Subject: Re: [Asrg] New take on emerging idea. (Query/C-R system?)

From: "John Fenley" <[email-masked]>
Date: Thu, 10 Apr 2003 15:07:18 -0600

>From: Kee Hinckley <[email-masked]>
>At 3:22 AM -0600 4/10/03, John Fenley wrote:
>>Administrator maintained public "choicelist"(functions as a whitelist, and 
>>a blacklist) database:
>
>Who administers this?  And who can read it?
Each entry in the database is maintained by the creator of that entry.
anyone can read it because it is a public database.
>
>>Database curator:
>
>Again.  What's the scope of this job?  Per-ISP?
>
>>2. protect the security of the database against unauthorized changes.
>
>How are changes authorized?
By password, then by password reset, then by an actual person contacting the 
creator using the contact info they give.
>
>
>>4. give id# of the list's entry to subscribers so they can recieve the 
>>list, or use a system where they send the first message to subscribe to 
>>the list.
>
>These ID #'s are unique world-wide?  Who guarantees that?

Yes they are unique. there is one central database that that generates a 
unique number when an entry is created.

>>1. enter # given when you sign up for a list if your mail service supports 
>>it, or send a subscribe message to the list.
>
>Enter # (or list?) where?

into your Mail User Agent so that your MUA can contact the database to 
maintain your whitelist.

>>1. allow user to enter id #s.
>
>Into what?
>
into the whitelist manager

>>When a new user joins the system:
>>1. They choose a user name, and a password.
>>2. they enter contact info, to prvent hijacking.
>
>How does that prevent hijacking?
>Fenley, Dagmar
>1985 N 360 East
>PROVO, UT 84604

In the event of a lost password, contact info would be used to give them 
control of their account.

>>#1 Each time your system recieves an email message the senders address is 
>>checked against a whitelist.
>
>Where is "your system" in this model.  MTA, MUA?

The Mail User Agent.

>
>>If the name IS on the list deliver the message. end
>>If the name IS NOT on the list procede to #2.
>>#2 Check the choicelist database, and compare the numbers returned against 
>>the users choicelist. If no number is returned go to #3 If the number is 
>>in the users choicelist deliver the message. end
>>If the number is not in the users choicelist delete the message. end
>
>More critically.  You've described a complex whitelisting system using 
>unique numbers (not sure why, the email address is also unique, and the 
>mapping between the two appears to be public, although I'm not certain from 
>the description).  What does that gain over just whitelisting the address.  
>And how does it do any more to prevent forgery than just whitelisting the 
>address?

Hypothetical situation:
I sign up at amazon.com.
they give me a #
I enter that # into my MUA
ANY address that Amazon.com now decides to send me mail from is now 
whitelisted.
Amazon.com is responsible for adding a new address to the public database.
When they add an address to the public database, it is added to my 
whitelist.
All I have to do is enter the # once.

even if someone creates a fraudulent entry in the main database with 
"[email-masked]" in it, That does not help them send me spam, because my 
system only reads the entrys that I have authorized it to read, and I probly 
didn't authorize that number. Even If i did, I could just remove a single 
line from my whitelist to never hear from them again.

John Fenley

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE*  
http://join.msn.com/?page=features/virus

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 10 Apr 2003 17:46:33 -0400

At 3:07 PM -0600 4/10/03, John Fenley wrote:
>>>Administrator maintained public "choicelist"(functions as a 
>>>whitelist, and a blacklist) database:
>>

I'm not asking who adds entries to it.  I asked who administers the database.

>By password, then by password reset, then by an actual person 
>contacting the creator using the contact info they give.

You skipped the scope.  Who is paying this person's salary?

>>>4. give id# of the list's entry to subscribers so they can recieve 
>>>the list, or use a system where they send the first message to 
>>>subscribe to the list.
>>
>Yes they are unique. there is one central database that that 
>generates a unique number when an entry is created.

I'm sorry.  Are you proposing one single global address that is run 
for free (you said this was non-commercial so that it would be better 
adopted), and into which every user puts their email address, their 
postal address, their password and a list of every single email 
address that they allow to send them email?  And further did you not 
say that if I input an address into this database, I get out a list 
of all people who can send email to that address?  So in other words, 
if I subscribe to the porn video volunteers mailing list--anyone can 
find out?

Am I misunderstanding you?
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg