Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 09 Jan 2005 12:00:27 -0500

> > > No it would not be. You can't have it both ways. On one side, you
> > > say it would be cheap to decode CAPTCHAs by an army of human beings,
> > > but now you say it would be expensive to decode CAPTCHAs by an army
> > > of human beings.
> >
> > The legitimate list-owner has to handle 1,000 CAPTCHAs a week (for a
> > huge list).  That's $1.00.
> >
> > The spammer sends 100,000,000 messages per week.  That's $100,000.
> 
> No. The CAPTCHA based addresses are worth much more than an ordinary
> address. The CAPTCHA addresses don't filter spam, mail sent to them
> are guaranteed to be seen prominently by the recipient. So a spammer
> only needs to send 1000 spams to find a gullible person who'll respond.

These CAPTCHA based addresses are nearly worthless as compared to an
ordinary email address.  A spammer can use an ordinary email address 
for years.  A spammer can pay 0.1 cent to have a sub-address decoded
but the receiver will almost certainly deactivate this sub-address after 
the first time they receive spam.

Also there is no concern that any service that decodes the CAPTCHA on
behalf of a commercial entity will then secretly sell the list to spammers.
Paypal could have a company decode 20,000 of these CAPTCHA.  If this list was
given to spammers then it would be instantly obvious what happened after
the Paypal customers instantly deactivate these newly decoded sub-addresses
in response to spam.  The customers would also know that the spam was sent
using a sub-address sent to Paypal; go see Reflexion.net and how each email
will list the original owner of the sub-address whenever that sub-address is used
by an unknown entity.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 9 Jan 2005 13:21:14 -0500 (EST)

"Michael Kaplan" <[email-masked]> wrote:

> for years.

With a very low delivery rate.

>  A spammer can pay 0.1 cent to have a sub-address decoded but the
> receiver will almost certainly deactivate this sub-address after the
> first time they receive spam.

So the spammer has a big incentive to hit it hard, with many spams at
one time, for guaranteed delivery.  It's still worth something.

> Also there is no concern that any service that decodes the CAPTCHA
> on behalf of a commercial entity will then secretly sell the list to
> spammers.

There clearly is concern, since some of us have expressed it.

> Paypal could have a company decode 20,000 of these CAPTCHA.  If this
> list was given to spammers then it would be instantly obvious what
> happened after the Paypal customers instantly deactivate these newly
> decoded sub-addresses in response to spam.  The customers would also
> know that the spam was sent using a sub-address sent to Paypal; go
> see Reflexion.net and how each email will list the original owner of
> the sub-address whenever that sub-address is used by an unknown
> entity.

So Paypal loses.  But if it was the "Joe's Cheap Nigerian
CAPTCHA-Decoding Company" that Paypal used who was actually stealing
and selling the addresses, Paypal got screwed.  True, that company
will go out of business, to be replaced by "Mike's Cheap Nigerian
(etc.)"

Or maybe they'll just sell the addresses of their ex-customers, or
people who haven't done enough business lately.

Or if a few big users of Paypal wanted to screw Paypal, they could
release some sample of Paypal addresses, which (if they play the right
statistical games) would be very hard to trace back to them, and again
Paypal looks guilty.

Seth

---

From: Laird Breyer <[email-masked]>
Date: Mon, 10 Jan 2005 09:35:08 +1000

> the first time they receive spam.

It depends on your point of view.

Current email lists are worthless since three quarters of spam sent
doesn't reach valid users, of the remaining quarter spam filters
remove another three quarters, and the remaining 1/16th of the
original number competes with all the other spam that made it in an
undifferentiated way. Even then, spammers are forced to change header
contents continually to prevent being easily blacklisted, and must
write catchy content in the subject etc.

From a business perspective, the only indication that mail actually got
through to the recipient's eyeball is if he actually replies.

Contrast this with a valid sub-address. The sub-address is known to be 
valid, is known to be unfiltered, and is guaranteed to be visible to 
the recipient, without the need to compete in his inbox with scores of other
spams (otherwise the sub-address would have been deactivated long ago).

From a business perspective, this is like courier delivery.

Put another way, spammers send millions of email currently, with most
of those never reaching a person. If spammers were to send exclusively
to valid sub-addresses, then every mail sent would be guaranteed to be
looked at and stand out in their inbox. It doesn't matter that the
sub-address will be deactivated after it has been spammed, in fact
it's a useful service as it limits the spammer's competition from
taking advantage of the same sub-address.

-- 
Laird Breyer.