Subject: Re: [Sipping] updated SIP and Spam draft

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 05 Mar 2007 12:45:52 -0600

Jonathan Rosenberg wrote:

> I've updated the SIP and Spam draft based on WGLC reviews and
> comments. Until it appears, you can pick it up at:
> 
> http://www.jdrosen.net/papers/draft-ietf-sipping-spam-04.txt

Jonathan:

Thanks for rev'ing up -04.  I went through your changes, and all
of my comments during the review were addressed sucessfully.

I do not have further comments on the draft, save a couple of
clarifications below.  I will leave it up to you whether or not to
include them in -05 and beyond.

* In S3.3, I wanted to suggest the use of tagged addresses as one
  possible solution to the "introduction problem" you posit in that
  section.  More specifically, there are programs (see TDMA,
  http://tdma.net/index.html) that combine temporal addresses with
  the challenge-response mechanism to solve the introduction problem.
  The basic issue with the introduction problem is that I cannot
  put a contact on my white list who I have never met before.  However,
  by combining temporal addresses and a challenge-response mechanism,
  I can do this as follows: I sent an email to my collegue who I have
  not conversed with in years, thus I am not on his white list.  His
  MUA does not recognize my email address, so it sends me a challenge.
  This challenge requires me to send an email response to a temporal
  address related to my collegue's real email address.  This temporary
  address expires in, say, 28 hours.  If I successfully send a response
  to the temporary address, I am automatically added to the white list,
  and the program sends my quarantined email to my collegue.

  This is equivalent to the challenge-response used in web-based
  captchas, except that (a) here, it is not visual or auditory, and (b)
  occurs entirely in email; no web-page is accessed.

  So, what does this mean for the text in S3.3?  You could leave it
  as is, which is fine with me.  Or better yet, if you agree on
  what I write below, you could replace the *last* paragraph of S3.3
  with the following:

    The introduction problem remains, however.  In email, techniques
    like the Turing tests (see Section 3.8) have been employed for this
    purpose.  Also, in email the introduction problem can be solved
    and managed to a great extent by automatic tools that use temporal
    addresses coupled with a challenge-response mechanism to maintain
    the white list.  Whether or not the techniques that work with
    email will be applicable to SIP spam is yet to be determined.

* Editorial nit: S3.8 - The last sentence of the first paragraph
  appears out of context.  The bulk of the paragraph talks about
  Captchas, and then in the end, there is a sentence on visual and
  auditory Turing tests.  I think it is better placed at the end
  of the first sentence, possibly in brackets.  Something like this:

    In email, Turing tests are those solutions whereby the sender of
    the message is given some kind of puzzle or challenge, which only
    a human can answer (since Turing tests rely on visual and auditory
    puzzles, they sometimes cannot be solved by individuals with
    handicaps.)

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 05 Mar 2007 15:13:03 -0500

inline.

> of my comments during the review were addressed sucessfully.

Great.

>  occurs entirely in email; no web-page is accessed.

I'm confused as to why this works. Why can't an automata send a response 
to the temporal address, getting itself added to the white list? I don't 
see how this prevents spam.

>    puzzles, they sometimes cannot be solved by individuals with

ok, fixed in my working -05. I can put it in with iesg and ietf last 
call comments.

THanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 05 Mar 2007 14:34:36 -0600

> see how this prevents spam.

It does not.  I was merely responding to what I thought was an
open question in S3.3; namely, how to solve the introduction
problem for white lists?

Two solutions exist: Turing tests for visual/auditory puzzles,
and challenge-response+temporal emails for email-based spam.

The fact that both of these solutions can subverted by automata
remains true.

Thanks,

- vijay