Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sat, 08 Jan 2005 23:50:14 -0500

> Wouldn't the newsletter operator first have to obtain the specific
> sub-address from each receiver (assuming your system is widely deployed)
> at least once? That's a thousand bounces (ie number of recipients) right
> at the start.

The address is provided by the recipient when they sign up for the newsletter,
just like what is done now.

> Also, there are privacy implications in outsourcing the processing of
> sensitive email messages to cheap third parties?

Outsource the CAPTCHA, not the entire message.

>What happens if a
> Nigerian spammer outfit offers 0.1 cent per bounce processing, and
> keeps a record of these bounce messages, reads each CAPTCHA and
> compiles a clean set of email addresses which are guaranteed to accept
> spam messages?

In the critique section of my webpage I detail how tremendously
costly this would be for spammers.

> Each such deactivation generates a number of automatic CAPTCHA bounce
> messages for people trying to contact that sub-address. The more
> snooping occurs, the higher the frequency of deactivation, and the
> higher the amount of work on senders. However, snooping implies
> guaranteed spam delivery, so is much more valuable than ordinary mail
> address harvests, and is easy to do with a distributed infrastructure.
 
I'll leave others to comment with more knowledge, but I doubt that
snooping occurs with such an extreme degree of frequency that it would
disable this system.  This system is ideal for dealing with an address
that is occasionally snooped.

> The existence of these CAPTCHA messages are an inherent security risk,
> because they are allowed to be passed to the receiver's inbox without
> checks of any kind, on a priority basis, provided a weak set of
> credentials is bundled. This weak set of credentials consists of
> a public email address identifying the purported sender, if I understand
> your proposal correctly.
> 
> The obvious line of attack given the above is as follows: A spammer
> writes a CAPTCHA containing an advertisement rather than a
> sub-address, and inserts as the sender of this fake CAPTCHA an email
> address which is likely to belong to the receiver's whitelist.
> 
> Sometimes, this fake CAPTCHA is blocked because the inserted address
> is not on the receiver's whitelist, but this doesn't matter to the
> spammer as the mail did not cost him much to send. Sometimes, the
> inserted address belongs to the receiver's whitelist, in which case the
> advertising payload gets priority treatment, bypassing all spam defenses
> as it could be a legitimate challenge.

An email service provider that has not no accommodation to my system
would treat a fake bounce just like any other piece of spam, ergo the spammer
would have no incentive to fake a bounce.

An email service provider that has accommodated my system will treat a fake bounce
just like an erroneous bounce.  The bounce white list will only allow in bounces 
coming from an address that the user had emailed within the past few hours.
The fake bounce will never be seen, ergo the spammer would have no incentive
to fake a bounce.

> Perhaps you are unaware of the fact that email is much like a
> postcard, without the stamping security measure. Anybody at any time
> can read messages, or in fact modify them in every way, so long as
> they are located within the relevant mail path. The honour system
> is the only widespread protection in existence.
> 
> Valid sub-addresses can also be harvested automatically on users'
> computers by spyware. Valid pairs of (sender/receiver) addresses can
> be harvested from public archives of mailing lists, and such pairs can
> be used to send spam disguised as a fake CAPTCHA challenge as
> described above.

I don't have to hypothesize about the efficacy of multiple sub-addresses.
Zoemail and Reflexion users have many satisfied customers.

I don't mean to flood the list with postings concerning my system,
but since my initial posting I've only been responding to follow-up
posts.  Although flaws exist, I am pleased (at least in my view) that 
no killer flaws have been illuminated, and that no reason has been
given why it wouldn't be highly efficacious at blocking spam even when
employed by a massive number of people.  Much of the concern seems focus
on inconvenience to people who do not use the system, and I still can't
bring myself to believe that this inconvenience is severe enough to kill
the system, especially given the severity of the spam problem.  I accept
that others feel differently.

Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Ken Raeburn <[email-masked]>
Date: Sun, 9 Jan 2005 00:10:13 -0500

> The fake bounce will never be seen, ergo the spammer would have no 

If some system is down, the message may not reach its destination -- 
and thus a legitimate bounce may not be sent -- for a few days.  It 
varies by system configuration.  I'd recommend keeping the entries for 
maybe a week.

