Subject: [stir] Thursday lunch discussion on new techniques for stopping robocalling

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 17 Mar 2018 09:33:49 -0400

Folks -

The problem of robocalling on the PSTN has only continued to increase over
the last few years. As with any battle this significant, we need multiple
tools on the table that can be used to fight it. Recently, Cullen and I
proposed some new ideas for techniques to work in concert with STIR -
notably https://tools.ietf.org/html/draft-rosenberg-stir-sipcoin-00 and
https://tools.ietf.org/html/draft-rosenberg-stir-callback-00.html . We'd
like to hold a lunch discussion to discuss these concepts and more
importantly, discuss other possible ideas people have on work the IETF can
do to increase the number of weapons in the arsenal.

We've got a room booked on Thursday lunch, room Hilton Meeting Rooms 1-4.
Anyone who'd like to discuss is welcome to join.

Thx,
Jonathan R.

-- 
Jonathan Rosenberg, Ph.D.
[email-masked]
http://www.jdrosen.net

---

From: Ted Hardie <[email-masked]>
Date: Sat, 17 Mar 2018 10:58:14 -0700

Hi Jonathan, Cullen,

I was somewhat surprised that the draft did not have a direct reference to
the SIP Hashcash work (especially since Cullen was the author of
https://tools.ietf.org/html/draft-jennings-sip-hashcash-06).  From my
perspective at least, it still looks to be a useful historical antecedent
to consult, since it is a proof-of-work system (and one on which a bunch of
later cryptocurrencies draw).  In particular, its view that this is about a
demonstration of work rather than a payment to send may still be a valuable
perspective.

http://www.hashcash.org/ still appears to be up, by the way, for folks that
want to see how its original use case tied into thwarting denial of service
attacks.

Ted

On Sat, Mar 17, 2018 at 6:33 AM, Jonathan Rosenberg <[email-masked]>
wrote:

> _______________________________________________
> art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/art
>
>

---

From: Jonathan Nelson <[email-masked]>
Date: Sat, 17 Mar 2018 12:10:02 -0700

Unfortunately I'm in DC during this meeting for the FCC/FTC joint session
on robocalling 3/23. Any chance of setting up a bridge for this lunch
discussion?

Thanks,

Jonathan Nelson
Hiya Spam and Caller ID

On Mar 17, 2018 6:34 AM, "Jonathan Rosenberg" <[email-masked]> wrote:

Folks -

Thx,
Jonathan R.

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 17 Mar 2018 15:27:02 -0400

This is mostly to blame on getting the draft together last minute. Of
course we're familiar with that document ;) We'll get that fixed in the
next rev.

The SIPCoin doc makes reference to the technique even though it omits the
citation. draft-jennings-sip-hashcash is in the category of challenge-based
solutions described in Section 6 of the draft. The problem with these
approaches in general is that, any amount of compute that incurs an actual
useful cost, would take far too long to perform, and thus impact actual
call setup delays. Bad guys and larger players might get around this by
distributing the work across machines in parallel, but it punishes the
'normal guy', which is not what we want.

Thx,
Jonathan R.

On Sat, Mar 17, 2018 at 1:58 PM, Ted Hardie <[email-masked]> wrote:

> http://www.hashcash.org/ still appears to be up, by the way, for folks
> that want to see how its original use case tied into thwarting denial of
> service attacks.
>
> Ted
>
>> The problem of robocalling on the PSTN has only continued to increase
>> over the last few years. As with any battle this significant, we need
>> multiple tools on the table that can be used to fight it. Recently, Cullen
>> and I proposed some new ideas for techniques to work in concert with STIR -

---

From: Steve Atkins <[email-masked]>
Date: Sat, 17 Mar 2018 13:49:13 -0700

> On Mar 17, 2018, at 10:58 AM, Ted Hardie <[email-masked]> wrote:
> 
> Hi Jonathan, Cullen,
> 
> I was somewhat surprised that the draft did not have a direct reference to the SIP Hashcash work (especially since Cullen was the author of https://tools.ietf.org/html/draft-jennings-sip-hashcash-06).  From my perspective at least, it still looks to be a useful historical antecedent to consult, since it is a proof-of-work system (and one on which a bunch of later cryptocurrencies draw).  In particular, its view that this is about a demonstration of work rather than a payment to send may still be a valuable perspective. 
> 
> http://www.hashcash.org/ still appears to be up, by the way, for folks that want to see how its original use case tied into thwarting denial of service attacks.

I hope someone is soliciting input from the email community, who went through this process a decade or so ago and noted that bad actors have much, much cheaper access to CPU for proof-of-work than good actors do.

Cheers,
  Steve

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 17 Mar 2018 17:08:41 -0400

I admit that I'm less than thrilled with having VoIP add to global warming.
Is that really what we want to accomplish, just as other blockchain-like
systems are getting, rightfully, dinged for that?

We have to consider that the most likely parties affected will be
legitimate mass callers, e.g., for emergency notifications or appointment
reminders, increasing their costs for no particularly good reason. As long
as this isn't universal, the bad guys will simply avoid such destinations.
(They don't seem to be focusing on the PBX market anyway - they may suspect
that corporate offices are not promising target markets for cruise deals
and credit repair pitches.)

Henning

On Sat, Mar 17, 2018 at 4:49 PM, Steve Atkins <[email-masked]>
wrote:

> > I was somewhat surprised that the draft did not have a direct reference
> to the SIP Hashcash work (especially since Cullen was the author of
> I hope someone is soliciting input from the email community, who went
> through this process a decade or so ago and noted that bad actors have
> much, much cheaper access to CPU for proof-of-work than good actors do.
>
> Cheers,
>   Steve

---

From: Richard Shockey <[email-masked]>
Date: Sat, 17 Mar 2018 17:40:44 -0400

+1   ☺  

— 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN +1 703-593-2683

From: stir <[email-masked]> on behalf of Henning Schulzrinne <[email-masked]>
Date: Saturday, March 17, 2018 at 5:08 PM
To: Steve Atkins <[email-masked]>
Cc: Applications and Real-Time Area Discussion <[email-masked]>, <[email-masked]>
Subject: Re: [stir] [art] Thursday lunch discussion on new techniques for stopping robocalling

I admit that I'm less than thrilled with having VoIP add to global warming. Is that really what we want to accomplish, just as other blockchain-like systems are getting, rightfully, dinged for that?

We have to consider that the most likely parties affected will be legitimate mass callers, e.g., for emergency notifications or appointment reminders, increasing their costs for no particularly good reason. As long as this isn't universal, the bad guys will simply avoid such destinations. (They don't seem to be focusing on the PBX market anyway - they may suspect that corporate offices are not promising target markets for cruise deals and credit repair pitches.)

Henning

Cheers,
  Steve

_______________________________________________ stir mailing list [email-masked] https://www.ietf.org/mailman/listinfo/stir

---

From: Ned Freed <[email-masked]>
Date: Mon, 19 Mar 2018 10:00:56 -0700 (PDT)

> I hope someone is soliciting input from the email community, who went through
> this process a decade or so ago and noted that bad actors have much, much
> cheaper access to CPU for proof-of-work than good actors do.

+1

And if anything it's even more lopsided now.

				Ned