Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Fri, 07 Jan 2005 23:51:42 -0500

The following is an amalgam of responses to various people.

To once again clarify how erroneous bounces will be filtered:
Any email system that allows a user to generate a white list will be able to readily
generate a 'bounce white list' composed of all addresses that the user had sent
mail to within the past few hours.  The bounces generated by my system will
be identified as bounces by a universally recognized tag.  The user will
only see the bounces that are contained on the bounce white list.

> Every time a proposal comes up one of the key weaknesses in all of them
> becomes getting EVERYONE to use the system for it to work.

My system can be activated once email account at a time.  Simultaneous world wide
adoption is completely unnecessary.  Some attributes of my system (previously described)
are improved as more and more email providers update their systems.

>But more
> importantly I think a LOT of people are resisting, because your "solution"
> isn't really a solution at all, it's a "system" for dealing with spam not
> solving it. And more than anything it's not a solution, because it requires
> human interaction to work.

Our perspectives clearly differ, since I view it as a solution because it
requires human interaction.  I believe that this human interaction is as
limited and as non-disruptive as it can possibly be while still maintaining
an extreme degree of efficacy.  A solution that provides similar 
efficacy while requiring zero human interaction would be far superior, but
this "solution" just doesn't seem to exist.

> >>> No innocent user will ever get an erroneous bounce if a few of the
> >>> large consumer ISP adopt the system;
> >> [???]
> > I was unclear.  What I meant was that it would be a simple matter for
> > and email provider to recognize a bounce sent via my system.
> 
> Yes, though it's questionable whether anyone would want to implement
> special-case recognition for every new C/R challenge out there.  I
> certainly am not interested in doing so.

I'm not arguing that every C/R system be accommodated, I'm just arguing for my
system.
Anyway the world would be a better place if a standard was adopted so that every
bounce-like message (such as my system, traditional C/R systems, vacation messages)
came with a universally recognized tag.  Then my bounce white list filtering system
would prevent everyone from getting any kind of erroneous bounce.

> Perhaps this needs to be another FUSSP criterion: "it assumes it's the
> only system in use, or at least that everyone will be willing to add
> special cases for it".

I suggest that the following be removed from the FUSSP list:
"Spammers can't automate puzzle solving, character recognition,
or or other hoops in the FUSSP that legitimate users must jump manually."

One day it may need to be re-added, but it should be removed for now.

> ASRG got a pointer to my own system a while back:
> 
>      http://www.vsta.org/spam/
> 
> It has a lot of similarities to your own

Your system is very similar to Zoemail, and my system incorporates
many of the techniques of Zoemail.  My website details the
differences/advantages my system has over Zoemail.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Laird Breyer <[email-masked]>
Date: Sat, 8 Jan 2005 15:37:49 +1000

On Jan 07 2005, Michael Kaplan wrote:

> To once again clarify how erroneous bounces will be filtered: Any
> email system that allows a user to generate a white list will be
> able to readily generate a 'bounce white list' composed of all
> addresses that the user had sent mail to within the past few hours.
> The bounces generated by my system will be identified as bounces by
> a universally recognized tag.  The user will only see the bounces
> that are contained on the bounce white list.

The mail transport system will see, store, and analyse all the bounce
traffic regardless. Who are the beneficiaries? Individual mail
users. Who are affected indifferently or negatively? ISPs, admins,
software developers intending support. Who is in a position to
implement the proposal?  The latter group. Who does need convincing?

>  I believe that this human interaction is as limited and as
> non-disruptive as it can possibly be while still maintaining an
> extreme degree of efficacy.  A solution that provides similar
> efficacy while requiring zero human interaction would be far
> superior, but this "solution" just doesn't seem to exist.

What are the prospects for user-side automation? 

If X sends out a weekly newsletter to thousands of people, most of
whom use your system, then X receives thousands of bounce messages
back, requiring individual CAPTCHA decoding, followed by individual
resending of the message, does it not?

> Anyway the world would be a better place if a standard was adopted
> so that every bounce-like message (such as my system, traditional
> C/R systems, vacation messages) came with a universally recognized
> tag.  Then my bounce white list filtering system would prevent
> everyone from getting any kind of erroneous bounce.

Emails are sent through SMTP servers in the clear.

How does your system fare against snooping attacks, wherein any
relevant information such as sender + receiver's email addresses are
routinely harvested from archives, hacked and proxied servers, and
spyware infested computers, and fake bounces are sent back to each
identified sender, containing a spamvertizement? These fake bounces
are always whitelisted, are they not?

What is the effect of harvesting correct subaddresses by searching for
the replies to the CAPTCHA bounces, wherein the correct subaddress is 
visible in the clear?

