Subject: Re: [Asrg] Please critique my anti-spam system

From: Danny Angus <[email-masked]>
Date: Wed, 5 Jan 2005 11:14:33 +0000

Michael,

> Thank you for your feedback.  I have updated my website in response to
what I
> believe were the most significant criticisms of my method, and I believe
that
> my method is now devoid of any major flaws.

Charmingly put, but you're sadly mistaken!

You have failed to address the major flaw in your process which occurs
because your system introduces a new message into the transport system for
every questionable message identified by your system.

It is not enough to simply mask spam from end-users where this is done at
the expense of a significant increase of load other parts of the system,
particularly those parts outwith your control, and most importantly those
parts for which there will be a tangible dollar cost.

The fact that low volume systems may have excess capacity does not mean
that increasing load is without cost though it may be accomodated without
expenditure. What it does mean is that part of the cost of the redundant
capacity is now associated directly with the generated messages. Likewise a
system which is efficiantly utilising close to its full capacity would
require investment in infrastructure to allow it to participate.
Your system does not make this participation optional. Any party
transporting mail destined for any party using your system would require to
double their capacity for that route.

Any effective system must be cost effective, not just technically complete.
The cost of transporting unwanted email is already a significant part of
the problem and your system will increase, rather than reduce, this cost.

d.

***************************************************************************
The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient (or responsible for delivery of the message to the intended recipient) please notify us immediately on 0141 306 2050 and delete the message from your computer. You may not copy or forward it or use or disclose its contents to any other person. As Internet communications are capable of data corruption Student Loans Company Limited does not accept any  responsibility for changes made to this message after it was sent. For this reason it may be inappropriate to rely on advice or opinions contained in an e-mail without obtaining written confirmation of it. Neither Student Loans Company Limited or the sender accepts any liability or responsibility for viruses as it is your responsibility to scan attachments (if any). Opinions and views expressed in this e-mail are those of the sender and may not reflect the opinions and views of The Student Loans Company Limi!
 ted.

This footnote also confirms that this email message has been swept for the presence of computer viruses.

**************************************************************************

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Danny Angus <[email-masked]>
Date: Thu, 6 Jan 2005 09:27:01 +0000

> I suspect that many of the participants of this list use and manage email
in a way that
> is very different than the way that the average Joe does.

Professionally and with expertise you mean?

> Ergo the flaws in my system (such as graphical support) may be
> absolutely intolerable to the people involved with the
> ASRG but these same flaws may be trivial to the average Joe.

But surely it is the professionals and the experts whom you wish to
convince of your proposal's
efficacy and desirability? Why else have you asked them to criticise your
proposal?

It seems to me that you hope to achieve the approval of this group but are
not prepared to
compromise your pet project in response to well informed, well intentioned
and cogent points
raised against it.
If you are only interested in appealing to the average Joe I suggest you
seek your approval
elsewhere, where you may receive a less honest and more acceptable
palliative review.

> Eliminating spam for most, if not all people, would be an accomplishment.

No doubt. However I'm quite sure that mail administrators in ISP's and
corporations the world over
would look in dismay at cost of accomodating the use of a system which
requires that an outgoing
message be sent for every unwanted incoming message.

> There is still some concern that the bounces will "spam" innocent people.

>If we arbitrarily guess

Ah yes, a good solid "arbitrary guess"

> that 1 out of 50 forged spam return addresses represents a real active
account,
> and if we assume that bounces will only be sent back to 5% of spams after
filtering,
> then we would have a 'bounce spam' problem that is only 1/1000th the size
of the spam
> that is being sent out.

Of course this is an "arbitrary guess" and does not represent anything like
the real world.
What about those virii which send mail floods with real addresses? I seem
to recall several occasions when
these floods resulted in real headaches for sysadmins trying to cope with
the bounces.

>  This is not even taking into account the ease with which a bounce can be
> prevented from reaching a user if that user had not sent out the
corresponding email.

Preventing its receipt is one thing, preventing its transport is quite
another.

