Subject: Re: [Asrg] Re: TitanKey and "white lies"... (Faking SMTP hard errors "improves" C/R utility?)

From: mathew <[email-masked]>
Date: Sun, 1 Jun 2003 18:21:07 -0400

On Friday, May 30, 2003, at 18:11 US/Eastern, Barry Shein wrote:
> I'll answer such inquiries, a quick check on google would probably
> confirm I've answered many thousand such queries, but I think if I
> were then confronted with a C/R requiring me to go web site etc I'd
> say "good luck buddy!"
>
> Most of my point really was the web addr which can often mean firing
> up a browser etc. If it were just a matter of responding in e-mail I'd
> be more inclined to respond.

Let me understand how this TitanKey system is supposed to work...

1. I send mail to Joe Smith.
2. I get a bounce message saying that there's no Joe Smith account, and 
that
    my e-mail wasn't delivered. I delete it immediately, of course.
3. I get an e-mail claiming to be from Joe Smith, saying that I need to 
go
    read a web page to get permission to send him e-mail. The web URL
    presumably has some information encoded in it.
4. I remember that Joe Smith was actually someone I tried to e-mail, and
    I don't bin the challenge immediately.
5. I go visit the web page.

It seems to me that the assumptions in steps 3 & 5 are a major problem, 
because users are well aware that (a) clicking on encoded URLs is one 
of the tricks spammers use to verify your e-mail address, resulting in 
your getting more spam; and (b) that spammers and worms often use the 
e-mail addresses of your friends in the From: field to try and persuade 
you to read and respond to their spam.

As far as step 4 goes, I'll be generous and assume I'm the only person 
who doesn't remember the e-mail addresses of everyone he sends mail to.

There's also the question of whether TitanKey saves a copy of all the 
e-mail it sends 550 responses to. If it does, then you're basically 
using up as much disk space and bandwidth as just delivering the spam. 
If it doesn't, then you're expecting the sender to go find a copy of 
the e-mail he tried to send--assuming he kept a copy--and send it 
again. I find it very hard to believe anyone would really jump through 
a hoop *that* high.

Now, I may be wrong, so what if users *are* prepared to go visit a web 
site in response to a challenge from a C/R system? In that case, I give 
it about a week before we start seeing spam that's a verbatim copy of 
the TitanKey C/R text, followed by a URL which redirects to a porn 
site. Users learn to associate C/R system challenges with porn spam, or 
(even worse) their Bayesian spam filter recognizes the cloaked URL and 
learns to filter out challenges automatically.

In fact, a similar problem applies to any other C/R system--inevitably 
we'll see spammers sending fake C/R challenges as a means of obtaining 
confirmed e-mail addresses.

mathew

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Aronson <[email-masked]>
Date: Sun, 1 Jun 2003 20:25:40 -0400

> Let me understand how this TitanKey system is supposed to work...
 [snip]
 > 4. I remember that Joe Smith was actually someone I tried to e-mail,
 > and I don't bin the challenge immediately.

This last bit might be helped by quoting the (normally visible) headers.  
(yoohoo, mr. titankey, i hope you're listening....)

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 1 Jun 2003 20:04:00 -0600 (MDT)

> From: mathew <[email-masked]>

> ...

I also forget, even when the message was sent to a single person.
Then there are the cases when I'm doing a "reply-all" to a message
from a stranger who sent copies to half a dozen colleagues.

This problem applies to all of the C/R systems I've seen described, except
those that assume that software on 100,000,000 desktops is upgraded first.

> ...

This also applies to all C/R systems that don't assume both sender
and receiver are running new, as yet unspecifed (not to mention not
designed or written) software.

> learns to filter out challenges automatically.

Why is that worse?  Many people will think expect their Bayesian or
other filters such as SpamAssassin to recognize the "please click
or respond" boilerplate of a challenge as likely junk.

C/R advocates will tell me I'm being nasty and negative, but others
should consider the numbers.  Assume a C/R system becomes popular.
Spammers will then imitate C/R "click or respond" boilerplate just as
they now blather about imaginary laws.  Some spammers will honestly
think that sending an "click or respond" challenge is a legitimate
"confirmed opt-out subscription" mechanism and have software that does
something with responses.  As soon as you have reponded to the challenges
of your regulare correspondents (or whitelisted them), most of the
challenge boilerplate you'll receive will be spam.  If you don't have
any ego or money invested in the C/R system, what will you do?  Why
won't you will tune your filters to reject mail that looks like
challenges even if that wrecks the C/R system for you?

Some C/R advovates will tell me I'm stupid besides negative and that
challenges will be easily distinguished from the fakes by some means.
I'll respond that if that were possible, we could apply the same means to
ordinary mail and skip the whole challenge/response hassle.

> confirmed e-mail addresses.

Let's not over generalize.  Just as not all spammers (do not) honor
550-unknown-user SMTP status and the question whether most do or not
is meaningless, some spammers won't be using C/R fakery to clean their
lists but will simply be capturing "eyeballs."

The fundamental problem with C/R systems is the same as with most
propose spam solutions.  It is their advocates they assume that mail
recipients, spammers, and legimate senders are just like the people
advocating the proposal.  There is an oddly consistent refusal of
advocates to play devil's advocate against their own proposals.  People
assume that everyone, spammers as well as the general public, will go
against individual self-interest to make the proposal work.  No one
seems to have ever heard of Murphy or know that Murphy was an optimist,
because the other guys are actively looking for ways to bend the system.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg