam.  With such legislation, source identification that would stand up in
court would be rather useful - that's why I think some form of
authentication is needed to back up the legislation. Reliable detection of
fake source/path information could also provide a good filter mechanism to
supplement those which already exist.

Tom Thomson

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 7 Apr 2003 10:26:43 -0600 (MDT)

> From: "Tom Thomson" <[email-masked]>

> ...
> >or Outlook express. ...

> average email punter (the one who may fall for the spammer's scam)? - No

That seems to be another way of making the good point that "if
authentication is a good defense against spam, then why aren't even
its advocates using it all these years after it was first advocated"?

> ...

That is mistaken.  I've recent seen public statements from people
apparently not given to lies saying that their large scale filtering
includes checks for obviously forged Received headers.  Years ago, it
was common to reject mail with certain common bogus Received headers.
Do you remember the bogus timezone?

> ...

That is only part of what I do for my own mail.  If you bother to read
the words in those pages, you'll probably see I don't think that
can work for all situations.

> reduce rejection of non-spam at any site following rhyolite's advice. 

What I assume you to mean by "verification" would reject almost as
much legitimate mail with free provider addresses as simply rejecting
all mail with free provider senders without such "verification."  A
large fraction of legitimate mail with free provider envelope or header
From values is sent from IP addresses unrelated to the free provider.
Free providers tend to receive far more legitimate mail than they
send.  This is because many people send from their ISPs but receive
at free providers for various reasons including using temporary
addresses to avoid spam.  Many free provider users could not use free
provider MSAs if they wanted to because of port 25 filtering by their
dialup or other ISPs.

>                                                               (It's

That misrepresents my position.  I have said that contrary to common,
false, naive or self-serving claims, most (but not all) spam sender
information cannot honestly be said to be "forged."  I think most spam
carries envelope and header From values that the spammer leigitately
owns or owned recently enough to not be guilty of "forgery."  In
addition, because almost all spam is about advertising, very few
spammers are shy about critical aspects of their identities.

>  ....  With such legislation, source identification that would stand up in

We don't need any changes for "source identification."  The source
that matters is the organization whose name, products, or services
are advertised by spam.  As demonstrated with the TCPA at least in
the U.S., you need only convince a court a "spamvertised" organization
was not "joe jobbed."  See also the Flowers.com court case in
http://www.mids.org/mn/803/spamset.html or
http://www.google.com/search?q=%22Flowers.%2Bcom%22+spam.  The IP
address used to originate spam is like the telephone number of the
fax machine that sends unsolicited fax advertisements.  If you have
that telephone number, you can also go after its owner, but your
primary legal target is the advertised outfit.

Authentication as a cure for spam has always been and always will be
snake oil.  Like most snake oil, it does its nominal target no harm.
Unlike most snake oil, it does some real good in areas unrelated to
spam.  Like most snake oil, it is flogged by the uninformed or credulous
people who haven't checked it out and by somewhat fewer who lack scruples.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 7 Apr 2003 16:18:53 -0400

At 10:26 AM -0600 4/7/03, Vernon Schryver wrote:
>are advertised by spam.

So would you propose a law requiring that companies include that 
information in the email?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 7 Apr 2003 16:01:18 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> information in the email?

  *** OF COURSE NOT! ***

Why can't I communicate the simple, obvious fact that advertising
almost always identifies the advertiser?  

Spam identifies its perpetrator to its targets so that they can buy
whatever is being advertised.  That identification is also sufficent
in court for people with a complaint agatinst the spammer.

