Subject: Re: spam

From: "J. Noel Chiappa" <[email-masked]>
Date: Tue, 27 May 2003 20:36:02 -0400

> From: Dean Anderson <[email-masked]>

    > If the corporation (like hotmail) brings in less than $1 per month from
    > each user, pays all .. from this revenue, then quite clearly, there are
    > no hidden costs, as you assert.
    > Clearly, spam can not cost more than they bring in, in revenue, else
    > they would go out of business.
    > There are sites that offer email services (unsubsidized), for $1 - $2
    > per month. They also have no hidden costs, and no subsidies.

You appear to be deliberately obtuse.

The costs of spam, to the users, include not just the cost of the emailbox,
but also the costs to process the mail. This includes, principally, their time
- a component on which others (including you) are not capable of placing a
value.

If the only cost associated with spam was the cost of storing/forwarding the
email, I'll wager most people wouldn't care.

Anyway, this whole discussion is moot. I'm sure there is rough consensus in
the IETF that getting rid of spam is a good idea. (Maybe a question worthy of
a plenary hum to confirm this.)

The only question left is if there are any *technical* components to doing so
(which would be the IETF's preserve), and, if so, what they are.

	Noel

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 28 May 2003 18:17:56 +0200

On woensdag, mei 28, 2003, at 02:36 Europe/Amsterdam, J. Noel Chiappa 
wrote:

> Anyway, this whole discussion is moot.

I couldn't agree more. The bottom line is that most people simply don't 
want to receive spam, often to the degree that they are willing to pay 
extra to get rid of it.

> I'm sure there is rough consensus in the IETF that getting rid of spam 
> is a good idea. (Maybe a question worthy of a plenary hum to confirm 
> this.)

> (which would be the IETF's preserve), and, if so, what they are.

It surprises me that so many people are so eager to declare defeat 
before even trying the protocol route. (With current protocols defeat 
is pretty much inevitable.) If we adopt such an attitude in other areas 
as well, we would all refuse to have locks on our doors because they 
don't stop all burglars, and refuse to call the police when someone is 
assaulted on the street because the perpetrator may have a diplomatic 
passport.

The problem with spam isn't that legitimate business are legitimately 
advertising legitimate services. (Although even in those cases I never 
gave them my email address so even this type of spam isn't completely 
above board.) For that, filtering or unsubscribing should keep the 
problem within reasonable bounds. Without forgery it isn't all that 
simple to bypass filters and legitimate businesses lose more than they 
gain from trying to do so.

The problem is that we are subjected to all kinds of filth and scams, 
and the SMTP protocol is severely abused in the process in order to 
avoid filtering. And this is only going to get worse over time, as 
people get more adept at avoiding spam. Spammers then simply have to 
send out more messages and address even more perverse "demand" to make 
money. Going after them in the real world won't work for the same 
reason that the war against drugs doesn't work: limiting supply only 
increases profit for the remaining suppliers so it's more attractive 
than ever to enter the game. So if we can't get spam under control 
(which isn't the same as eliminating it) by doing something about 
supply or demand, we have to do it in the middle by giving users the 
means to blacklist spammers or whitelist legitimate correspondents and 
make it sufficiently hard to fake an identity to get around this.

I don't think moving to some kind of SMTPng is quite as impossible as 
people seem to think. Receiving wouldn't be a problem anyway because 
the new service would simply fall back to SMTP when delivering 
messages. Most service providers would be thrilled to switch to a near 
spam-free email service given the opportunity, so email between service 
providers wouldn't be the problem. Email between customers and their 
service providers wouldn't be a problem either: here regular SMTP can 
be used together with existing authentication mechanisms. So that 
leaves people running their own mail server: either they have to 
upgrade, or subscibe to an upgraded email service.

About the "charging for email" thing: this doesn't have to be actual 
money. Doing it with some kind of cryptographic token that is passed 
from sender to recipient should work just as well in making sure people 
can't send many orders of magnitude more email than they receive, and 
this wouldn't have many of the adverse effects of using money for this.

Mabye a BOF would be in order in Vienna?

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 28 May 2003 10:02:41 -0700

Iljitsch van Beijnum wrote:
> ...

Rather than passing a token, require the mail to be encrypted with the
public key of the recipient. This would do two things, make it expensive
to send mass random mailings, and provide an incentive for the ISPs to
actually deploy a PKI.

> Mabye a BOF would be in order in Vienna?

A better idea than leaving the problem to languish as a research topic.

Tony

---

From: Keith Moore <[email-masked]>
Date: Wed, 28 May 2003 13:30:31 -0400

> A better idea than leaving the problem to languish as a research

standard IETF operating procedure - start trying to engineer a solution
before the problem is understood.

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 28 May 2003 19:02:32 +0100 (BST)

> before the problem is understood.

you need to engineer new problems for workgroups to work on.

L.

"We invented congestion! So we could invent congestion control!"

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 20:45:09 +0200

Tony writes:

> Rather than passing a token, require the mail to
> be encrypted with the public key of the recipient.

Public-key encryption of an entire e-mail is extremely processor-intensive.
Even conventional encryption is very time-consuming.  You can just hash it
and sign the key.

