Subject: FW: [Asrg] 0. General

From: "Denny Figuerres" <[email-masked]>
Date: Tue, 21 Oct 2003 14:25:01 -0400

Thanks for the links and input....
A few comments on the comments so far.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Yakov Shafranovich
> Sent: Tuesday, October 21, 2003 11:13 AM
> To: [email-masked]
> Cc: ASRG list
> Subject: Re: [Asrg] 0. General
> 
> 
> denny wrote:
> > Hello everyone!
> > I have a lot to say and I hope it's worth hearing....
....
> > some things I belive at this time are:
> >  
> > 1)  make the sender "Pay Postage" will get us further than 
> trying to 
> > filter the junk / spam.
> 
> There are scaling and other implementation problems with 
> e-postage which 
> must be solved before its implemented. See the following:
> 
> http://www.taugh.com/epostage.pdf 
> http://www.templetons.com/brad/spam/estamps.html#bad
> 

I agree there are issues with the "postage"  model.
But I think unless some other means is found we will have to go that
way.

> > 2)  the SMTP email system needs to get modified to make forgery of 
> > headers very difficult.
> > 3)  common practice, the law and the SMTP software need to 
> make "accountability" a requirement not an option.
> 
> Installed base makes it very hard PLUS anonimity is an issue. See the 
> following document:
> 
> http://www.ietf.org/internet-drafts/draft-crocker-spam-techcon
> sider-02.txt
> 

I am reading the documents as fast as I can between work and other
stuff....

Just let me ay this:

Anonimity:  as far as I am concerned if someone wants me to recive a
message they should be willing to identify them selves.
This does not mean you can not recive an email from an "unknown" party,
but it does mean that I should be able to read a valid
Email header that is not lying to me.

> > 4)  as has been stated elsewhere: classifing "SPAM" via program is 
> > difficult and requires constant adaptation.
> 
> Correct.
...
> >  
> > the fee can be small for each message.
> 
>  From the technical considerations document 
> (http://www.ietf.org/internet-drafts/draft-crocker-spam-techco
> nsider-02.txt):
> 
> 
I agree... No way can we just drop SMTP and cut over.
We have to add some new features one at a time and build.

> There are other mechnanisms such as RMX, etc. which allow 
> authentication 
> for servers as opposed to individual clients, and tend to stop relays 
> and hijacked home computers. There is a currently a small sub-group 
> working on reconciling several RMX proposals, but than again 
> implementation will be difficult.
> 

Great!  That's something that I will look at.

While I used the term "Postage" I guess I should clarify how I have used
it.

What I envision is primarily an "Operator to operator" payment process.
Where the operator can set local policy on how and when to collect fees
from local users if and when needed.

Keep the addon cost very low to invisible to the "average user"
A sliding scale for example where 1-10 messages are free / cheap for
john doe
But 10,000 messges cost Mr. SPAM some real cash.

I *THINK* a server validation / authentication could be added to SMTP
with only a small impact by and large.
We do DNS lookups at that point already, just add some form of pulic key
type of process and we could have the basis for an audit-trail.

Back to the anonimity subject:

When email started is was all based on trust.
And email moved with little or no "filtering" or interception.

Today we are going in a dierection I find frankly frightening and like a
"Goerge Orwell / 1984" model
If we keep adding mail filtering and scanning it then does raise the
specter of "Big Brother" in to many ways to count.
If we tell the public and the government that filtering and scanning is
good then how can we cry foul when they want to tap in and monitor the
flow for
"Security" and "Child Porn" and "State secrets" ???

And might our work to develop anti-spam methods be turned into some
project to further take anonimity from all our communications??

That is one of the resons why I feel that at it's core the "filter"
method is the wrong approach. 

Enable the user to make the "Value Judjments" on the content .... Let
the "Operator" only deal with managing the network and not with becoming
an "Editor".

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Thu, 23 Oct 2003 01:39:42 +0700

>  Email header that is not lying to me.

	There are human rights workers around the world that have their 
lives literally depending upon being able to send anonymous e-mail. 
You will literally be responsible for the murder of tens, hundreds, 
thousands, maybe millions of people, if you do not account for this 
issue.