This is not a crackpot theory.  Title 47, Section 221 of the U.S. Code
commonly known as the Telephone Communications Protection Act or TCPA
is frequently used against advertisers that are technically more
anonymous that any spammer.  Any spam received through an SMTP server
that is not utterly broken and lame has a Received header that accurately
identifies the IP address of a computer owned by at least one party
that is at least partly responsible for the spam.  Many and probably
most junk faxes are not tagged with the true telephone number of the
send fax machine (if it has one, which it need not), with accurate
caller-ID information (since most fax machines don't record caller-ID),
or even the sender's identification required by the TCPA.  Despite
that lack of technical pointers to the junk faxer, the TCPA is regularly
used to whack them with fines ranging from $500 to millions of dollars.
For examples, see http://www.fcc.gov/eb/tcd/ufax.html

The only identification of the perps is obtained from the advertising
copy in the junk faxes and subpoenas served on them.  It is uusually
too much work and not worthwhile to involve the telcos in TCPA actions.

Thus, there is no non-technical need for any more identification of
spammers than we already have.  The only sane and honest justification
for more identification of spammers is better automated filtering of
spam....well, there are other honest but unstated and generally hidden
or denied justifications such as selling software, PKI certs, or
anti-spam snake oil.

Note that I've applied this theory in the legal system against a sender
of junk faxes.  Note also that I could go on at length about the
limitations of the TCPA and why I think it has not entirely ended the
junk fax problem, but won't unless prodded beyond endurance.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 7 Apr 2003 22:45:23 -0400

>almost always identifies the advertiser?

Because that statement bears no relationship to what I see in my inbox.

The email addresses they provide go to free web mail sites.
The web addresses they go to go to IP addresses, or to free-website 
sites, or to real sites that have an open-redirect, or to real domain 
names that are hosted on some web server in China and have whois 
information that doesn't point me to a real company.  Or in those 
cases were it might, it means calling some random phone number in a 
country on the other side of the world.

>in court for people with a complaint agatinst the spammer.

LOWRATEMORTGAGES.INFO
Registrant Organization:ibms computer
Registrant Street1:59 shanghai street
Registrant City:kowloon
Registrant Postal Code:10023
Registrant Country:CA
Registrant Phone:+905.34323423
Registrant Email:[email-masked]

Okay.  Now what?

I know, ignore that.  I should go to the web site and use that to 
track them down.  Right?  Follow the money?

Okay.   Follow that link.  After all, eventually they will give us 
enough information to nail them.

Hmm.  First thing on that page is a form.  In order to do anything I 
have to fill that form out with my phone number, address and email 
address.  And then they will send me three mortgage offers.

Okay.  So I could create a throw-away address.  Put in fake address 
and phone number information, and then I would receive three mortgage 
leads from somewhere.

And then I'd have to track down those companies and see if they are 
real, or whether they are the spammer.  Maybe they are innocent 
parties and they are just paying for leads.  That's going to take 
more tracing, more phone calls, possibly even a court order.

So.  Yes.  Eventually we can follow the money.  That is very 
different from "identification".

What good does this do to the average user on the net?  We can now 
tell them that if they hire a computer consultant to spend several 
hours of time they might be able to find out the name of the person 
who is spamming them from China.

There's identifiable, and there's *usefully* identifiable.  I don't 
buy the claim that this identifies the advertiser in any real sense. 
And this is one of the more trackable pieces of spam in my inbox.

>that is at least partly responsible for the spam.  Many and probably

Yup.  This one was clearly identified as coming from an open proxy in Brazil.

>For examples, see http://www.fcc.gov/eb/tcd/ufax.html

I know.  I've provided the FCC with a number of complaints for junk 
faxes and phone calls.  They even follow up to every report with a 
letter containing a printout of several pages on their web site.

>spammers than we already have.  The only sane and honest justification

Whoa.  Backup.  Those junk faxes and phone calls; they had a contact 
phone number in them.  I fed that number to the FCC, they look it up, 
now they have a name and address.  Obviously all I had to do was 
write the phone number down, so it didn't take any of my time.  It 
takes me about 15 minutes to fill out the form on their site, it 
takes them half an hour to an hour to process each complaint 
(according to their web site).  I assume that includes the time it 
takes to map the phone number to a name and address and compare it to 
other complaints in the database.

Now compare the amount of time it would take to track down the spam I 
just mentioned.  And add in the fact that, unlike the fax/call case, 
it needs to be done by someone technical.