However, this would be a problem for people in countries that outlaw
encryption.  What would they do?

> ... and provide an incentive for the ISPs to
> actually deploy a PKI.

Who would you trust to certify keys?

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 28 May 2003 13:45:39 -0500

on 5/28/2003 11:17 AM Iljitsch van Beijnum wrote:

> people seem to think.

Although I'm all for an SMTPng, it's important to delineate the benefits
that would be served from such an approach, and also some discussion on
how difficult this would be.

For example, a protocol would not be able to confidently deter the
transfer of unsolicited commercial email over a valid connection by
itself. However, an SMTPng by itself could specifically address the issue
of accountability.

The accountability information could in turn be used to help fight
forgeries, and this information would help to combat some kinds of spam.
It would help get a spammer's account yanked due to AUP violations since
you would be able to prove where the spam came from (assuming the ISP
enforced an AUP that prohibited spam). By the same measure, it would also
be useful for authoritatively rejecting mail from those ISPs who don't
enforce AUPs or who don't prohibit spam, and it would be usefule for
authoritatively rejecting mail from organizations who are known to be
spammers themselves (in these cases, it would effetively allow for better
blacklists). If we had a way to validate the transfer path (such as using
recursive signatures on the transfer path), then the accountability would
be further heightened by allowing us to reject any mail that had passed
through any of the known-offender networks. These would all be
improvements over what we have today, giving us better accuracy in our
rejection policies, but still allowing some spam through the network (eg,
first offenders).

Improved accountability would also substantially improve the enforcement
of anti-spam laws, should any exist. Since the improved accountability by
itself would not be sufficient to stop all spam, there would still be a
need for laws. Those laws would be significantly strengthened by the extra
accountability information. A strong law in conjunction with accurate and
credible filters would cumulatively be very effective in the fight against
spam, possibly even good enough to "win" the war.

An SMTPng could also help against forgery-related problems. This includes
common spam-related fraud, but also includes outright fraudulent
misrepresentations, worms, etc.

Co-existence with legacy SMTP is a problem. If it easy for spammers to
avoid using SMTPng, then they will stick with legacy SMTP. There are
operational ways for reducing the exposure (including heavily discounting
mail from SMTP during post-transfer filtering), but the hammer of law is
still going to be necessary to kill that problem. At the same time, if we
know that we can't directly fix this in protocol, then there is some
validity to the argument that we can just keep using the existing SMTP and
hope that laws do the rest. In that regard, the substantitive gain from
doing all of the work necessary is in the improved accountability that
SMTP *cannot* provide in its current form (even if all of the options such
as STARTTLS are used).

This is how I think an SMTPng might work:

  C: <connect>
  C: <send certificate>
  S: <validate host identity>
  S: ok
  C: <request transfer>
  S: ok
  C: <send transfer headers>
  S: <validate sender identity>
  S: <validate transfer path>
  S: <validate recipients>
  S: <...>
  S: ok
  C: <send message headers, possibly encrypted/signed>
  S: <validate headers (eg pass/reject contents)>
  S: ok
  C: <send message body>
  S: ok
  C: <close>

That gives a lot of data to validate and substantially improves the level
of accountability over anything that SMTP can offer in its current form.

There are lots of other things that could be incorporated once this was
done which would further add to the value proposition. In fact, the
long-term value to an SMTPng would be to address all of the other
mail-related issues that are also already outstanding besides just the
credibility shortcomings. This includes features such as encrypted message
headers (rather than just bodies), true i18n support, per-recipient
message routing (similar to the expiremental MB and other per-recipient
RRs), end-to-end option negotiation across the messaging network (in
addition to the hop-by-hop negotiation we have now), extensible OIDs as
response codes, reduced round-trip latencies, and more.

Things that would probably be needed to support any of this:

  - new transfer protocol syntax (replace HELO with certificate
    exchange, for example)

  - optionally a new submission service

  - URI and DNS types for the submission services

  - new message routing services separate from MX routing

  - new message format (separating transfer headers from message
    headers from message contents, which are all one unit currently)

  - MIME types for each message component, for compatibility with
    legacy mail stores

  - gateway rules for conversion betwen 821 and ng

This is a lot of work for the sole purpose of improving accountability but
it would probably be necessary in order to get beyond what SMTP can
provide today. It is much more justifiable if we are going to reinvent
mail for other purposes at the same time.

I also want to reiterate that we still need laws regardless of whether we
go to a new SMTPng or stay with SMTP. My feeling is that we (collectively)
should go ahead and start pursuing legal enforcement methods for use with
SMTP now, regardless of what we end up doing over the next five years on
the technology front. As such, I think the legal-interaction issue needs
to be addressed first.

I am also in favor of reinventing mail. It's a standing joke against the
IETF that people can readily commit flagrant forgeries in one of the most
important technologies of our time.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Dean Anderson <[email-masked]>
Date: Wed, 28 May 2003 15:39:09 -0400 (EDT)

On Wed, 28 May 2003, Iljitsch van Beijnum wrote:

> before even trying the protocol route.

We tried protocols 5 years ago. They haven't worked.  I've explained why
specifically, and why in theory they can't work.  Now the protocol
designers say that controlling spam wasn't the goal. It was the goal when
they started. Perhaps they should have stayed focused.

