Subject: Re: [Asrg] New proposal for spam blocking: Greylisting

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 20 Jun 2003 11:50:37 -0400

At 10:29 AM 6/20/2003 -0500, Evan Harris wrote:

>Over the past few months, I've been working on a new method of blocking spam
>that I've termed "Greylisting".  From my testing it appears to be over 97%
>effective.
>
>It requires no changes to the infrastructure, is resistant to spammer
>adaptation, and is very effective, yet very lightweight.
>
>The paper outlining the method is at
>http://projects.puremagic.com/greylisting/ and I have also posted an example
>implementation for a Sendmail Milter written in perl.
>
>Please look it over and try to poke holes in it, but I've worked pretty hard
>to make it as bulletproof as possible.

The main point of this method seems to be:

--snip---
"The Greylisting method is very simple. It only looks at three pieces of 
information (which we will refer to as a "triplet" from now on) about any 
particular mail delivery attempt:
The IP address of the host attempting the delivery
The envelope sender address
The envelope recipient address

 From this, we now have a unique triplet for identifying a mail 
"relationship". With this data, we simply follow a basic rule, which is:

"If we have never seen this triplet before, then refuse this delivery and 
any others that may come within a certain period of time with a temporary 
failure. "
--snip---

This proposal has been discussed before by someone else (I forget who), and 
is similar to the one used by TitanKey. The underlying assumption is that 
spammers will not retry message delivery. This may very well change very 
quickly. As I stated before, we need to look to developing a "consent 
architecture" for spam control like the charter says.

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John Morris" <[email-masked]>
Date: Sat, 21 Jun 2003 12:02:29 -0400 (EDT)

Vernon Schryver <[email-masked]> wrote ..
> > From: Elric Pedder <[email-masked]>
> 
> > ...
> > If only a hash of the triplet were stored, would this solve
> > the privacy issue?
> 
> No.  Consider a "dictionary attack."  If you have a copy of the database
> and want to know if Steve Case sent Bill Gates a message, you hash
> those two addresses with a likely IP address and see if you can get
> a hit in the database.  If you do not know the exact IP address, you
> can guess it is one of a few thousand (or at most a billion) and make
> the corresponding few thousand (or billion) probes of your copy of
> the database.  Like a dictionary attack on /etc/passwd, this attack
> may not be quick, but it is effective.

I agree with Vernon's comments.  Hashing the triplets would not "solve" the privacy problem, for the reasons Vernon explains.  But I do think it could "reduce" the privacy problems, because a dictionary-like attack would be less effective if you do not have any idea about who has sent e-mail to the person whose greylist you are attacking.  It would also make the greylist better protected from a more casual attack -- for example, a colleague or family member sneaking a quick peek at someone's greylist.

But, hashing the triplets would certainly not make all of the privacy problems disappear.  Indeed, even if one could come up with a hash that was resistant to kind of attack Vernon details, the other information in the database could reveal important personal information even without knowing who sent an e-mail.  For example, if you are trying to investigate whether person X made an initial contact with person Y during a given period of time, Y's hashed greylist could establish that someone contacted Y for the first time at a time specific (which could be valuable even if you cannot determine whether the someone was X).

John