Subject: [Asrg] Passive Spam Revocation

From: Yao Ziyuan <[email-masked]>
Date: Mon, 26 Oct 2009 12:45:12 +0800

Passive Spam Revocation (PSR)

Currently almost all mail systems (e.g. Hotmail and Gmail) use a spam
filter, which can drop good and important messages.

I propose an optional feature for current mail systems. The main idea
is if a message is considered spam, this spam status can be tracked by
the sender (but not sent to him directly, as the From field can be
faked). The message can be re-marked as "not spam" if the sender can
solve a CAPTCHA.

STEP 1: A is going to send B a message. A's mail client generates a
random code and puts it in a custom field in the outgoing message's
header:
    PSR-Code: <random code>
STEP 2: A's mail client sends the message, waits 30 seconds, and then visits:
    https://spamstatus.<B's mail domain>/?msgid=<Message-ID>&code=<PSR-Code>
This page displays one of these possible "spam statuses":
    * MESSAGE CONSIDERED SPAM. (A CAPTCHA is also presented below.)
    * MESSAGE CONSIDERED NOT SPAM.
    * PENDING. PLEASE TRY AGAIN LATER.
    * All other responses mean B's mail system doesn't support this feature.
In the first case, A's mail client will report the status and the
CAPTCHA to A. A can choose to solve the CAPTCHA to prove the message
is not spam.

Like the idea? Here is the official Google group for it:
http://groups.google.com/group/passive-spam-revocation

Regards,
Yao Ziyuan
http://sites.google.com/site/yaoziyuan/

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 26 Oct 2009 08:57:02 +0100

> faked). The message can be re-marked as "not spam" if the sender can

The mailing system described below is equivalent to direct-to-MX 
mailing, except for the fact that the message is pre-fetched via 
regular SMTP, which may be regarded as a compatibility hack. In 
facts, the client connects directly to the recipient's server in 
order to formalize the submission.

Direct-to-MX delivery has been discussed previously on this list. 
Bill pointed out that funneling email through MSA systems run by 
providers had been conceived for the very purpose of authenticating 
authors and introduce domain-level accountability. See 
http://www.ietf.org/mail-archive/web/asrg/current/msg15593.html

Allowing direct-to-MX delivery is likely to introduce more spam. The 
requirement of human interaction would only raise the entry level 
for leveraging such opportunity. CAPTCHAs can be solved by low cost 
personnel, as it is currently done, e.g., by http://decaptcher.com/ 
at 0.002 USD per solved CAPTCHA. Although those micro-payments might 
be considered similar to e-postage, that money would flow toward the 
wrong ranks.

In addition, letting senders monitor whether their messages have 
been marked as spam may turn out to be an advantage for those 
senders who can tweak their messages until they cannot be discerned. 
That's the reason why several servers drop spam rather than 
rejecting it.

Finally, if widely adopted, PSR would hinder any form of mass 
mailing, even legit.

---

From: Claudio Telmon <[email-masked]>
Date: Mon, 26 Oct 2009 09:01:43 +0100

>     * MESSAGE CONSIDERED NOT SPAM.

A possibile problem is that a spammer can send a few test messages,
check which one is not considered spam and flood with the same kind of
message for a while, then check again and change format if required,
thus increasing spam effectiveness. It doesn't need to solve the captcha
for this.

-- 

Claudio Telmon
[email-masked]
http://www.telmon.org

---

From: Yao Ziyuan <[email-masked]>
Date: Mon, 26 Oct 2009 17:03:21 +0800

> CAPTCHA to A. A can choose to solve the CAPTCHA to prove the message

Showing a message's spam status to the sender can be bad, if he is
really a spammer. So the page can also return:
    * SPAM STATUS HIDDEN. (A CAPTCHA is also presented below.)
This means the sender can solve the CAPTCHA to see the status and
change it to NOT SPAM.

---

From: Rich Kulawiec <[email-masked]>
Date: Mon, 26 Oct 2009 05:43:58 -0400

On Mon, Oct 26, 2009 at 12:45:12PM +0800, Yao Ziyuan wrote:
> The main idea is if a message is considered spam, this spam status
> can be tracked by the sender (but not sent to him directly, as the From
> field can be faked). 

Providing useful intelligence about (a particular site's) spam filters
to spammers is a seriously bad idea.

---Rsk

---

From: Jose-Marcio Martins da Cruz <[email-masked]>
Date: Mon, 26 Oct 2009 11:08:15 +0100

> to spammers is a seriously bad idea.

On the other hand, consider valid the hypothesis that spammers don't 
know what kind of filter is being used (by some particular site) is also 
a bad idea.

JM

--

---

From: Claudio Telmon <[email-masked]>
Date: Mon, 26 Oct 2009 11:56:59 +0100

> This means the sender can solve the CAPTCHA to see the status and

This would solve the problem of spammers testing the filters without
solving the captchas. However, any automated mailing system would be
unable to take advantage of the system. If the goal is just to provide
an additional mean for people to check if their messages have been
delivered, this wouldn't be a problem, but it would require some changes:
- it would be useless to automatically check for the message status
(which would be HIDDEN anyway), unless you expect people to be willing
to solve captchas for every message they send
- message status should be availabe for a long time, since people would
use this opportunity only if they somehow suspect that the message has
not been delivered

-- 

Claudio Telmon
[email-masked]
http://www.telmon.org

---

From: Rich Kulawiec <[email-masked]>
Date: Mon, 26 Oct 2009 07:41:07 -0400

> know what kind of filter is being used (by some particular site) is also  

Oh, I agree.  It's long been known that [some] spammers have taken pains
to track the characteristics of target sites/systems/networks/etc.  And
some of those sites are (in various ways) "announcing" details of their
configuration to the outside world, which makes that task easier.

---Rsk

---

From: Pars Mutaf <[email-masked]>
Date: Mon, 26 Oct 2009 15:26:40 +0200

What if the CAPTCHA needs to be solved before the status can be seen?
That would work?

pars

On Mon, Oct 26, 2009 at 1:41 PM, Rich Kulawiec <[email-masked]> wrote:

> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg
>

---

From: Yao Ziyuan <[email-masked]>
Date: Tue, 27 Oct 2009 02:35:07 +0800

> What if the CAPTCHA needs to be solved before the status can be seen?

Right. The sender can set a "wait period" for every outgoing message
-- if the wait period is over and there is no reply, his mail client
can remind him to solve the CAPTCHA to see and fix the status.

---

From: Yao Ziyuan <[email-masked]>
Date: Tue, 27 Oct 2009 02:45:10 +0800

> Right. The sender can set a "wait period" for every outgoing message

for important messages

---

From: Rich Kulawiec <[email-masked]>
Date: Mon, 26 Oct 2009 17:27:41 -0400

> What if the CAPTCHA needs to be solved before the status can be seen?

Nope.  (Let me pause to note that there are a number of other problems
with this idea as well, I just didn't articulate those.)

The gap between "captcha which is difficult enough to defeat a program"
and "captcha which is easy enough to be solved by a human" has already
closed -- and even if it hadn't, spammers have numerous other techniques
available to them that scale reasonably well, including (a) captcha
replay and (b) mass cheap labor.  So I think it's reasonable that if
it becomes advantageous to spammers to solve captchas en masse, they will.

---Rsk