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 28 May 2003 13:10:11 -0700

> Public-key encryption of an entire e-mail is extremely 

Which is precisely the goal. It is not so extreme as to make routine
mail unusable, but extreme enough to make random bulk mail not worth the
cost.

> Even conventional encryption is very 
> time-consuming.  You can just hash it and sign the key.

That simply provides message integrity, the point is to make the cost
for the bulk sender higher than for the individual receiver. 

> 
> However, this would be a problem for people in countries that 
> outlaw encryption.  What would they do?

Break the law, because it is likely they are anyway for anything that
those laws are designed to prevent. ;)

Realistically, those situations would be addressed by including a plain
text copy as well. The agency concerned about enforcing encryption laws
could run the plain text part through the same encryption process and
verify that the output matches. Alternatively, the origin could be
required to encrypt using the enforcement agency key, then have the
enforcement point decrypt & re-encrypt with the receiver's key. Either
way there is enough pain felt at the enforcement point to ensure any
random bulk spam is dealt with locally and quickly.

> Who would you trust to certify keys?

For the purpose of email through the ISP servers, the ISP would be able
to handle key certification. Those keys may or may not be useful or
meaningful outside the context of services arranged by that ISP. 

Tony

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 06:20:47 +0200

Tony writes:

> Which is precisely the goal. It is not so extreme
> as to make routine mail unusable, but extreme enough
> to make random bulk mail not worth the cost.

Point taken, although I think conventional encryption would probably a
better choice for this purpose.

I think, though, that a more effective method would be to find something
that one can require on each message and that is not trivially easy for a
computer to do automatically.

For example, the various admininstrations passing through the White House
have long had a policy of establishing a "secret number" or similar text
that must be placed on any incoming letter that is to be forwarded directly
to the President or his family with minimal screening.  The President and
family then give this number to a select few people.  Any correspondence
without the number goes through all the usual screening.

This works because the number is an out-of-band datum that the average
sender is not likely to have.  It is communicated from human being to human
being, and isn't to be found anywhere in public.  So it cannot be
automatically added by a machine, nor can unauthorized people add it.

A simple e-mail implementation of this would be to place a random string in
the subject line of a message intended for a specific recipient that serves
the same purpose as this "secret number."  The string would be different for
each recipient, and the only way to obtain it would be through some
out-of-band process (such as contacting the recipient by phone, or
something).  Since there would be no record of this anywhere that spammers
could harvest, it would be impossible for spammers to include these numbers
on outgoing mail.  Very simple, and very effective.  It would, however, be
nice to have e-mail clients that automated this, by allow for a secret
number field in address books that would make it possible to insert them
automatically on outgoing mail (most clients already provide a way to filter
for such numbers on incoming mail).

Digital signatures and similar authentication would work but are overkill.
All you need is some bit of information that spammers cannot harvest, and
the above random string fits that purpose.  Spammers might pick up your
address on a newsgroup or Web site, but they'd have no way of discovering
your secret number.

> That simply provides message integrity ...

Hash it and sign it with the public key of the recipient.  That would work,
because spammers would not have the public key, whereas legitimate senders
would.

However, I think the secret-number concept described above would be much
similar and would be just as effective.

---

From: [email-masked]
Date: Thu, 29 May 2003 01:13:45 -0400

On Thu, 29 May 2003 06:20:47 +0200, Anthony Atkielski <[email-masked]>  said:

> the same purpose as this "secret number." 

This works for the somewhat restricted case of e-mail between people who
already have some out-of-band way of communicating.

You're welcome to extend your proposal to handle bootstrapping
communications between people who haven't before - if the whole intent
of the "secret number" is so I can ignore email without it so I don't
get spam, people can't send me e-mail to ask me for a secret number
so they can e-mail me...

And if I *still* have to check my mail that doesn't have the number on it,
in case I've missed a request like that, what has this proposal bought me?

> because spammers would not have the public key, whereas legitimate senders

Only if it's an *UNPUBLISHED* public key - at which point it just degenerates
into your "secret number" protocol, with the same bootstrapping issues.

---

From: Doug Sauder <[email-masked]>
Date: Thu, 29 May 2003 02:39:42 -0400

Do we have to solve *the* spam problem?  How about a much simpler, solvable 
problem that perhaps a large majority of email users struggle with?

The hard problem is how to allow people to be generally accessible by email, 
but not so accessible that they get tons of spam.  In other words, how they 
can participate in a public forum -- say a newsgroup or mailing list -- 
allowing other individuals to contact them with non-spam, while keeping the 
spam out.

The easy problem is how to allow two consenting parties to communicate via 
email without interference from spam.  Not everyone feels it's necessary 
that they participate in a public forum.  Many would be happy if just the 
easy problem were solved.

The easy problem has not been solved satisfactorily.  Some options:

1. Get multiple email accounts.  Some are throw-away accounts.  Some are 
closely guarded, but eventually end up compromised.