Ken

---

From: Laird Breyer <[email-masked]>
Date: Sun, 9 Jan 2005 15:52:57 +1000

> just like what is done now.

You mean the sub-address? How many unique sub-addresses do you expect people
to carry in their heads, or do you expect each person to carry around
a sub-address generator everywhere, for such occasions? 

> Outsource the CAPTCHA, not the entire message.

The CAPTCHA contains the key to generating the required sub-address. That's
all that is needed. 

> costly this would be for spammers.

No it would not be. You can't have it both ways. On one side, you say
it would be cheap to decode CAPTCHAs by an army of human beings, but now
you say it would be expensive to decode CAPTCHAs by an army of human beings.

I'm saying if the CAPTCHAs are decoded at 0.1 cent a pop, then the decoder
can increase profits by 100% simply by reselling the decoded CAPTCHA at
0.1 cent a pop.

> that is occasionally snooped.

Your system seems to *require* that addresses be snooped only
occasionally, as you don't appear to have given much thought yet on
the equally valid possibility that addresses be snooped very
frequently. Might I suggest you think through the case of frequent
snooping and write down solutions for the implications as part of your
case studies?

> would have no incentive to fake a bounce.

That's incorrect. Your bounce, when treated like any piece of spam,
will arrive into a user's inbox about 30% of the time, just like any
other piece of spam.  (global deployed spam catch rates appear to be
around 70% or so). The spammer therefore has the following incentives
after harvesting:

* 30% of fake CAPTCHA challenges go through to the wider population.
* 100% of fake CAPTCHA challenges go through to the population which deploys
  your system. 

>  An email service provider that has accommodated my system will
> treat a fake bounce just like an erroneous bounce.  The bounce white
> list will only allow in bounces coming from an address that the user
> had emailed within the past few hours.  The fake bounce will never
> be seen, ergo the spammer would have no incentive to fake a bounce.

Of course the fake bounce will be seen, since it has the correct
sender address. Remember that a few hours is a million years for a
computer.

> Zoemail and Reflexion users have many satisfied customers.

How many customers do Zoemail and Reflexion have in total? Aren't you
perhaps generalizing from insufficient data? You are after all proposing
a system for the masses, so you must think in terms of hundreds of 
millions of users.

> posts.  Although flaws exist, I am pleased (at least in my view) that 

If the postings are becoming off topic, the chair should probably step
in and say so. Otherwise, this is still a semi-technical discussion
(and it is certainly not intended to be personal). 

> that others feel differently.

It takes time to understand a system invented by someone else, so flaws
if any don't show up on a strict schedule.

Inconvenience is not the sole focus of the criticisms I've followed on
this thread. I've seen people list at least the following:

* Unacceptable increases of mail traffic.
* Incompatibility with mailing lists.

You've argued that the increase of traffic can be kept to 5%, but that
seems wildly optimistic to me. Here's a procedure for increasing the
traffic by much, much more:

Consider a mailing list serving 1000 people. Assume that each such
person has given a single unique sub-address to the mailing list
operator, and the mails being distributed by that list are therefore
accepted without filtering by each of the 1000 people.

One of these people is a spammer, who begins to send spam messages
through the list after a short time. Each of the 1000 users now
receives unfiltered spam through the list address, and decides to turn
off their list sub-address. The next time some message is sent via the
mailing list, 1000 CAPTCHA bounces are sent to the mailing list
operator. Conclusion: one single message sent by a spammer to the list
has resulted in 1000 CAPTCHA bounces, representing approximately
100,000% increase in traffic for the operator over a short time.

There's also the fact that list messages (such as your own to this
list) often arrive twice, once through the list and once directly.  If
I used your system, I would be sending you a CAPTCHA bounce which
would be clogging your inbox. You would get a bounce for every user
you replied to on this list, and requiring you to place me and all
other members of this list on your whitelist over time.

-- Laird Breyer.

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 9 Jan 2005 01:22:35 -0500 (EST)

> costly this would be for spammers.