> I do not believe that this will be the flaw that sinks this system.

Perhaps not, but don't underestimate the intelligence of the people who
will be required to make the
commercial decision to adopt your proposal.

d.

---

From: Danny Angus <[email-masked]>
Date: Fri, 7 Jan 2005 09:24:32 +0000

Michael,

> Well, I do plan on voicing my proposal to a larger venue.

I don't think that is an unreasonable thing to do.

> If I then receive the same level of doubt then
> I'll just crawl into a corner and start taking crazy pills.

Don't do that, instead take the criticisms on board and evolve your idea
into something that really hits the spot, what you have is "ownership" of
the beginnings of a system plus you are evangelical and determined to
succeed, these are valuable assets. Involve those who have reservations and
encourage them to help you resolve the issues they raise. The criticism
isn't personal its technical and by-and-large well intentioned.

If stopping spam was easy someone would already have found the silver
bullet by now and we'd all be sitting with our feet up, instead we're _all_
still looking. ;-)

d.

---

From: "Thomas Gal" <[email-masked]>
Date: Fri, 7 Jan 2005 16:44:30 -0800

(oops...here's the content)

	I'm reminded of a time I was using a computer belonging to a not so
tech savvy friend of mine to surf the web. As I'm browsing, I get to to a
site I frequent, where much to my chagrin a POPUP appears telling me that a
popup was blocked. I start thinking about it, and while I used to think that
popup ads advertising popup blockers were the most rediculous thing in the
world, and I'm dumbfounded by the fact that someone installed such a
program. 
	Now clearly you've noticed quite a few people hammering on the flaws
of your proposal, but really it's no less than the brutal interchange that
has become the norm in this space. I will say that one of the common themes
across many of the proposals is forcing a lot of people(users, and
user/transfer/submission agents) to change, which your system does heavily.
Everytime a proposal comes up one of the key weaknesses in all of them
becomes getting EVERYONE to use the system for it to work. But more
importantly I think a LOT of people are resisting, because your "solution"
isn't really a solution at all, it's a "system" for dealing with spam not
solving it. And more than anything it's not a solution, because it requires
human interaction to work. People want to save time, and not get bombarded
by emails that don't server a purpose ( a direct transactional purpose as
opposed to a self serving one). People who deal with this stuff all the time
CRINGE at the thought of anything that sends more contentless emails.
	So the really big difference ends up being, that you're trying to
find a way to get rid of spam, when the more valid question is "how do I
make sure that my mail can legitamately be identified as having come from
me, and get's through to my intended recipient in a timely and efficient
manner which no longer requires my interaction, and can be differentiated
from illegitamate mail so as to not harm my reputation."

-Tom

[email-masked]  

> 
> > 
> > Eliminating spam for someone else at the cost of increasing 
> it for me 
> > is not an acceptable tradeoff, and I will take action to 
> ensure that 
> > the costs of implementing such a system rebound to the 
> dis-benefit of 
> > the implementer.
> > 
> > Seth
> 
> <snip>
> 
> > Well, things have gotten to the point where I'm not saying anything 
> > new, and neither is anyone else.
> > Some have suggested that I am blowing off valid criticisms.  
> > If anything I am merely suffering from a severe lack of 
> insight as I 
> > am still unable to appreciate why the residual flaws are 
> severe enough 
> > to disregard a proposed system that could theoretically 
> conveniently 
> > eliminate spam for so many consumer level email users.  Well, I do 
> > plan on voicing my proposal to a larger venue.  If I then 
> receive the 
> > same level of doubt then I'll just crawl into a corner and start 
> > taking crazy pills.
>

---

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 09 Jan 2005 03:01:53 -0500

> More to the point, I wanted to know what Michael Kaplan thought 
> about the various situations:

> 1) Sender isn't filtering bounces but multiple list members are 
> using his system and thus issue challenges.

In such a case the sender would get a lot of bounces.  The simplistic
filtering system that my system uses to prevent such bounces 
would be become much more prevalent if my system became so popular that 
a significant number of list members were using my system.