2. Change email addresses from time to time.  For many users, that, to them, 
means changing ISPs.

3. Just learn to live with spam.

4. Try a filter and live with false positives.

Those are the options available to average email users.  For more capable 
users, there is another option:

5. Some clever ad hoc solution.  Like putting a special string in the 
subject line.

As this easy problem is a truly solvable problem, and one that many people 
care about, why not solve it in a standard way?

See my further comments below...

Anthony Atkielski wrote:
[snip]
> for such numbers on incoming mail).

As Anthony's suggestion implies, the solution is simple.  It works like 
this: You can get into my email imbox because I authorized you to get in. 
You prove that you are authorized by presenting the "secret" that I provided 
to you.

While some would prefer to re-engineer the entire Internet mail system, I 
just see that average users would be happy if email from their relatives, 
friends, co-workers, and acquaintances went into one folder, while 
everything else went into another folder, automatically.  Why is that so 
hard to do?  Why isn't it done?

Personally, I think that plus aliases (also called subaddresses) are the 
best way to solve the easy problem.  But I would be thrilled to see the 
problem solved for the sake of Joe Average User by whatever technique: plus 
aliases, secret number in the subject line, new mail header field, or any 
other good idea.  Once that problem is solved sufficiently, we can go back 
to our research problems.

BTW, some commercial enterprises are on to this idea in a big way.  Just as 
one example, there is ZoEmail (www.zoemail.com).

-- 
Doug Sauder
Hunny Software, Inc

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 09:27:12 +0200

Valdis writes:

> You're welcome to extend your proposal to handle
> bootstrapping communications between people who
> haven't before ...

There isn't any way to automate this without opening the door to spammers.

> ... if the whole intent of the "secret number"
> is so I can ignore email without it so I don't
> get spam, people can't send me e-mail to ask me
> for a secret number so they can e-mail me...

Correct.  They'll have to ask you in some out-of-band way.  There isn't any
other option.  Any means you provide of obtaining your secret number without
your explicit, out-of-band approval will be used by spammers just as readily
as by anyone else.  There is no unambiguous, automated way to distinguish
between spammers and any other sender of unsolicited e-mail.

> And if I *still* have to check my mail that
> doesn't have the number on it, in case I've missed
> a request like that, what has this proposal bought me?

Not very much, but for people with a small circle of legitimate
correspondents as compared to the volume of e-mail they receive, it might
help.

In the world of postal mail, the same problem of spam exists, and there is
no solution to it.  Political figures, celebrities, and organizations
receive incredible volumes of unsolicited, junk mail; the one and only way
to separate the truly useless mail from legitimate mail is to hire human
beings to sort through it.  There isn't any other way.  And prosecuting
those who send mail improperly doesn't work, either; it stops one entity
from sending mail, but all the rest continue, so the incoming volume does
not decrease.

If you send a letter to the President of the United States, he may not read
it himself, but the letter will definitely be read by a human being.  All
incoming mail is read.  The same is true for all incoming e-mail.  And the
President is not the only one having this done.  Many celebrities have staff
or subcontractors that do nothing but read every piece of incoming mail.
There isn't any other option.  And prosecuting someone who sends mail
illegally, or sends threats, or something like that, does nothing to slow
the flow of mail overall.

It may be that spam is an insoluble problem.  No automated filter can
protect against it.  No after-the-fact prosecution or lawsuits can slow the
flow significantly.  No billing scheme can slow the flow of spam without
equally affecting the flow of legitimate e-mail, because there isn't really
any fundamental difference between the two, except in the eye of the
recipient.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 09:32:07 +0200

Doug writes:

> Do we have to solve *the* spam problem?

I'm beginning to think that it cannot be solved--not technically, and not
legally.  One man's spam is another man's legitimate e-mail.  It's like
censorship.

> The hard problem is how to allow people to be
> generally accessible by email, but not so accessible
> that they get tons of spam.  In other words, how they
> can participate in a public forum -- say a newsgroup
> or mailing list -- allowing other individuals to contact
> them with non-spam, while keeping the spam out.

Agreed.  Most spammers seem to pull addresses from newsgroups, discussion
forums, and Web sites.  Addresses of mine that appear on none of these never
receive any spam.

> While some would prefer to re-engineer the entire
> Internet mail system, I just see that average users
> would be happy if email from their relatives,
> friends, co-workers, and acquaintances went into
> one folder, while everything else went into another
> folder, automatically.

I agree.

> Why is that so hard to do?

It's not.

> Why isn't it done?

Probably because the same people who might easily be able to use such a
system are not receiving spam, anyway, because their e-mail addresses are
invisible to spammers (they don't post to USENET, they have no Web sites,
they've never given their e-mail address to a Web site, and their e-mail
address is largely immune to a dictionary or exhaustive attack).

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 29 May 2003 16:51:06 +0200

On woensdag, mei 28, 2003, at 21:39 Europe/Amsterdam, Dean Anderson 

> specifically, and why in theory they can't work.

I'm not interested in a discussion about semantics so we can define the 
problem as solvable or unsolvable.

I found the following to be an interesting read: 
http://www.cdt.org/spam/

It shows that even five years ago or so most ligitimate businesses 
advertising legitimate services through spam employed header forgery. 
If we can't stop spammers from spamming we should at least be able to 
stop them from doing so in ways that add insult to injury by derailing 
the entire email service.