Phone and fax spam provides enough information for someone's 
grandmother to file a complaint.

Email spam is hidden behind a maze of temporary identities.  It often 
isn't possible to trace if you don't respond to it immediately.  I 
don't see how you can argue that this bears any relationship at all 
to phone and fax spam.  The difficulty in tracking down a spammer is 
different by several orders of magnitude.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 7 Apr 2003 21:34:40 -0600 (MDT)

> country on the other side of the world.

Which of those cannot be traced?   For example you might pass them a
credit card number and then serve papers on the credit card factor
that tries to collect.  In an anti-junk fax mailing list, I've seen
many reports of successful applications of this tactic.  The reason
they use this tactic is that many junk faxers are just as shy about
releasing their real names and postal addresses.

> more tracing, more phone calls, possibly even a court order.

That's probably not a good example, because reports from those who
have chased mortgage broker spammers say that the spammers are paid
real money by real mortgage brokers for leads and the real brokers
are often happy to cooperate in identifying the spammer.

> different from "identification".

No, it is "identification," but it isn't point-and-click.  Contrary
to the crypto authentication snake oil, there will never be point-and-click
interfaces to mechanisms that destroy spammers.  Spammers will always
use shells and screens.  If you somehow force them to buy Verisign
certs, they'll use false names, brokers, and middle men like Domains
by Proxy.  The only effective way to identify spammers will always be
variations of "follow the money."

> And this is one of the more trackable pieces of spam in my inbox.

I agree, it is not usefully identifiable to people who are not motivated
by something more than a single $500-$1500 fee.

> Yup.  This one was clearly identified as coming from an open proxy in Brazil.

Again, a spammer's IP address (or any conceivable crypto authentication)
is about useful as the telephone number in a TCPA case.  In many
and perhaps cases they are useless.  You have to follow the money.

> letter containing a printout of several pages on their web site.

Until the Colorado do-not-call law went into effect in July, 2002,
and my junk faxes abruptly stopped, I had trained the FCC letter
openers to respond with junk paper copies of the TCPA and so forth
only every half dozen monthly packages of paper copies of junk faxes.
I suspect from the affidavits and other hints that the FCC occassionally
asked me to sign that our packages and reports were significant in
the $M actions against 21st Century.  

> now they have a name and address.  ...

Do they really?  Don't some 1-900 phone system outfits shield their real 
customers?
Why couldn't the FTC do the same with spam that the FCC does with
junk faxes?  Hasn't the FTC already done exactly that with several
dozen spammers?

> it needs to be done by someone technical.

No one technical (in the TCP/IP or SMTP sense) is needed to follow a
credit card number.  On the other hand, the identification in the 21st
Century junk faxes consisted of a 1-900 phone number.  Could you have
done anything with that?  I couldn't.

I was also unable to convert Denver area phone numbers on some junk
faxes to addresses.  I suspect that subpoenas or other legal crowbars
would have convinced the local telco to help, but I found that barrier
too high for a mere $500-$1500 pay off.

> grandmother to file a complaint.

So does spam.  Your grandmother could print the whole spam with
headers and treat it as I treated 21st Century's junk faxes.
I didn't need to know the next to nothing I know about 1-900 
phone numbers, ANI, and so forth to mail paper copies to people
who do have clues, can issue subpoenas, and ask me to sign
affidavits saying that I'm in charge of a fax machine and that
21st Century did not have permission to send their junk.

> different by several orders of magnitude.

That is not true if you normalize the difficulties for both to the
common person.  A 21st Century junk fax had no identification except
1-900 numbers.  I don't know about you, but for me it's "several orders
of magnitude" easier to chase SMTP headers and IP addresses than to
convert a 1-900 number into an address for sending papers for small
claims court.

There's another lesson in the TCPA and junk faxes that is waiting to
be learned by those who are not stuck on peddling authentication snake
oil.  The TCPA requires that all faxes carry an equivalent to a banner
that identifies the sending fax machine.  If you've seen many junk
faxes, you know that many junk faxers ignored that requirement.  If
you have a fairly recent fax machine, you've surely configured it to
reject some junk faxes based on valid or invalid source telephone
numbers such as "@".

