Subject: Re: [Asrg] News Article - Microsoft and spam

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 12:44:14 -0400

At 10:20 AM 6/26/2003 -0600, Vernon Schryver wrote:

> > From: Yakov Shafranovich <[email-masked]>
>
> >...
> > (http://news.com.com/2100-1032_3-1021166.html) discussing the difference
> > between Microsoft's actions and words on spam.
>
> > ...
> > "People will try to exploit free Web mail even to the extent of hiring
> > people to go through human interface test ..."
>
>I've been wondering for a long time when someone might say that in public.
>[..]

I was wondering about that as well. Would hiring people for go through the 
human interface test increases the costs for spammers? Does it matter since 
the cost is so small anyway? What about in a C/R system where a human 
interface test is used, would spammers actually go ahead and hire people to 
pass the test from each bounced message?

Yakov  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 26 Jun 2003 15:02:09 -0400

At 10:57 AM 6/26/2003 -0600, Vernon Schryver wrote:

>Let's do some arithmetic.  At $10/hour and 10 seconds per challenge
>answered or account created, the cost would be about $0.03 address.
>That sounds a little but not very high to send mail until the
>challenge whitelist entry is deleted by the spam target.  It sounds
>low for a valid sender account that can be used for millions of
>messages for days until the free provider notices enough bounces
>or receives a complaint and terminates it.
>[..]

Even if every single message has to be manually verified or sent by a 
human, how much would it cost anyway to hire people to do so? It seems that 
the advantage that spam enjoys is due to low cost of the transmission 
medium. In the postal system junk mail is restricted not by the fact that 
its sent by humans or machines, but rather by the cost of the postage 
itself and various laws covering illegal mail scams. Thus, in the email 
world it would seem that an economic solution that imposes postage costs 
would seem like a good solution but then again the real world does not 
correspond directly to the Net world.

On the other hand snail mail recipients cannot have an automated system 
reject junk mail, unlike email users. Thus this brings us back again to 
consent-based communications. Users and/or their providers define filtering 
rules under which email is rejected or put into the bulk folder. For the 
most paranoid, all email is rejected unless the receiver is known, for 
others filtering, C/R, HTML blocking, etc. systems can be used.  Once the 
receiver has given his consent to the sender, all email will flow freely. 
Consent can either be given by being put on a whitelist - then issues of 
forged sender must be resolved. Other ways to give consent is cryptographic 
tokens or passwords.

Just some thoughts.

Yakov