So let's have that BOF.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 09:44:08 -0600 (MDT)

> From: Iljitsch van Beijnum <[email-masked]>

> advertising legitimate services through spam employed header forgery. 

It is an article of faith for many people that most spam involves
header forgery, but no one seems to have better support than intuition
for that faith.  Where in the report at http://www.cdt.org/spam/ does
it say that "most ligitimate businesses advertising legitimate services
through spam employed header forgery?"  I found "forged addresses and
domain names as the source of innumerable problems" and similar
statements, but they differ signficiantly from the familiar claims
that most spam involves header forgery.  Moreover, since that report
there have been the Flowers.com case and many state laws against header
forgery that I think have discouraged a lot of header forgery.

A lot of spam does involve header forgery, but a lot clearly does not.
The problem with concluding that "most" spam uses header forgery is
that it encourages looking for solutions to header forgery instead of
stopping unsolicited bulk mail.

That leads to a major problem in dealing with spam.  Most people
who say they want to stop spam in fact have other goals that they
value more.  Those other goals include:
  - stopping header forgery,
  - making all mail "authenticated," for various notions of that word,
  - stopping commercial email, and never mind that an order confirmation
     is commercial,
  - stopping unsolicited commercial email (Never mind that many of us
     depend on unsolicited non-bulk commercial email for our daily bread),
  - selling anti-spam services or software,
  - counting coup on spammers by "LARTing" them, signing them up for
     junk postal mail, etc,
  - becoming famous for having stopped spam, or at least getting into
     the RFC index.

Vernon Schryver    [email-masked]

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 29 May 2003 18:54:45 +0200

On donderdag, mei 29, 2003, at 17:44 Europe/Amsterdam, Vernon Schryver 

> through spam employed header forgery?"

Ok, I can't find it right now, and the thing is too big to completely 
reread.

> stopping unsolicited bulk mail.

Stopping header forgery would be useful in and of itself, but 
regardless of that it will also help against unsollicitated bulk email. 
I downloaded the list with known spam address blocks from spews.org. It 
lists around 1600 spammers and 14000 addresses or address blocks. 
Obviously spammers are trying hard to cover their tracks. Filtering out 
1600 spammers is easier than filtering out many more thousands of 
individual addresses. I'm assuming we can come up with some identifier 
that's harder to change than an IP address.

A quick look at a week's worth of email for an account I've used to 
post to Usenet for nearly 10 years (370, 98% spam or mailinglists I 
can't unsubscribe) tells me around 75% of the spam I received either 
has obvious header problems or employs some kind of anti-anti-spam 
measure. Also around 75% is of a pharmaceutical, sexual or financial 
nature (often at least two of those at the same time). There is no 
obvious correlation.

> value more.

Yes, it seems like many of them are more interested in perpetuating the 
status quo.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 11:08:36 -0600 (MDT)

> ...
> Stopping header forgery would be useful in and of itself, 

Many people who say that have strange notions of "header forgery."
They consider using your home mail address as a sender or return email
address when sending mail while away from home to be "forgery" but
they don't have any problems using their home postal addresses on
postcards while on vacation.

>                                                           but 

That is not logical, unless you assume that spammers have no
alternative to using header forgery.

> that's harder to change than an IP address.

That is a tall assumption.  Unless you involve national governments,
I've never yeard of an identifier that is harder to change than an IP
address, except when you get your IP addresses from ISPs that look away
from the spam of their customers and the customers of their resellers.
Such ISPs would be as happy to sell new identifiers of whatever sort
you like to spammers as they have been happy to rent IP addresses.

> nature (often at least two of those at the same time). There is no 

I notice that you wrote "header problems" instead of "forgery."

> Yes, it seems like many of them are more interested in perpetuating the 

I do not agree with that.  Some people do have usually unconcious
interests in the status quo, but most people are doing illogical
things like attacking header forgery as if spammers could not create
zillions of valid user names at free or cheap providers or domain
names and avoid header forgery.

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 13:34:05 -0400 (EDT)

> the entire email service.

Agreed. But I think the current legislation will make header forgery
illegal, and already is in some states.

I expect that Type 1 spammers will comply. Some already are.

		--Dean

---

From: Dave Aronson <[email-masked]>
Date: Thu, 29 May 2003 17:06:10 -0400

On Thursday 29 May 2003 01:13, [email-masked] wrote:

 Va> On Thu, 29 May 2003 06:20:47 +0200, Anthony Atkielski
 Va> <[email-masked]>  said:
 ...
 Va> > Hash it and sign it with the public key of the recipient.
 Va> > That would work, because spammers would not have the
 Va> > public key, whereas legitimate senders would.
 Va>
 Va> Only if it's an *UNPUBLISHED* public key - at which point
 Va> it just degenerates into your "secret number" protocol,
 Va> with the same bootstrapping issues.

Correct, but still methinks Anthony is onto something.

Yes, a spammer could get hold of your public key.  However, this 
"tailoring" means that he's going to have to send the spam to each 
recipient individually, instead of using a huge Bcc list.  This won't 
get rid of spam entirely, but it could put somewhat of a damper on the 
flow.