---

From: [email-masked] (Claus Färber)
Date: 08 Apr 2003 12:20:00 +0200

Vernon Schryver <[email-masked]> schrieb/wrote:
> whatever is being advertised.

Not necessarily:

. Spam advertising premium service phone numbers: All you need is the
  phone number. Often these are registered for foreign or non-existent
  addresses. You would have to track where the money goes to catch the
  spammer -- something that's difficult even for governmental agencies.
  (And that's if the phone provider cooperates, which is not always the
  case.)

. Political spam: The spammer is content when the message is delivered.

. "Probe" spam: Used to test whether addresses are valid (all you need
  is a mailbox; not all mailboxes are trackable to the owner).

Claus
-- 
http://www.faerber.muc.de/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 08 Apr 2003 10:36:57 -0400

> in court for people with a complaint agatinst the spammer.

  If you have damages which match the legal definition of damages.

...

  Doesn't apply to my spam problem.

> Any spam received through an SMTP server that is not utterly broken
> and lame has a Received header that accurately identifies the IP
> address of a computer owned by at least one party that is at least
> partly responsible for the spam.

  The IP then resolves to an address in China, for the majority of
spam I'm seeing.

  Hmm... I've got a contact at the Chinese embassy.  I'm going to try
to talk with him about it.

> spammers than we already have.

  The cost of going after them is still prohibitive for the average
individual or company.  Even if they are traceable, the spammers hide
behind layers of shell corporations, all of which have been drained of
assets.

  One solution would be to have a central organization which "buys"
the spam complaints from people.  They could operate like a collection
agency, so that by buying complaints from 1000's of people, it would
be worth their time to go after the spammers.

  This kind of agency is also known as the "government", or "police".
But in most cases, they've shown little interest in doing anything.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 8 Apr 2003 09:16:49 -0400

>that tries to collect.  In an anti-junk fax mailing list, I've seen

Okay.  Let me try and say this in less words.

A junk fax or junk pre-recorded phone message can be traced, using 
information provided by a clueless user, in half an hour.

A junk email message can be traced, using information provided in a 
timely fashion by a clueful user, over a period of anywhere from half 
an hour to several days, possibly using throwaway email addresses, 
credit cards and court orders.

I do not consider those two things equivalent.  Nor do I consider the 
second to fit the normal definition of an "identifiable" source.

>variations of "follow the money."

Nor did I claim otherwise.  I'm simply taking issue with your claim 
that it is easy to identify who is sending most spam.

>by something more than a single $500-$1500 fee.

For the simple reason that it takes more than $500 to $1500 to track 
down the sender with a sufficient level of proof to receive the 
payment.

>is about useful as the telephone number in a TCPA case.  In many

In theory yes.  In practice that does not seem to be the case.  None 
of the cases I've reported to the FCC showed any indication of using 
fake caller-id or somehow hiding the 800 numbers they provided.  I 
don't have a large enough data sample of phone and fax violations, 
but I strongly suspect that majority are not hidden, whereas the 
majority of spam *does* attempt to hide where it comes from.

Oh, whoops.  I just realized where that argument was going.  Okay, 
forget it.  I forgot that you disagree with that.

>and my junk faxes abruptly stopped, I had trained the FCC letter

Unfortunately most of my complaints have been for unsolicited 
pre-recorded calls.  Which means manually describing the things. 
(Unless you can point me at a place where I can submit an audio file!)

>Do they really?  Don't some 1-900 phone system outfits shield their real

Perhaps.  I've never seen/heard junk faxes/calls with 900 numbers. 
It's all been traceable 800 numbers.

>done anything with that?  I couldn't.

No.  But I can give the FCC a 900 number and they can do it.
There is nothing I can give the FCC from a spam message that provides 
a similar level of traceability.  At a minimum it means following the 
links in the spam and actually entering a credit card number.  What 
consumer is going to do that?  And if they don't, what are the odds 
that the site will still be there by the time the FCC looks at it. 
Never mind the effort and time required to do it, whether done by the 
consumer of the FCC.