	Regardless of whatever else we may do, we must find a way to 
preserve the ability to send e-mail anonymously for the people who 
need this feature.  Otherwise, we may never find out about SARS II, 
or the next Tutsi-Hutu massacre until it is too late.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: [email-masked] (Justin Mason)
Date: Wed, 22 Oct 2003 12:45:58 -0700

>thousands, maybe millions of people, if you do not account for this 

This is important, I agree.

But IMO, something like the PGP remailers and/or hushmail are the key
systems to support this form of free speech -- it should *not* be part of
the core SMTP protocol.  Here's why:

As it stands, SMTP is *not* anonymous for such people.   It takes a lot of
technical know-how to send an anonymous email that cannot be tracked to
your ISP, who then have your phone number in their call records.   For
example, I know right away that your mail was sent by 216.194.225.101
at Wed, 22 Oct 2003 15:02:10 -0400.   No matter what header data you
insert or remove, you can't hide that tracking data.

To avoid this, you may use open proxies.  But for a whistleblower, this
still would not be safe, if there was enough law enforcement interest; an
authoritarian state would just have to sniff the unencrypted traffic going
*from* the source *to* the proxy to catch "troublemakers".

More likely, a sensible whistleblower would be using systems like
hushmail, Peekabooty, Freedom Network, and (if they're techie) the PGP
remailers network.  (Most nowadays seem to use hushmail.)

These can be volume-throttled, do not provide spammable bandwidth, or use
CAPTCHAs, so they become useless for bulk mail spamming -- but remain
*very* useful for free speech, since they *are* fully encrypted and
*designed* for whistleblowing activity.  

- --j.

---

From: David Maxwell <[email-masked]>
Date: Wed, 22 Oct 2003 16:01:48 -0400

> the core SMTP protocol.  Here's why:

I think there's an important distinction to make between 'Internet
email' and 'messages'.

If the choice is between 'all mail servers are open, and all users must
accept spam' and 'mail servers authenticate connections in some way, and
activists need to create their own infrastructure to get messages out' -
I'll pick the second.

To _whom_ are the activists sending their messages? Are they spamming
them to random recipients, or to known contacts? If to known contacts,
why can't they use encryption to hide the content. If they're spamming
to unconsenting recipients, how is that any different (technically) from
commercial spam?

-- 
David Maxwell, [email-masked][email-masked] --> Mastery of UNIX, like
mastery of language, offers real freedom. The price of freedom is always dear,
but there's no substitute. Personally, I'd rather pay for my freedom than live
in a bitmapped, pop-up-happy dungeon like NT. - Thomas Scoville

---

From: [email-masked] (Justin Mason)
Date: Wed, 22 Oct 2003 13:16:22 -0700

>to unconsenting recipients, how is that any different (technically) from

Exactly -- from what I've seen of it, it's generally to known contacts
(e.g.  cryptome, journalists, Amnesty etc.)

- --j.

---

From: David Maxwell <[email-masked]>
Date: Thu, 23 Oct 2003 12:15:56 -0400

On Thu, Oct 23, 2003 at 07:23:08PM +0700, Brad Knowles wrote:
> At 4:01 PM -0400 2003/10/22, David Maxwell wrote:
> 
> 	Would you be willing to bet your life on that?  The life of your 
> family and friends?  Would you be willing to have them tortured to 
> death while you watch, because you made this bet?

I can separate the emotional issues in that situation from the technical
problems caused by spam which are affecting all users of email. Can you?

Instead of using your energy to try to prevent progress in solving the
spam problem, why don't you use it to develop a system that supports a
solution to this problem you feel strongly about.

> 	Encryption is usually highly illegal (as in, a capital offense) 
> in those places where the human rights workers are most likely to be 
> needed.  Yes, they can use steganography techniques to try to hide 
> the crypto, but they're still taking a serious risk.
> 
> 	You get caught with this sort of stuff, and you get declared an 
> enemy of the state, guilt of spying and high treason.  And then you 
> get executed.
> 
> 	That's after they torture you and make you watch while they 
> torture your family and friends to death.

You did not answer my question. You then followed with a statemen that
these activists who are already at risk due to the content they are
communicating would be at risk for using encryption... that seems to not
contribute to the discussion. Then you got emotional again.

If someone _consents_ to receiving mail from these activists, they can
configure an SMTP (or other protocol which might be less likely to
be sniffed!) server to accept connections from anyone, anonymously.

That in no way implies that everyone on the planet should be FORCED to
'consent' to accepting mail from anyone, anonymously.