The list operator should also then drop these deactivated bounce-generating
email addresses from the list as well.

> 2) Sender is filtering bounces (either approach that's been 
> discussed -- discard all bounces generated by this system because 
> you object to it, or look for recognized addresses as the bounce 
> sender), and multiple list members are using his system

If you send mail to [email-masked] then you won't get bounces from other
people if you have the filter.

> 3) Sender is filtering bounces, and the original recipient address 
> is a simple mail forwarding service, with the final destination 
> running his system

Are we no longer talking about a mailing list here?  Are you asking how
would the sender receive a legitimate bounce if the email were sent without
a sub-address?  I think I know some work arounds but as my knowledge of
the intricacies of email is limited I'll defer this to more experienced members
of the list.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

---

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 09 Jan 2005 11:31:05 -0500

----- Original Message -----
From: "Peter J. Holzer" <[email-masked]>
To: [email-masked]
Subject: Re: [Asrg] Please critique my anti-spam system
Date: Sun, 9 Jan 2005 14:32:00 +0100

> 
> On 2005-01-09 13:29:41 +1000, Laird Breyer wrote:
> > On Jan 08 2005, Michael Kaplan wrote:
> > > > If X sends out a weekly newsletter to thousands of people, most of
> > > > whom use your system, then X receives thousands of bounce messages
> > > > back, requiring individual CAPTCHA decoding, followed by individual
> > > > resending of the message, does it not?
> > > > It almost sounds as if you expect most newsletters to get bounced.
> > > The newsletter will only get bounced if the specific 
> > sub-address used by > the newsletter is deactivated.  Wouldn't 
> > the newsletter operator first have to obtain the specific
> > sub-address from each receiver (assuming your system is widely deployed)
> > at least once? That's a thousand bounces (ie number of recipients) right
> > at the start.
> 
> Probably not. The User would generate a fresh subaddress and subscribe
> that to the newsletter. Since Subaddresses are created in "accept
> everything" mode in Michael's proposal, the newsletter would be accepted
> without a challenge. Only when the subaddress is deactivated, challenges
> will be generated. (On a well-maintained newsletter this will probably
> cause the address to be unsubscribed)
> 
> 
> However, subscribing to mailinglists may be a bit difficult with
> Michael's scheme:
> 
> Lets say, Our user Joe tries to subscriben to the mailinglist
> <[email-masked]>. So he creates a new subaddress (e.g.,
> <[email-masked]>) and enters into a web form or sends it to
> <[email-masked]>. Typically, the mailing-list software will
> reply with a confirmation request: from:
> <[email-masked]> to: <[email-masked]>. When Joe
> replies, his software will generate a new unique address, since he never
> sent mail to <[email-masked]> before (e.g.,
> <[email-masked]>). So the Mailinglist-Software will receive a
> confirmation from <[email-masked]> to subscribe the address
> <[email-masked]>. Some mailinglist software will refuse the
> request if the two addresses don't match.
> 
> Even if he manages to subscribe, however, the first time he wants to
> send something to the mailinglist, the software will create yet another
> unique address (e.g., <[email-masked]>), since he hasn't sent
> anything to <[email-masked]> yet. Since most mailinglists only allow
> postings from subscribed addresses, his message won't get through
> (Some, but not all mailing lists allow you to specify alternate
> addresses).
> 
> So at the very least, any software implementing Michael's proposal needs
> to allow the user to override the automatic generation of new
> subaddresses. (This of course means user interaction and it means user
> errors - I know that I often make errors of that kind when I first post
> to a new mailinglist)
> 
> > Perhaps you are unaware of the fact that email is much like a
> > postcard, without the stamping security measure. Anybody at any time
> > can read messages, or in fact modify them in every way, so long as
> > they are located within the relevant mail path. The honour system
> > is the only widespread protection in existence.
> 
> That and the sheer number of mail paths. A spammer is probably not in a
> position where he can intercept a significant number of mails.
> 
> 	hp
> 
> --
>     _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
> |_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
> | |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
> __/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
<< 1.2.dat >>