The two are not comparable.

>headers and treat it as I treated 21st Century's junk faxes.

See all of the above comments.  And add to it that spam reports from 
non-techies seldom have the full headers.

>convert a 1-900 number into an address for sending papers for small

Yes.  But we aren't talking about you and me.  We're talking about 
the average user.  The 900 number is sufficient identification to 
hand off the problem.  The email headers are not.

>be learned by those who are not stuck on peddling authentication snake

I'd appreciate it if you'd back off from your vendetta against 
authentication for a second and address the issue at hand.  "Is spam 
identifiable?"  I claim that it is not identifiable at anywhere near 
the level of fax and phone spam, and therefore the laws that work for 
junk faxes (namely, bounties) are not likely to work for spam.  You 
claim otherwise.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 8 Apr 2003 11:01:22 -0600 (MDT)

> information provided by a clueless user, in half an hour.

Have you never received a junk fax with a bogus banner, without
a knowable source telephone number, and advertising a web page?
I have.  How would I trace the junk faxer?

How do I trace a junk pre-recorded phone message that asks me to
record my number or push some touch tone keys to be called back?
I received many of those before July, 2002.

> credit cards and court orders.

Accounts of those who have become "clueful" in tracing junk faxes say
they often use the same tactics to get evidence against the big junk
faxers.

Spam that does not carry an IP address of someone complicit in the
crime cannot exist.  You can always identify the IP address of the
SMTP client.  If it's not overseas, you can launch lawyers.  If it's
foreign, you can at least firewal it.

> that it is easy to identify who is sending most spam.

I should not claim that it is easy in an absolute sense to identify
spammers.  Instead, I'm trying to say 

 - it is easy as to identify spammers as is to identify junk faxers
      and pre-recorded phone callers
 - it is sufficiently easy for those who are motiviated to spend
     more than half an hour pointing and clicking on the web.
 - it cannot be improved.

> down the sender with a sufficient level of proof to receive the 

Exactly. 
And no matter what is done in the IETF, legislatures, or anywhere,
spammers will use defenses that cost more than $500 to $1500 to
penetrate.  However, those defenses are readily penetrated by anyone
who really cares.  Moreover, because at least in the U.S. ISPs don't
have PTT protections, you can always go after the owner of the IP
address of the STMP client that sent the spam to your SMTP server.

> forget it.  I forgot that you disagree with that.

There is an unsubtle difference between "forged headers" and "using
your main home mail address so the net-nazi anti-comerze net-cop
flamers can get your account terminated."

> (Unless you can point me at a place where I can submit an audio file!)

How do you trace them?  Most that I've received are far less traceable
than any spam, since all spam has an IP address but I often have no
phone number for pre-recorded calls.  How should I trace a pre-recorded
that tells me to stay on the line to record my name and phone number
so that I can be called back?  Still, those who really care do drag
those guys into court.

> It's all been traceable 800 numbers.

If you're in the U.S., you surely saw 21st Century's "polls" in which
you were supposed to dial one of a pair of 1-900 numbers to "vote."

> links in the spam and actually entering a credit card number. 

No, the FCC can only identify the telephone equivalent of an ISP, or
the outfit that runs the 1-900 or 1-800 phone banks for the junk faxer.
That's like taking the IP address or mail address from spam and
identifying the ISP.  To get past that outfit, the FCC must issue
subpoenas or "follow the money."

>                                                                What 

The same applies (or not) to 1-800 and 1-900 phone numbers.  You can
rent a 1-900 or 1-800 phone number and disappear into the night when
you think it's time, with little few more traces than renting hosting.

Note also that plenty of spam contains 1-800 numbers.
See http://groups.google.com/groups?as_epq=1+800&as_ugroup=*abuse*

> non-techies seldom have the full headers.