-- 
David Maxwell, [email-masked][email-masked] --> Unless you have a solution
when you tell them things like that, most people collapse into a gibbering, 
unthinking mass.  This is the same reason why you probably don't tell your 
boss about everything you read on BugTraq!    - Signal 11

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 24 Oct 2003 16:13:30 -0400

[Subject changed as per list guidelines. Mod.]

Brad Knowles wrote:
> lives literally depending upon being able to send anonymous e-mail. You 
> will literally be responsible for the murder of tens, hundreds, 
> thousands, maybe millions of people, if you do not account for this issue.
> 
> preserve the ability to send e-mail anonymously for the people who need 
> this feature.  Otherwise, we may never find out about SARS II, or the 
> next Tutsi-Hutu massacre until it is too late.
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 24 Oct 2003 16:27:23 -0400

Brad Knowles wrote:
> family and friends?  Would you be willing to have them tortured to death 
> while you watch, because you made this bet?
> 

This reminds me of some relatives and their KGB stories :) In any case, 
the need for privacy and anonymity is so engrained within the Internet 
and IETF/IRTF culture, that sometimes it is hard to explain it to 
someone else since it is so basic. In fighting spam, if privacy and 
anonimity is touched, it needs to be explained why and how far. A very 
careful balance must be struck between privacy, anonimity and the need 
to authenticate people. For example, no need exists to autheticate 
individuals if servers can be authenticated, etc.

Further, someone else at the IETF has once told that privacy and 
anonimity are considered core values of the IETF, and that
things could get Orwellian really fast if privacy is surrendered; and
anonymity is a fundamental component of privacy.

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 24 Oct 2003 16:48:27 -0400

> anonymity is a fundamental component of privacy.

  My concern is that I don't see a requirement that SMTP should solve
all of the worlds problems.  I understand that SMTP should not
*remove* peoples privacy and anonymity.  But there is no requirement
(and there SHOULD be no requirement) that SMTP creates privacy and
anonymity, where there was none before.

  e.g. If the vaunted "human rights workers" don't have access to
computers, there are still many ways for them to get their message out
to the rest of the world.  The mere existence of access to computers &
SMTP changes nothing.  If they want to be anonymous and private when
sending information to the rest of the world, there are hundreds of
methods outside of SMTP that they can use.

  Further, I believe that the emotional appeal to human rights workers
is inappropriate in a professional forum.  Arguments of the form "If
you're for proposal X, then you're for killing people!" should be
explicitly outside of the scope of ASRG.  We can solve any necessary
issues without resorting to polemics.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 24 Oct 2003 16:53:08 -0400

> anonymity, where there was none before.

Nevertheless, we should tread carefully on removing on whatever 
anonimity is currently being granted by SMTP.

---

From: "Brian Adams" <[email-masked]>
Date: Fri, 24 Oct 2003 14:19:05 -0700

> anonimity is currently being granted by SMTP.

Agreed, lets be careful, but let us not forget that preserving the ability for any MTA to accept anonymous email means that spammers will forever be able to send anonymous spam.  No two ways about it.  Please consider that the current system has resulted in the SPAM epidemic.  We HAVE to change something to fix the bigger problem.  For a majority of people receiving anonymous email is not a feature of any value.  If certain organization desire to receive anonymous email, let them setup servers that accept email regardless of origin.  I can see governments, human rights organizations, and press outlets all providing such a service.  For the rest of the world... lets add the ability to certify the sender and close the SMTP exploit that is being abused by spammers.

Brian Adams

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 24 Oct 2003 17:02:59 -0400

> anonimity is currently being granted by SMTP.

  I agree.

  As I understand the RMX-style proposals, they do not remove any
anonymity.  They add accountability, but only under the mutual consent
of the message originator and recipient.  If the sender does not wish
to be accountable, they can choose to not send messages to the
recipient.  People who wish to remain anonymous can use throw-away
accounts, paid for in cash.

  The problem isn't hard to solve, and the solution very often has
nothing to do with SMTP.

  As was pointed out earlier, the "human rights activist" isn't
randomly spamming people.  Instead, (s)he's sending targeted messages
to people who want to receive them.  Mutual consent exists, so any
anonymity, privace, and accountability issues become whatever the two
parties agree to.

