Subject: RE: [Asrg] 2 - Solving Spam By Establishing A Platform For Sender Accountability

From: Bob Wyman <[email-masked]>
Date: Sat, 28 Jun 2003 18:31:13 -0400

Vernon Schryver wrote:
>Ok, but why do you care about servers instead of persons?
    Because that was the focus of the message to which I was 
responding! The base proposal was for a system that involved 
recipient's mail servers exchanging messages with a sender's 
servers in order to verify which server had sent the message. 
I was pointing out that this sort of bandwidth heavy exchange 
can be eliminated by using signatures instead. 

> It sounds as if you are making the familiar assumption that
> every legitimate sender transmits only via a small number
> of SMTP clients.
   I make no such assumption. Also, such an assumption would 
be irrelevant to this discussion since we're only talking 
about verifying servers -- not clients.

> why is it any harder for a spammer to get a signed,
> throw-away domain name than to get a throw-away personal
> or other certificate?
   Why should it be hard? As far as I can see, there are only 
two useful reasons to verifying the identity of a sending 
server: First, so that you can build white/black lists and 
Second, so that you can detect false statements in mail 
headers. Of the two, the first is clearly the most important. 
Both of these two benefits arise from verification whether it 
is cheap or expensive.

   bob wyman

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 28 Jun 2003 16:49:48 -0600 (MDT)

> From: Bob Wyman <[email-masked]>

> ...

That's a subversive notion, or at least contrary to the standard
rational for authentication as a spam solution that is based on the
idea that signatures are almost free and that spammers can't get
signatures or will be disavowed by their CAs or blacklists.

I also doubt it's necessary.  Most of the senders that you might
whitelist already use practically unforgeable tokens, namely the IP
addresses of their SMTP clients.  The remaining senders that you might
add to your whitelist are likely to have other sufficient marks,
sometimes including digital signatures.  On the other side, many of
the senders you might blacklist are already easily blacklisted by
their IP address or sending domain.

What's the point of looking for lies in headers?  Most of the spammer
header lies were in Received headers, but seem to be out of style.
Spammers tha send from their own systems have no reason to fake Received
headers, and neither do those using open proxies.  The other header
statements that most people mean when they say such things involve
the envelope or From sender, but I don't see how you could usefully
detect real lies there.  If signatures became necessary, then spammers'
$8 domain name registrar would provide them.  As you said, signatures
verify spammers's STMP clients just as well as everyone else's.

A combination of IP address blacklists (including DNS BLs) and local
whitelists can be awfully effective, and requires no changes in the
mail system or other people's behavior.  That doesn't imply that
looking for improvements is not good, but any proposal that does
not do better than ~80% is a waste of breath.

The ASRG standard dichotomy between the silver bullet of the moment
and 50 spam/day/user is false.  No one need receive more than a very
few spam/week if they'll use the current mechanisms.

Vernon Schryver    [email-masked]