How is that relevant?  Is it more relevant than the fact that many
junk faxes that I sent to the FCC did not have the TCPA required
banner, because the junk faxers voilate the law and use forged values.

> junk faxes (namely, bounties) are not likely to work for spam.  You 

That is not my claim.  Please go back and read my words about the
problems with the TCPA and notice that I have not advocated a TCPA
equivalent for spam.  Instead I claim:

 1. laws like the TCPA would reduce the spam problem a little, but
    only a little, and would certainly not solve it.

 2. spammers are already as well identified as junk faxers.  In both
     cases, it often costs more than $500 to find the home of the perp.

 3. contrary to the authentication snake oil, all spam is more identifiable
  than many pre-recorded phone calls, because pre-recordeds often lack
  all ID data but all spam contains an IP address and usually contains
  a phone number, domain name, or other contact information.  All spam
  is more identifiable than many junk faxes, because you always have
  an IP address but many junk faxes lack the sending fax machine.

 4.  It makes no sense to say the contact information in spam, whether
    URL, telephone number, email address, or postal address, is
    untraceable, but the same is traceable in a junk fax.  If fact,
    junk faxes and spam have similarly traceable contact info.

 5. contrary to the authentication snake oil, no laws, protocols,
     terms of service or anything else will force spammers to be more
     identifiable than junk faxers.  Every mechanism that lets TCPA
     violators cost more than $500 to find works on email.

 6. not withstanding #4-#5, if you are motiviated, you can identify
     spammers and TCPA violators.  There are people in anti-spam
     circles who have built large reputations on their skills in
     finding the names, home addresses, birth dates, and anything else
     you might care to know about a given spammer.

My vendetta against authentication snake oil is my main point.  People
have always had the delusion that authentication can somehow solve
the spam problem.  By pointing to the TCPA and junk faxes and
pre-recordeds, I'm trying to prove by example that more authentication
is as good a spam solution as HGH is an elixir of youth.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 8 Apr 2003 15:28:19 -0400

>I received many of those before July, 2002.

No to both.  So we're back to an ascertainable fact that neither of 
have access to.  What's the percentage of those compared to the 
percentage of equivalent obfuscations in email.  Oh well.

>than any spam, since all spam has an IP address but I often have no

The ones I've received have always given a phone number to call back to.

>   all ID data but all spam contains an IP address and usually contains

I'm going to assert that most pre-recorded calls contain address 
information that allows you to track them down.  After all, they want 
the user to contact them.  Why would they obscure that information?

Does that argument sound familiar?

Now I'm going to take it back, and state that while I believe that, I 
have no evidence other than the phone spam I've received to back it 
up.

>     junk faxes and spam have similarly traceable contact info.

It does if you assume that it is far easier to create untraceable 
transactions online than it is over the phone.  That is what I am 
assuming.  I know what it takes in software and hardware to generate 
pre-recorded calls--I've been involved in that business.  I don't 
know what services are available within the States to make that 
untraceable.  I seriously doubt there are too many services doing 
that from outside the States, because of the costs of international 
calls.  However, I don't know.  I could be wrong.  Without sufficient 
evidence I'm not going to argue the point.  Suffice to say that I'm 
not making a nonsensical argument.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 8 Apr 2003 16:22:30 -0600 (MDT)

> have access to. 

I hope you're not saying I'm lying about having received such faxes
or pre-recorded phone calls, but I don't understand what else you mean.

>                  What's the percentage of those compared to the 

Only a small minority of faxes sent to me flogged URLs and not phone 
numbers.  I found them noteworthy for obvious reasons.
About 50% of the telemarketing calls to my phone numbers in 2002 were
pre-recorded and wanted touch tones or to record a voice message
instead of offering a contact address.  I suspect someone was selling
nasty PC software to idiot business owners along the Front Range. 
Generally the businesses identified themselves by name, but were not
in phone books.  Joe The Idiot's Loan Service tends to be missed by
the directories whether it is advertising by spam or pre-recordeds.