  If the human rights worker *does* resort to randomly spamming people
with their messages, then it's my perogative as a recipient MTA to
ignore their message.  But in no way does this non-consent to spam
make me responsible for people dying.  I have no polite words for
arguments which would make me responsible for any deaths as a result
of me choosing to not accept spam.  Those arguments are not just
counter-productive, they're actively hostile to free speech and
freedom of choice.

  Alan DeKok.

---

From: Florian Kunkel <[email-masked]>
Date: Thu, 23 Oct 2003 00:06:52 +0200

> Agreed, lets be careful, but let us not forget that preserving the
> ability for any MTA to accept anonymous email means that spammers
> will forever be able to send anonymous spam.

no it does not.
you have to distinguish between users authenticated to the relay but 
sending anonymous emails
and anonymous users using open relays.

there's no problem with sending anonymous emails if you are 
authenticated to the relay operator. usually your access provider offers 
such a relay service.

open relays indicate the inability of their operator to act responsible 
in the internet. ... partly misled by click and pray software vendors.

Florian!

---

From: "Tom Thomson" <[email-masked]>
Date: Mon, 27 Oct 2003 12:15:43 -0000

> anonimity is currently being granted by SMTP.

It's really pretty straightforward, isn't it.

Some people want to receive anonymous mail.  Others don't.  So why don't we
have a protocol that provides several classes of service: anonymous mail,
mail where the originating server is authenticated, mail where the sender is
authenticated, maybe mail where teh country of origin is authenticated,
maybe a few more classes.  Individual email users can choose to accept one
or more of these three classes of mail.  Organisations concerned with civil
rights will presumably accept all classes, others will presumably accept a
restricted set.  Someone spamming for a seller of unprescribe prescription
deugs is not going to get much mileage out of his spam if the only people
who can receive it are human rights workers, so providing a decent set of
classes will effectively kill off such spammers.

Tom Thomson

---

From: "Jonathan A. Zdziarski" <[email-masked]>
Date: Mon, 27 Oct 2003 09:02:02 -0500

Hi Everyone,

I'm new to the group, and have spent the past year or so working on the
DSPAM project (http://www.nuclearelephant.com/projects/dspam/), as well
as working with the spamfilt group (a private group of other anti-spam
tool developers, mathematicians, and scientists).  I recently put
together a draft we're submitting for RFC at
http://www.ietf.org/internet-drafts/draft-spamfilt-inoculation-00.txt
after the next meeting is over.

Anyhow, I had a few comments to inject into this discussion that may or
may not be helpful.  Being new to the list, some of these things may
have already been discussed.

I had been discussing the concept of an authenticated SMTP system with a
few individuals for quite some time.  We've gone over many different
scenarios from using cipher keys in DNS records to full blown digitally
signed SMTP.  Ultimately one problem still remained: The public would
demand that authentication be something that can be easily implemented
(whether it be on a domain-name level, or even per-user), but if that's
the case then spammers, being that their nature involves both unethical
and sometimes illegal practices, would easily be able to create new
"authenticated" domains, companies, or users on a daily or weekly basis
to circumvent this mode of spam prevention.  It's a great concept, but
in order to work we would need to find a way to prevent spammers from
being able to authenticate on this system, and being that every country
has their own set of laws (or lack thereof) about spam, identification
practices, etc., implementing any type of authentication will only make
it more difficult until spammers come up with a system of adapting to
this new environment (e.g. either authenticating a new domain, company,
or person every few days, or finding a way to steal existing
identities).

My other concern with removing anonymity are the massive number of
issues it opens up for 1. government big-brother monitoring, 2.
significant liability issues, and 3. further commercialization of the
Internet by evil companies.  The reasoning behind this is that any
authenticated system that made it impossible for a spammer to simply
generate their own keys, etc., would require the implementation of some
form of a central registry and identification process, which leads to
all of these issues, and even further privacy issues down the road.  Not
to mention, full blown authenticated mail puts companies like Hotmail in
a precarious situation.  I'd personally rather have spam sent to my
email box than have to deal with any of these bigger headaches.  
 
Basically what I'm saying is that an authentication mechanism will stop
spammers in the present-day environment of sending spam, however since
this authentication mechanism must be made available to any entity
sending legitimate email, spammers would easily be able to adapt to
operate in an authenticated SMTP environment, even if you apply the
"shotgun" theory of chasing after them.