The big question is, how many recipients are there (To + Cc + Bcc), for 
the average piece of outbound spam?  That is roughly the ratio by which 
such a scheme will make it costlier to spam.  (I'm purposesly ignoring 
the extra cost of the hashing and encryption.  These will probably make 
a small contribution, by comparison.)  Anybody got a large corpus of 
spam, COMPLETE WITH BCC LISTS, to analyze?

Then comes the followup question of whether that ratio is enough to be 
worth the trouble of further investigation along this path.  Keep in 
mind, they could always simply apply the usual Microsoft solution: throw 
more and faster hardware at it.  Note also that a lot of spam is already 
sent to single recipients per piece.  In those cases, the extra costs of 
hashing and encryption MIGHT make a SMALL dent, but I doubt it would be 
enough to be worth the hassle.

-- 
David J. Aronson, Unemployed Software Engineer near Washington DC
See http://destined.to/program/ for online resume, and other info

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 22:22:21 +0200

> I expect that Type 1 spammers will comply. Some already are.

Of course they will.  The whole idea of Type 1 spammers is to provide a way
for you to contact them, anyway, so they have little incentive to hide.

---

From: Andrew Shore <[email-masked]>
Date: Thu, 29 May 2003 22:07:01 +0100

>  - becoming famous for having stopped spam, or at least getting into

     And on that subject, would Doug be willing to write up his 
"subaddresses" proposal as a draft? Or would that be counterproductive 
to its eventual acceptance? At least three of us have proposed variants 
on this theme, and while it will not put an end to spam overnight, it 
will be a useful beginning. I realise there may be patent issues... ^^

Andrew.
-- 
Andrew Shore.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 29 May 2003 23:51:51 +0200

On donderdag, mei 29, 2003, at 23:06 Europe/Amsterdam, Dave Aronson 
wrote:

[Having to do crypto for each outgoing spam]

> Keep in

I think the people selling crypto accelerators will be very happy about 
this...

However, creating new publick/private key pairs is an incredibly 
expensive operation, and one that a legitimate email wouldn't have to 
do very often, but a spammer would if we just keep blacklisting their 
keys.

---

From: Dean Anderson <[email-masked]>
Date: Thu, 29 May 2003 19:11:00 -0400 (EDT)

> do very often, but a spammer would if we just keep blacklisting their

Of course, this results in another Type 3 attack, where you get messages
with lots of bogus keys, and you have to verify the keys.

		--Dean

---

From: Graham Klyne <[email-masked]>
Date: Thu, 29 May 2003 18:16:09 +0100

At 09:44 29/05/03 -0600, Vernon Schryver wrote:
>for that faith.

This comment prompted me to do a little experimentation.  I keep all my 
spam (except that large ones that I don't bother to download), mostly unread.

It's not scientific, or very statistically significant, but I examined the 
last 20 spam mails I received, and note that:

(a)  3 appear to have been received at my ISP with forged or inconsistent 
SMTP envelope information.

(b)  7 have significant inconsistencies between email headers and 
received-from trace to make me believe that they are probably forged headers.

(c)  5 have email header information that may or may not be forged -- I 
couldn't see enough evidence to make an assessment either way

(d)  5 have email headers that I believe to be genuine.  Of these, 3 come 
from what I presume to be throw-away accounts at AOL or hotmail.

My assessments were made initially by comparing the from address with the 
received trace, and making a judgement (not always scientifically) about 
the relationship between the addresses offered.  In some cases, I also 
looked to the message content and check to see if the source address is 
DNS-resolvable and/or reachable.  Of the "definitely-forged" headers, three 
used domain names that are operated by my own ISP, and I'm pretty sure are 
not customers of same.

The 20 messages I examined appeared to be broadly typical of the style of 
spam I generally receive.

This little experiment suggests to me that header forgery is a significant 
factor in spam -- I estimate about 50% of the sample I examined.

And one other data point:  in looking at my spam, I discovered two messages 
that were not strictly spam, because I had signed up for communications in 
the past, but which had been swept into my spam-box in the general 
clear-out.  I don't currently use automatic filtering, but simply move 
unrecognized messages  onopened into the spam box.  The point of this is 
that legitimate email marketing is suffering by failing to be sufficiently 
distinct from the unsolicited spam.

I don't claim all this proves anything, but I think I have cause to believe 
forgery of email headers is involved in a significant portion of the spam I 
receive.

#g

-------------------
Graham Klyne
<[email-masked]>
PGP: 0FAA 69FF C083 000B A2E9  A131 01B9 1C7A DBCA CB5E

---

From: Dave Aronson <[email-masked]>
Date: Fri, 30 May 2003 08:51:51 -0400

On Thursday 29 May 2003 17:51, Iljitsch van Beijnum wrote:

 I> However, creating new publick/private key pairs is an
 I> incredibly expensive operation, and one that a legitimate
 I> email wouldn't have to do very often, but a spammer would
 I> if we just keep blacklisting their keys.

I was only responding to the part about encrypting the message's hash 
with the recipient's public key.  Nobody needs to generate any keys, 
except those who want to be behind this sort of gatekeeping function.  
Requiring that all email be signed with a private key is another story, 
which has been (ahem) hashed over many times.