> have no evidence other than the phone spam I've received to back it 

I don't understand the point you're making.  I agree many pre-recorded
phone calls contain addresses.  Political ads are the most consistent
exception.

> assuming. ...

Again, in a sense there is no such thing as untraceable spam.  You
always have the IP address of the SMTP client and you can always go
after its owner, even if the owner is a retail ISP and its clue-free
customer using a proxy.  I agree that for a given amount of effort,
it is easier to make network advertisements harder to trace than
telephone ads.  However, for practical purposes for the vast majority
of people, junk faxes, email spam, and pre-recorded telephone ads are
similarly traceable.

> not making a nonsensical argument.

I don't understand the thrust of your argument.  If you are saying
that ordinary telephone customers can trace most junk faxes and
pre-recorded phone ads, then you are wrong.  You're also wrong if
you're saying that motivated people cannot trace any given spammer.
I agree if you're saying that experts can trace phone abuse and that
most users cannot trace spam with the least obfuscation.

If your point is something about the relative costs of tracing phone
and email abuse, then it would help if you could quantify it.  I think
that both cost nothing when there is no obfuscation and otherwise
generally more than $500 but usually less than $5000.

    .................

] From: "Hallam-Baker, Phillip" <[email-masked]>

] > Versign demonstrated the low value of affordable authentication when
] > it sold the identity "Microsoft Corporation" for about $350 to to an
] > individual who fraudulently claimed to be a Microsoft employee.  
]
] The mistake was discovered by VeriSign and the certificate revoked.
] It has never been used. The procedures have since been changed.

All of which is irrelevant or unverifiable, and slightly wrong.

I doubt the cert was used, but how can anyone know other than by
believing statements from the people in San Diego that the certs were
never used?  According to Verisign and Microsoft, they are liers.

The error is seen by some people as the biggest the scandal.
The certs could not be revoked without installing patched versions
of Microsoft software on all computers in the net.  See
http://www.microsoft.com/technet/security/bulletin/MS01-017.asp
and especially the following:

    VeriSign has revoked the certificates, and they are listed in
    VeriSign?s current Certificate Revocation List (CRL). However,
    because VeriSign?s code-signing certificates do not specify a
    CRL Distribution Point (CDP), it is not possible for any
    browser?s CRL-checking mechanism to locate and use the VeriSign
    CRL. Microsoft has developed an update that rectifies this
    problem. The update package includes a CRL containing the two
    certificates, and an installable revocation handler that
    consults the CRL on the local machine, rather than attempting to
    use the CDP mechanism. 

] ...
] > As Phillip Hallam-Baker knows, I have never said "80% of spam comes
] > from free email providers," because we both know that is not true.
] > We both know that rate limiting by free providers is irrelevant.
]
] Your web site states that blocking mail from those addresses cuts out 80%
] of all spam. 

Why do you continue to repeat that obviously false statement?  
http://www.rhyolite.com/anti-spam/ says rejecting "spam CLAIMING to
be from" my list of free providers "currently seems to be effective
against 90% of spam."  It's been perhaps a year since I counted, so
that 90% could be wrong today.  Spam *CLAIMING* to be from the free
providers is not *FROM* the free providers.  It is silly to say anything
like "80% of spam comes from free providers."  I may be crazy, but
I'm not that stupid.

] > If certs were required for mail, then free providers would issue certs
] > along with usernames and passwords, and for the same price and with
] > the same due diligence in checking that the applicant is not really
] > Alan Ralsky that they now excerise.
]
] You have the end-to-end principle on the brain here. No there is no
] point in issuing client certs to such people. Authenticate the
] hosting service, the fact of interest is that they implement velocity
] limits.

Ever SMTP message has always arrived with a practically unforgable
certificate that is owned and useable only by the hosting service of
the immediate source of the spam.  It makes no sense to look for a
commercial certificate saying that mail from a UUNET, Sprint, or
hosting service is from that hosting service, because your SMTP server
already knows that.

Anyone who wants that sort of certs already has them.  You need only
set your STMP server to accept mail from only the certs that are in
your local list of good guys.  You can even configure your routers to
reject mail from outfits without certs that you consider valid.