I think you misunderstood.  The market rate for bounce processing is
.1 cent.  The Nigerian spammer outfit offers bounce processing for
.099 cents.  Unbeknownst to their customers, they also steal the
deliverable email addresses.  Now they're getting those addresses for
.001 cent each, or actually just making less profit than their
competitors.

Seth

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 9 Jan 2005 01:30:57 -0500 (EST)

Laird Breyer <[email-masked]> wrote:

> No it would not be. You can't have it both ways. On one side, you
> say it would be cheap to decode CAPTCHAs by an army of human beings,
> but now you say it would be expensive to decode CAPTCHAs by an army
> of human beings.

The legitimate list-owner has to handle 1,000 CAPTCHAs a week (for a
huge list).  That's $1.00.

The spammer sends 100,000,000 messages per week.  That's $100,000.

> I'm saying if the CAPTCHAs are decoded at 0.1 cent a pop, then the
> decoder can increase profits by 100% simply by reselling the decoded
> CAPTCHA at 0.1 cent a pop.

A lot more than that, since most of the .1 cent is cost.  But he can
resell them for less, because they're free.

Seth

---

From: Laird Breyer <[email-masked]>
Date: Sun, 9 Jan 2005 16:39:04 +1000

> The spammer sends 100,000,000 messages per week.  That's $100,000.

No. The CAPTCHA based addresses are worth much more than an ordinary
address. The CAPTCHA addresses don't filter spam, mail sent to them
are guaranteed to be seen prominently by the recipient. So a spammer
only needs to send 1000 spams to find a gullible person who'll respond.

And if the MUA implements special processing for the CAPTCHA challenges
(e.g. blinking popup window "please respond NOW to ensure mail delivery"),
then any fake CAPTCHAs are now getting a royal treatment even.

> resell them for less, because they're free.

Yes.

-- 
Laird Breyer.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sun, 9 Jan 2005 15:54:03 +0100

On 2005-01-09 15:52:57 +1000, Laird Breyer wrote:
> > > at least once?

How often do you subscribe to newsletters while away from your computer
(or any computer with internet access)?

If I was using Michael's system I'd probably carry a list of a dozen
pregenerated sub-addresses in my wallet and expect that to last a few
years (Well, actually I'd use the same list to give valid subaddresses
to individuals during face-to-face meetings, so it would be expleted a
lot faster).

> The CAPTCHA contains the key to generating the required sub-address. That's

No, not necessarily. Although the Michael's example presents the CAPTCHA
together with the invariant parts of the mail address, this isn't
necessarily the case. It would be possible to separate them in such a
way that the recipient could keep the invariant parts secret and pass
only the puzzle to the outsourcing company. So the outsourcing company
would know that the solution of the puzzle is "LUCKY", but they don't
know that the full address is <[email-masked]>. Of course they
could try all combinations of addresses and solutions, but that would be
extremely expensive if the system is deployed widely (if it isn't, they
won't bother).

> would be clogging your inbox.

No, you wouldn't, unless you had the subaddress already disabled, in
which case you wouldn't receive mails from the mailinglist either
(unless you explicitely whitelisted the mailinglist).

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Laird Breyer <[email-masked]>
Date: Mon, 10 Jan 2005 02:17:53 +1000

> (or any computer with internet access)?

There are a few cases depending on the amount of roaming involved.

I can be away from my computer while being on some computer with
reduced resources (think publicly provided terminal and telnet(!) ), 

I also can have several computer accounts used separately and
simultaneously for mail, with widely varying software/OS environments.
(On occasion, I've had four or five such mail accounts used as convenient,
although currently I use one mail address, but several computers)

I can also be subscribed by someone else as a service (e.g. by office
staff etc.), in which case I need not be physically at a computer at all.

I can subscribe by talking to someone and writing an address on a
piece of paper. I can subscribe by browsing the net while on someone
else's computer.

That said, I actually like your paper based solution quite a lot, and 
it is much less cumbersome than looking for a sub-address generator 
on some remote computer while roaming. 

So I think I now agree with you that most initial list subscriptions
would involve a sub-address, and no CAPTCHA bounce for the list
operator.

> extremely expensive if the system is deployed widely (if it isn't, they

Hmm. This would work I think, but to be safe from related attacks the
customer who receives the CAPTCHA would have to remain anonymous to
the outsourcing company. 