What is the effect of bouncing the CAPTCHA bounce back to the CAPTCHA
bouncing recipient, with or without another CAPTCHA attached?

-- Laird Breyer.

---

From: Ken Raeburn <[email-masked]>
Date: Sat, 8 Jan 2005 06:40:47 -0500

> only see the bounces that are contained on the bounce white list.

Will that work in a world that still has a lot of mailing lists that 
don't rewrite the envelope sender data, such that bounces go back to 
the sender but from addresses the sender didn't send to?  Or do you 
break all such systems and require their replacement with something 
different, like SPF?

Personal email forwarding addresses are in some respects a special case 
of the above, except you can probably make a stronger argument for 
wanting envelope senders that do relate to the original sender, and not 
to the agent in the middle, for example for use by vacation programs at 
the final receiving site.

Ken

---

From: Seth Breidbart <[email-masked]>
Date: Sat, 8 Jan 2005 12:36:23 -0500 (EST)

Ken Raeburn <[email-masked]> wrote:

> the sender but from addresses the sender didn't send to?

That one I don't consider a problem; if you subscribe to a mailing
list and I post to the list, I _don't_ want to see anything automatic
 from you.  If you miss out on postings to the list because I won't
jump through your hoops, that's your problem.

Currently, such lists (e.g. bugtraq) are a problem for posters.

Seth

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 8 Jan 2005 19:40:15 +0100

On 2005-01-08 12:36:23 -0500, Seth Breidbart wrote:
>  from you.

I think he means it the other way around: Every time you post
something to a mailinglist, you get a lot of challenges because your
address isn't in the whitelist.

> If you miss out on postings to the list because I won't

But bugtraq does rewrite the envelope sender (it uses ezmlm's VERP
scheme). The problem with bugtraq is that a lot of people have software
installed which ignores the envelope sender and replies to the address
in the From: header instead. 

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 8 Jan 2005 20:22:02 +0100

> in the From: header instead. 

Speaking of which, I just got this bounce:

On 2005-01-08 11:59:42 -0600, System Administrator wrote:
> Your message
> 
>   To:      [email-masked]
>   Subject: Re: [Asrg] Please critique my anti-spam system
>   Sent:    Sat, 8 Jan 2005 11:52:44 -0600
> 
> did not reach the following recipient(s):
> 
> [email-masked] on Sat, 8 Jan 2005 11:59:41 -0600
>     The e-mail system was unable to deliver the message, but did not
> report a specific reason.  Check the address and try again.  If it still
> fails, contact your system administrator.The MTS-ID of the original
> message is:c=us;a= ;p=cool savings;l=CSMAIL20501081759CRQ9K8GR
>     MSEXCH:IMS:Cool Savings:ICN:CSMAIL2 0 (00120345) Too Many Hops
[...]

This is kind of rare: It is a correct DSN, but it didn't go to the
envelope address but to the header address. From the Received headers I
gather that 2 Exchange servers and something called "NetIQ MailMarshal"
were involved in the failed delivery of the mail, so probably one of
them discarded the envelope sender and recreated it (erroneously) from
the mail header.

Just a little example, where the mailing list does everything right, but
bounces still go to the wrong address.

	hp

---

From: Seth Breidbart <[email-masked]>
Date: Sat, 8 Jan 2005 18:04:05 -0500 (EST)

> address isn't in the whitelist.

For a "public" mailinglist (such as this) I'd consider that the same
as challenges due to forgery: spam.

> in the From: header instead.

Good point.  OK, substitute some other list instead.  (I just thought
of bugtraq due to the huge amount of garbage I get whenever I post
there.)

Seth

---

From: Ken Raeburn <[email-masked]>
Date: Sat, 8 Jan 2005 23:54:14 -0500

> address isn't in the whitelist.

I meant both, actually. :-)
More to the point, I wanted to know what Michael Kaplan thought about 
the various situations:

1) Sender isn't filtering bounces but multiple list members are using 
his system and thus issue challenges.

2) Sender is filtering bounces (either approach that's been discussed 
-- discard all bounces generated by this system because you object to 
it, or look for recognized addresses as the bounce sender), and 
multiple list members are using his system

3) Sender is filtering bounces, and the original recipient address is a 
simple mail forwarding service, with the final destination running his 
system

I've deleted the email with the URL, and it's out of my browser's 
history now, but I don't recall the proposal addressing these points 
from my earlier reading.

I'd be kind of disappointed if his answer turns out to be the same as 
for SPF (i.e., don't forward without rewriting the envelope), but 
offhand I don't see what else would work without losing a lot of mail, 
which I would consider unacceptable.