If you want to hire a commercial service to decide which hosting
services are good and maintain your list of good-guy certs, you can
contact MAPS.  They sell a real-time service listing trustworthy certs.

Of course, that rub in all of that is that no one cares about a UUNet
cert, because a large fraction of spam comes from UUNet (by virtue of
UUNet's size if nothing else.)  Certs from hosting services are too
broad.  You want certs for individual users, but that gets you back
to Hotmail issuing certs along with usernames and passwords.

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 8 Apr 2003 21:47:00 -0400

>or pre-recorded phone calls, but I don't understand what else you mean.

No, not at all.  My apologies.  What I meant was that this comes down 
to a question of whether faxes and calls like that are common or 
rare, and we don't have the necessary information to make that 
decision.  As with the email spam problem, we're a bunch of blind men 
around an elephant.  Everyone's operating off of what shows up in 
their inbox.

>I don't understand the point you're making.  I agree many pre-recorded

Sorry.  Same point as above, except with the added irony that I'm 
basically making the same claim about faxes that you've been making 
about email--that most people don't hide their contact information. 
You think it's equally true of both, I think it's more true of faxes. 
But without information we're pretty much stuck there.

>phone calls contain addresses.  Political ads are the most consistent

Yes, but they are exempt from the pre-recorded message laws as well. 
So we're pretty much screwed there.

>customer using a proxy.  I agree that for a given amount of effort,

Am I missing something?  I didn't think there was a traceable 
original IP in open-proxy spam.  (The nice thing about my current 
role is that I'm *not* the one doing all the header analysis, and 
open proxies came into major play after I stopped looking at headers.)
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 8 Apr 2003 20:26:50 -0600 (MDT)

> >..
> decision.  ...

I don't see the importance of deciding whether they are common.  They
were common until recently in my experience, but I'm not claiming my
experience proves more than that they happen.

My claims are elsewhere.  Those faxes and calls are in practice (not
withstanding theoretical telco logs) as obfuscated as the spam of the
shiest spammer, but their perpetrators have felt the sting of the
TCPA.  That shows that the claim that authentication is required to
identify spammers is snake oil.

The TCPA requires all faxes to have a banner identifying and authenticating
the sender.  It outlaws pre-recorded junk calls.  Modern fax machines
can filter on those banners and phones can filter on caller-ID.  Still,
the TCPA helped but did not end those problems.  It has been effective
only as a deterrent, and against major bad guys only when Washington
DC launched major court efforts.  Caller-ID and fax banner filtering
is like per-mail-sender authenticaion.  That filtering can be used by
individuals who don't want to hear from strangers, but they're useless
for people or businesses that need to hear from strangers.

> But without information we're pretty much stuck there.

I won't guess which obfuscation is more common, and I don't care. 
I claim only that fax/telemarking obfuscation is sufficiently common
to illuminate the truth (or its lack) in claims about spam obfuscation
and authentication.

> original IP in open-proxy spam. ...

I meant that you can always go after the owner of the open proxy.

Everyone must be held accountable for every IP packet that comes out
of their networks.  It does not matter whether a packet is part of
legitimate web surfing, good mail, spam, or a DoS attack.  It also
does not matter whether an arbitrary open proxy operator is paid by
Ralsky as long ago Spamford paid his "Bandwidth Partners" for relaying
spam.  It doesn't matter whether the proxy is operated as a charity
to help the Chinese tunnel through the Great Wall or out of ignorance.
The proxy operator is responsible.

When imposing penalties, someone who ignorantly installed an open
proxy should not be punished like Ralsky or Spamford, but that does
not change the responsibility or the need to communicate with the real
threat of punishment to even the most naive and nominally innocent user.

A network operator must be responsible for closing the open proxies
of its customers just as it is responsible for shutting down "owned"
machines used in a denial of service attack.  Failure to do either
should make the operator vulnerable to criminal penalties related to
those imposed on the originator of the attack.