> (unless you explicitely whitelisted the mailinglist).

Either you're confused or I am. Michael sends me two messages, once as
Michael (which is unsolicited, and he's not whitelisted, so gets a CAPTCHA),
and once as [email-masked], which is whitelisted since I've subscribed to 
the list. 

-- 
Laird Breyer.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sun, 9 Jan 2005 18:54:32 +0100

> and once as [email-masked], which is whitelisted since I've subscribed to 

But both messages are sent to an active subaddress, so they are
accepted without a CAPTCHA. See
http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

| Zack now has a completely functional and unique email address for Joe
| (e.g. [email-masked]). Zack can share this fully functional
| email address with other friends. These other friends now send email
| to Joe using the address ([email-masked]) given to them by Zack.

| Zack can pass on [email-masked] to Bud. Bud successfully mails
| Joe using [email-masked], but when Joe replies his return
| address will appear as [email-masked]. Bud now has two separate
| addresses that he can use to communicate with Joe, but in time he will
| become more likely to use [email-masked] as this will always
| appear as the return address whenever he receives email from Joe.

Only when you deactivate the the subaddress (because some spammer has
harvested the ASRG mailing list archive and is spamming that address),
CAPTCHAs will be generated in response to mails from non-whitelisted
senders. So at that point you would have to decide whether you want to
whitelist [email-masked] (which would lead to your scenario of
sending out lots of CAPTCHAs and being thrown off the list) or
resubscribe with a new subaddress (which is a bit of a hassle,
especially if you are subscribed to lots of mailing lists). In both
cases you have to remember that your subaddress <laird.ghqwr@...> was
the one you used to subscribe to the ASRG before deactivating it
(Hopefully your software gives you an easy way to look up the usage of a
subaddress).

("Deactivating" the subaddress seems to be a misnomer. AFAICS Michael's
proposal doesn't allow a subaddress to be really deactivated once it is
created. It is only put into "Accept mails only from whitelisted
addresses and send a CAPTCHA to everybody else" mode)

	hp

---

From: Laird Breyer <[email-masked]>
Date: Mon, 10 Jan 2005 09:14:35 +1000

> http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

How would Michael's MUA know the subaddress? Only the list expander knows
the subaddress. Michael's MUA sends mail to the main address, which replies
with a CAPTCHA.

-- 
Laird Breyer.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Mon, 10 Jan 2005 10:54:54 +0100

On 2005-01-10 09:14:35 +1000, Laird Breyer wrote:
> How would Michael's MUA know the subaddress?

It's in your From: header.

> Only the list expander knows the subaddress. Michael's MUA sends mail
> to the main address, which replies with a CAPTCHA.

That's not the way I understood that it works.

ISACS rewrites all outgoing mails to contain a unique subaddress for
each recipient. Thus all your mails to the mailing-list will contain
your subaddress for the recipient [email-masked], (e.g. <laird.123@...>),
not your main address <laird@...>.

When Michael hits the group reply button, his MUA will take the
addresses from the headers and compose a mail to <[email-masked]> and
<laird.123@...> (It doesn't know that this is a subaddress, nor what the
main address is).

	hp

---

From: Laird Breyer <[email-masked]>
Date: Wed, 12 Jan 2005 13:25:46 +1000

> <laird.123@...> (It doesn't know that this is a subaddress, nor what the

I didn't think it would be this way, as that would make spam attacks so much
easier.

Consider the following: I give a subaddress laird.123@... to
the ASRG mailing list. I now send a message to the list.

1) If the ASRG expander forwards my subaddress laird.123@... to everybody
on the list, then everybody knows my subaddress and can send me mail without
being filtered. Moreover, the public archives at

http://news.gmane.org/gmane.ietf.asrg.filtering/

now list the subaddress laird.123@... , so anyone on the internet can send
me mail without being filtered.

2) If the ASRG expander censors my subaddress, ie claims the mail is from
laird@..., then anybody replying to me privately must still pass a CAPTCHA.
But at least the list expander is the only entity which can use the unfiltered
subaddress.

-- 
Laird Breyer.