BTW, I also thought of a way you can make the computational costs much 
harder for spammers.  This unfortunately also affects legitimate bulk 
mailers, but they can be whitelisted.  However, it keeps the costs 
roughly the same for most ordinary (one-to-one) senders.  The trick is 
to require that the hash include the recipient address, not just the 
message body.  That way, not only must the hash be re-encrypted per 
recipient, but re*calculated*.  Even worse, you can insist that the 
address be *first*, so they can't just save the results of hashing the 
message and start from there for each victim.  Sorry if this has been 
brought up already; I've only been lurking a few days and haven't delved 
THAT deeply into the archives....  B-)

---

From: Dave Aronson <[email-masked]>
Date: Fri, 30 May 2003 09:00:02 -0400

Yeah, I know, self-followup is bad form, but I just wrote:

 DA> Sorry if this has been brought up already; I've only been lurking a
 DA> few days and haven't delved THAT deeply into the archives....  B-)

Oops, wrong list.  Thought I was on ASRG, not IETF.  Too much blood in my 
caffeine stream....

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 07:57:44 -0600 (MDT)

> From: Graham Klyne <[email-masked]>

> forgery of email headers is involved in a significant portion of the spam I 

The main thing your experiment proves is the compelling nature of the
article of faith.  You actually found 15% were forged, 35% might have
been, and concluded that probably 50% were.  Please understand that
I do not mean to suggest less than 50% of your sample was forged or
that forgery is not significant.  My point is that in fact you have
only what sounds like weak ("pertty sure") evidence for only the 15%.

When designing things, the first and most important requirement is
keeping track of what you know, what you suspect, and what you don't
know.  Someone I worked for 25 years ago was fond of saying "what you
don't know can hurt, but what you know that aint so can kill you."
Many spam solutions are based on the religious belief that most spam
is and must remain "forged."  Even if the first half of that religion
is true, the second half is plainly false.  Forgery is not required,
and spam solutions that stop forgery will only cause spammers that
now forge to use other tactics like registering hundreds of domain
names such as addadomainforyoutomail.com, addthisonetoo.com,
atepaintchips.com, chairwithfingersattached.com, and downinone.net.
(My notes list more than 270 other fairly recent domains of that porn
spammer.)

Why are do many spam "solutions" address only forgery?  I think there
are two main reasons.  Stopping forgery seems far easier than stopping
spam.  More important is that admitting forgery is not part of a
significant fraction of spam (your other 50%) and not a required part
of spam in general requires admitting that the spam problem exists
only because many of our own ISPs do not care enough about spam to
punish our fellow spamming customers.  Many ISPs are like UUNET/MCI,
which always dealt with spam with more wishful thinking and even bald
faced lies than its finances.  (People here may have missed the years
of obviously false statements from the UUnet abuse department spokesmen
in news.admin.net-abuse.email.  I hope bland claims of the impossibility
of examining RADIUS logs to find a reseller to hold responsible or
the technical impossibility of packet sniffers on fiber would have
been laughed out of the IETF.)

The spam problem is in a state like the dot-com stock bubble before
that collapse.  Neither problem could or can be addressed anywhere
that hype and wishful thinking is preferred to facing facts.

The IETF will design SMTPng and the world will replace SMTP with SMTPng
in fewer than 10 or 20 years, and the proof of that is HTTP needed 5
years to reach critical mass without any significant competition and
in a trivially tiny network compared to the Internet of today?
http://www.w3.org/History.html

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 30 May 2003 11:32:03 -0500

on 5/30/2003 8:57 AM Vernon Schryver wrote:

> of spam in general requires admitting that the spam problem exists only
> because many of our own ISPs do not care enough about spam to punish
> our fellow spamming customers.  Many ISPs are like UUNET/MCI, which
> always dealt with spam with more wishful thinking and even bald faced
> lies than its finances.  (People here may have missed the years of
> obviously false statements from the UUnet abuse department spokesmen in
> news.admin.net-abuse.email.  I hope bland claims of the impossibility 
> of examining RADIUS logs to find a reseller to hold responsible or the
> technical impossibility of packet sniffers on fiber would have been
> laughed out of the IETF.)

Accountability features would (hopefully) prove useful for preventing base
forgeries, but I don't think anybody has said that would be its only
benefit. Although some spammers might stop spamming if they lose their
artificial anonymity, the real strength comes from the improved ability to
enforce rules against a known identity (the meaning of the word).

The first step in that means weakening the ability to use forgery
techniques as a shield, but that's just a start. It should also help
against some of the prevarication you describe above, since there would be
less room for waffling if recipients were able to "prove" by verifiable
transfer-path analysis that a particular node had absolutely sent some
piece of spam. This ~provability would also be useful in whatever legal
enforcement options might be available (even if it's just one of the
state-specific laws, or a private lawsuit on the part of AOL/whoever).
Another benefit would come from the ability to have better pre-transfer
filters wherever the identity information made itself available.

These are all examples of how accountability can be used as a tool to help
fight spam. Forgeries are just a part of that particular fight.