---

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 09 Jan 2005 18:43:04 -0500

> On 2005-01-09 14:36:01 -0500, Michael Kaplan wrote:
> > > Again you are assuming that everybody will be using the same system.
> > > How can the mailing list software know that they are a single entity?
> > > After all <peter.holzer@wsr...> and <peter.janecek@wsr...> aren't two
> > > mail addresses of the same person, either. One is mine, the other
> > > belongs to a colleague two doors down the hall.
> >
> > When my system is activated all existing addresses are grandfathered in.
> > Now peter.holzer@wsr as an individual activates my system
> 
> No, he doesn't. Please stop assuming that everybody will use your system
> immediately. Even if your system wins out eventually, there will be many
> years where a significant portion of the email users don't use it. Also
> you must assume that there will be competing systems. So maybe the WSR
> will adopt a system where subaddresses are constructed with '+' as a
> delimiter, and AON will use one where subaddresses are constructed with
> '-' as a delimiter. (And others will maybe use / or $ or whatever)
> 
> > and he can use any sub-address he wants except the system will not
> > allow him to use "janecek."  Now no one else can establish an account
> > with a peter.????@wsr address.
> 
> Which would be unacceptable, given a company policy that everybody
> should have an email address of the form <firstname.lastname@domain> and
> the number of Peters around here.
 
I'm not insisting on using "."
Agreement can be made on using another keyboard symbol for this system.
Whether ; # * ! < or whatever is used is not important.  I'm sure that
whatever symbol is used there will be someone somewhere who will be
inconvenienced, but by picking a less common symbol the number will
be far less.  It's fine with me if peter.holzer;8j2ms7@wsr is used.

Picking a less commonly used symbol for this system will
solve most of the concerns you had about the way this system
interacts with mailing lists.

Michael Kaplan

---

From: "Hannigan, Martin" <[email-masked]>
Date: Mon, 10 Jan 2005 01:05:41 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Laird Breyer
> Sent: Sunday, January 09, 2005 6:35 PM
> To: [email-masked]
> On Jan 09 2005, Michael Kaplan wrote:
> > > 
[SNIP]

> It depends on your point of view.
> 
> Current email lists are worthless since three quarters of spam sent
> doesn't reach valid users, of the remaining quarter spam filters

Bounces are used as validators in many cases. The sponsors 
buy these lists and they want some deliverability. It's
inevitable that a filter will get some, but that's not the
spammers problem. The method is the spammers problem.

> remove another three quarters, and the remaining 1/16th of the
> original number competes with all the other spam that made it in an
> undifferentiated way. Even then, spammers are forced to change header
> contents continually to prevent being easily blacklisted, and must
> write catchy content in the subject etc.

You need to differentiate the sponsor
from the spammer. They are *usually two seperate entities
these days. Sponsor BUY$ the spammers services. The sponsor
is the scammer, seller, phisher, or whatever is the trend of
the day.

Let's call this the usual current hiearchy:

SPONSOR
   SPAMMER - High speed spam engine
     BOT HERDER - Gets the bots
      RBL VERIFICATION - Sells the quality measure
       BOT ARMY - Sends Spam
        LEGIT MTA - Delivers Spam
         RECIPIENT - Gets Spam

Oh. And they're all different people or machines. They
can be one, but they also can be many. Think $$.

-M<

---

From: "Hannigan, Martin" <[email-masked]>
Date: Mon, 10 Jan 2005 01:38:40 -0500

> Seth Breidbart
> Sent: Monday, January 10, 2005 1:23 AM
> To: [email-masked]
> "Hannigan, Martin" <[email-masked]> wrote:
> >> From: [email-masked] 
> [mailto:[email-masked]]On Behalf Of
> >> Seth Breidbart
> >> "Michael Kaplan" <[email-masked]> wrote:
> 
> >> > Let's do the math.  A spammer finds 5% of his spam 
> reaches people.
> >> Way high.
> >
> > Define reach. Hit the disk or eyeball? Sorry if I'm behind here.
> > I think MORE reaches people.
> 
> Hits the eyeball, since disks don't buy stuff.
> 
> We'd have to get good estimate from someplace like AOL.
> 
> Also, a lot of place block at the IP level, so the spam never gets in
> to the spambox in the first place.
> 
> Seth

I think a lot depends on what your provider or company does
and who your upstream is although no blocking is taking place
at tier 1 as far as I am aware.

