Subject: RE: [Asrg] News Article - Microsoft and spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 26 Jun 2003 10:27:36 -0700

I think that we have to be realistic about the cost/benefit issue here.

Yes it is possible for a spammer to hire people to sign up for these
schemes. However to do so requires capital which has an effect on the
starting out spam senders.

A spam sender that tries to do this in  bulk is going to start to hit limits
on the number of addresses a given IP address can sign up for at a time. 

It strikes me that it might be a good scheme to allow the spam senders to
register large numbers of domains but mark them as being suspect spamhaus
addresses. Then monitor the emails being sent out with spam filters and chop
the account.

		Phill

> -----Original Message-----
> From: Vernon Schryver [mailto:[email-masked]]
> Sent: Thursday, June 26, 2003 12:58 PM
> To: [email-masked]
> Subject: Re: [Asrg] News Article - Microsoft and spam
> 
> 
> > From: Yakov Shafranovich <[email-masked]>
> 
> > ...
> > I was wondering about that as well. Would hiring people for 
> go through the 
> > human interface test increases the costs for spammers? Does 
> it matter since 
> > the cost is so small anyway? What about in a C/R system 
> where a human 
> > interface test is used, would spammers actually go ahead 
> and hire people to 
> > pass the test from each bounced message?
> 
> Let's do some arithmetic.  At $10/hour and 10 seconds per challenge
> answered or account created, the cost would be about $0.03 address.
> That sounds a little but not very high to send mail until the
> challenge whitelist entry is deleted by the spam target.  It sounds
> low for a valid sender account that can be used for millions of
> messages for days until the free provider notices enough bounces
> or receives a complaint and terminates it.
> 
> Free providers often impose delays of more than 10 seconds for
> account creation.  That can be handled by giving your $10/hour
> employees big monitors and have them run several windows 
> simultaneously
> to overlap with the delays.  Pay them by the account created or
> challenge answered to keep them busy.  Use software to automate
> most of the process, including counting and checking the work.
> Don't worry about the U.S.  labor laws about piece work, since
> you're probably breaking lots of other laws.
> 
> I wonder how much of the flood of "work at home" spam today involves
> free mail account creation jobs?
> 
> 
> Vernon Schryver    [email-masked]
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 26 Jun 2003 17:30:08 -0400

> on the number of addresses a given IP address can sign up for at a time. 

Multiply that by the at least 200,000 unsecured proxies in the wild.

> addresses. Then monitor the emails being sent out with spam filters and chop

Gets back to the issue of how you detect spam...