Secondarily, there is another class of user where forgeries are
problematic in their own right, which is outright impersonation and/or
fraud, and in that context the anti-forgery capabilities would stand as a
unique benefit. However, the enforcement options which were made available
to those users as a result of the accountability features would be no less
compelling to those users if forgery were attempted and caught.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 11:05:02 -0600 (MDT)

> From: "Eric A. Hall" <[email-masked]>

> enforce rules against a known identity (the meaning of the word).

None of the even slightly plausible anti-forgery proposals have even
the slightest believable effects toward enforcing the use of known
identities.  No anti-forgery proposal has included anything that would
inconvenience a spammer that wants 10,000 "known identities."  No
price on certificates or any other mechanism can be low enough to be
tolerable by users but high enough to determine that the next new
account an ISP sees is not a known spammer with a new name, adresses,
and valid credit card number.

> piece of spam.  ...

That should sound like the mistake it is in a more or less technical
setting like this.  There has never been any lack of a "verifiable
transfer-path analysis that a particular node had absolutely sent some
piece of spam" unless you believe that spammers use initial sequence
number prediction to forge IP addresses.  You always know the IP
address of the SMTP client, even if it is a relay or proxy.  ISPs
could and should hold operators of open relays and proxies accountable
for sending the spam their systems send.

> compelling to those users if forgery were attempted and caught.

Please point out a single such case where header forgery was not obvious
and that needed or could have used any extra machinery.

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 30 May 2003 14:42:39 -0500

on 5/30/2003 12:05 PM Vernon Schryver wrote:

> identities.

They don't have to be "known" identies to provide accountability measures,
they only have to be verifiable. The proposals that even I think are too
complex are the ones that require the use of "known" identities
(exchanging tickets, bilateral postage agreements, etc).

Simply limiting the information to a "verifiable" scope can provide
sufficient levels of accountability. For exmaple, allowing self-signed
certificates but restricting their acceptance to the same mail domain
would provide some baseline measure of verification (DNS lookups), and
would provide some level of accountability (through the DNS domain
delegation information), and would provide additional strenght to the
available enforcement options. None of that requires "known" identities
(btw, I'm not ready to propose that usage model, just laying it out as an
example of how "known" identities aren't necessary to achieve a goal of
accountability through verified paths).

> No anti-forgery proposal has included anything that would 
> inconvenience a spammer that wants 10,000 "known identities." No price
> on certificates or any other mechanism can be low enough to be 

First of all, I think this is really an argument for legal options. I've
already stated that I don't think the spam problem in particular can be
"fixed" in the absence of legal enforcement options.

Secondarily, if we wanted to be productive (forward-moving) on this
particular subject, we should be discussing the mechanisms that would be
needed and/or useful towards making the necessary retrieval, comparison
and enforcement functions useful, and which would in turn make any of the
available enforcement options useful. I don't find the current absence of
credible services (WHOIS is currently useless) to be a compelling argument
against their eventual presence (WHOISng may be more useful), nor as
compelling arguments against their subsequent integration with other
services (integration between a WHOISng and an SMTPng for locating all of
the domains associated with a known offender, as one possibility). We
already know we're going to need some kind of identification mechanism, so
what else would we need as part of that?

>> against some of the prevarication you describe above, since there
>> would be less room for waffling if recipients were able to "prove" by
>> verifiable transfer-path analysis that a particular node had
>> absolutely sent some piece of spam.  ...
> 
> address of the SMTP client, even if it is a relay or proxy.  ISPs could
> and should hold operators of open relays and proxies accountable for
> sending the spam their systems send.

Conceding that "ISPs could and should hold operators...accountable"
doesn't dismiss the claims, and neither does the rest of your text.

Preventing the use of proxies through verifiable end-system identifiers is
one of "the first steps" I referred to. The problem would mostly move into
the relay and direct-sender space, but those uses could be dealt with much
more aggressively given the "proof" that would be available afterwards;
the range of enforcement options are all strengthened by better proof. The
original claims stand, despite your concession and fist-waving.

>> problematic in their own right, which is outright impersonation
>> and/or fraud, and in that context the anti-forgery capabilities would
>> stand as a unique benefit. However, the enforcement options which
>> were made available to those users as a result of the accountability
>> features would be no less compelling to those users if forgery were
>> attempted and caught.
> 
> Please point out a single such case where header forgery was not
> obvious and that needed or could have used any extra machinery.

In 1993, Adelyn Lee won a $100,000 wrongful-termination settlement against
Oracle, partially using forged email between her superiors as evidence.
Four years later the forgery was exposed, but the evidence that did her in
was testimony, log files, and cell-phone records, not the email message.
It seems obvious to me that a mail system which offered the kinds of
accountability features we're talking about and which cost less than the
settlement costs, corporate personnel and legal fees would have been well
worth the expense to them.

http://www.wired.com/news/technology/0,1282,9641,00.html describes three
different instances of fraudulent misrepresentation of Yahoo, any of which
would have been ameliorated with half-decent identity information which
clearly indicated the user was a customer and not an employee of Yahoo.
I've no idea what the dollar cost to Yahoo was, but the legal time alone
couldn't have been cheap, not to mention the economic impact from loss of
credibility.