I'm not up on local provider methods anymore, but I'd think AOL
vs. Hotmail would be interesting.

-M<

---

From: Danny Angus <[email-masked]>
Date: Mon, 10 Jan 2005 09:23:46 +0000

> Create
> the lhs of the Message-ID signed with a private key that changes
> daily.  If the "response" doesn't have one you could have generated
> recently, it's bogus.

It is a compelling idea, but remember that the message id can be generated
at any of a number of different tiers (hops) and can't be altered once it
has been created. This itself isn't a problem. If each tier uses this
system we have a kind of granuarity of attribution (sent by me, sent by my
office, sent by my office's ISP) and gradually weakening "trust" but it
also means you need to publish the public keys upwards to allow any of the
higher tiers determine if the mail is sent by a legitimate subsidiary tier.

You would want to do this because it would allow you to remove bogus
messages near the top of the stack and save infrastructure resources by not
having to transfer it any further.

I'm sure that similar systems have been dicussed in the past, I know I've
discussed some ideas around trust based systems, I also think there is
still a lot of merit in the idea if it could be made to work. It seems that
dicussions faded out as people spiralled their ideas in towards MARID.

d.

---

From: "Michael Kaplan" <[email-masked]>
Date: Mon, 10 Jan 2005 14:31:24 -0500

> Guaranteed deliverability is a big thing.  Divide that by the fraction
> that are delivered now, and see how big it looks.

I had hoped that use of ISACS would be efficacious enough so that no spam filtering of any kind would be needed for emails that were sent using a proper sub-address.  From the reaction on this list it is obvious that routine filtering should also be applied to emails sent with a proper sub-address.

Problem solved.

A relatively weak filter would likely suffice, so ISACS would still
produce fewer false positives than current filters.
Or use a strong filter - whatever floats your boat.

Also there has been some misunderstanding concerning my assertion that bogus addresses would impede spammers.  If the spammer is paying someone to manually decode the CAPTCHA then being forced to decode the CAPTCHA of a bogus email account will impede (i.e. cost money) the spammer.

Michael Kaplan

---

From: "Tim Bedding" <[email-masked]>
Date: Tue, 11 Jan 2005 12:37:40 -0000

> I imagine that, as per the purpose of this group, that any
> serious anti-spam proposal that is not blatantly unworkable would
> be considered by this group until it was either found to be
> too flawed or until it was accepted by the group.

How does your system cope with being sent email by an anonymous
remailer?

Regards
Tim

Crusade - The Rules of the Game
Gideon: I wouldn't recognise the mayor of
  my town if he came up and bit me on the ankle.

---

From: "Michael Kaplan" <[email-masked]>
Date: Tue, 11 Jan 2005 22:21:21 -0500

> How does your system cope with being sent email by an anonymous

Email sent with a valid sub-addresses will be handled just like an ordinary email address.

I guess you mean what will happen when you use an anonymous remailer and you send email without a sub-address.  If the person you emailed is not anonymous then the remailer will simply forward the bounce back to you in an unaltered manner.

If both parties are to remain anonymous then the anonymous remailer service will need to upgrade.  The bounce will first arrive at the remailer.  The remailer will then replace the true email address within the bounce with a made-up email address and send it on to you.  You now solve the CAPTCHA and successfully send the email back the stranger.

The bounces used by ISACS will be highly standardized so it will be easy for anonymous remailer services to swap the real addresses within them for an anonymous one.

Michael Kaplan