Subject: RE: spam

From: "Christian Huitema" <[email-masked]>
Date: Thu, 29 May 2003 17:18:35 -0700

>  > > However, creating new publick/private key pairs is an incredibly
>  > > expensive operation, and one that a legitimate email wouldn't
have to
>  > > do very often, but a spammer would if we just keep blacklisting
their
>  > > keys.
>  >
>  > Uh? Creating a Diffie-Hellman public/private key pair is actually
quite
>  > simple. Even an RSA pair is not all that hard, considering that a
set
> of
>  > N prime numbers can generate N.(N-1)/2 key pairs. The logical
>  > consequence of authenticated e-mail is bound to be authenticated
> spam...
> 
> You don't see that as a step in the right direction?

It depends whether you use something like PGP or something like PKI. If
PGP or PGP-like, then the spammers can very easily create throw away
identities, and we have not gained much. In fact, spammers seldom fake
the email addresses of one of your friends, so a PGP solution would not
be a dramatic improvement over simply maintaining a "white list" of
friendly email addresses. 

If PKI or PKI-like, then the spammers would need to obtain an actual
certificate for each of their throwaway identities. But so would
everyone else, which implicitly limits the cost of obtaining a
certificate to whatever the public can bear, and the amount of identity
checks to whatever the public is willing to accept, which today is an
e-mail reachability test. So, the spammers will be slowed down, but not
much.

-- Christian Huitema

---

From: Michael Thomas <[email-masked]>
Date: Thu, 29 May 2003 17:32:06 -0700 (PDT)

> e-mail reachability test. So, the spammers will be slowed down, but not

What if it cost some nominal amount, but with that
payment came another form of authentication (eg
credit card number) which you could then use to
_meter_ the rate of issuing new certs, and/or
cross referencing issued certs associated with
spammers with the credit card number used to
obtain the cert? Assumedly spammers would
eventually run out of credit cards well before
they ran out of money.

As a note, the identity bound to the key can be
completely opaque and insignificant (and thus
certs could be issued trivially and cheaply).

	  Mike

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 30 May 2003 09:17:26 +0200

I can't say that I'd favor any solution that requires everyone to pay money
or obtain the approval of some third party before sending e-mail.  Any
system that imposes a universal financial burden on all Internet users
and/or effectively allows a third party to censor communication between two
other parties is extremely questionable in my view.

A technical solution must be free, voluntary for people who are not
spammers, and must not subject anyone to the control of third parties.

----- Original Message -----
From: "Michael Thomas" <[email-masked]>
To: "Christian Huitema" <[email-masked]>
Cc: "Michael Thomas" <[email-masked]>; "Iljitsch van Beijnum"
<[email-masked]>; "Dave Aronson" <[email-masked]>; "IETF Discussion"
<[email-masked]>
Sent: Friday, May 30, 2003 02:32
Subject: RE: spam

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 30 May 2003 13:16:06 +0200

On vrijdag, mei 30, 2003, at 02:18 Europe/Amsterdam, Christian Huitema 
wrote:

>>>> expensive operation,

>>> set of
>>> N prime numbers can generate N.(N-1)/2 key pairs.

Ok, so the actual generating of new keys may not help us much.

>>> The logical

> identities, and we have not gained much.

Only the ability to recognize a known sender.

> In fact, spammers seldom fake

Right.

> e-mail reachability test. So, the spammers will be slowed down, but not

Disagree. If people want to run their own MTA or a substantial mailing 
list, it's not unreasonable to require much more than a simple email 
reachability check. Usually this includes buying a domain name anyway. 
Having to buy a certificate or having some relations sign a newly 
generated key isn't a huge imposition.

People who don't want/need an MTA of their own and only send hand-typed 
email can use a service provider who can limit the number of messasges 
from such customers to 100 per hour or so. That means that even if a 
spammer spams for an entire weekend until his account is yanked, that's 
less than 10k messages which isn't enough to make spamming worth their 
while.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 08:45:31 -0600 (MDT)

> spammer spams for an entire weekend until his account is yanked,

I've picked that fragment out of context only as an example of the
larger religion that holds "most spam is forged" as an article of
faith.  If you watch much spam without religious blinders, you know
that the religion that enough ISPs care about spam is delusional.

Consider the many entries in the SPEWS, SBL, and MAPS RBL blacklists.
If accounts were yanked within a business day, then the major DNS
blacklists would be useless instead of good for stopping 40-80% of
spam with low (at least for the SBL and RBL) false positives.  If
accounts were terminated with dispatch, then by the time entries were
added to the blacklists, the spammer would already be gone.

Then there is the fact that often nothing more than pro forma account
yanking is done.  For example, if you read carefully the recent accounts
of Earthlink's efforts against the Buffalo Spammer, you might wonder
how Earthlink spent millions of dollars and months of technician and
inside lawyer time chasing and not finding the spammer, but the outside
lawyer pinned him in days.  I've heard privately of cases of large,
telco-related ISPs that could not stop a spammer known by name and
address from using stolen hundreds of credit card numbers and that
supposedly had to be told by outsiders (who were neither lawyers nor
telco experts) about 1-800 ANI, the courts, and so forth.  I trust
these oddly unsuccessful or uninformed ISP employees are doing their
best, but something smells.

That pro forma account yanking is analogous to the pro forma financial
accounting of the dot-bombs.  Until there is a real accounting, things
continue.  Until organizations like UUNet care enough about spam to
not just whine about the impossibility of determining which customer
of a reseller is a spammer and seriously consider terminating the
reseller, spam cannot be reduced by technical mechanisms.

Vernon Schryver    [email-masked]

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 30 May 2003 18:06:04 +0200

On vrijdag, mei 30, 2003, at 16:45 Europe/Amsterdam, Vernon Schryver 

> faith.

Most of it is. But that's not an incredibly interesting point: I think 
we can all agree that there is a lot of spam that is forged and there 
is a lot of spam that isn't forged. There is too much of either type.

It sometimes seems like people are saying "it's no use going after spam 
that's forged as there's always the non-forged type" but then also 
"it's no use to go after non-forged spam because spammers simply forge 
headers to get by filters". May I suggest taking logic 101 again for 
those of you who think this makes sense?

> If you watch much spam without religious blinders, you know

If an ISP doesn't yank the mail identity from people that spam and/or 
lets spam through from known spammers, that would be a good reason to 
require additional validation for identities used by customers of this 
ISP.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 10:43:02 -0600 (MDT)

> From: Iljitsch van Beijnum <[email-masked]>

> ...

That is a red herring.  That forgery is not a required part of spam
does not imply that stopping forged spam is useless.  However, many
people are uninterested in mechanisms that reduce their own spam loads
by less than 80%.  Few care about mechanisms that would stop only 50%,
not to mention 15%.

> require additional validation for identities used by customers of this 

That is an intersting point, but only if you think that ISPs that
don't care enough about spam today to yank accounts (even of
resellers) will bother to provide any of the things that might be
called "additional validation of identities."  Otherwise, you may
as well permanently blacklist those ISPs by their IP addresses with
supplemental whitelists of your correspondents that patronize them,
and declare victory in the spam war.

Most of the anti-forgery proposals depend on ISPs doing lots expensive
work with the intended result in many cases of preventing spammers from
using the services of the ISPs that would do that work and today are
not terminating those same accounts....talk about a need for Logic 101!

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 30 May 2003 12:51:51 -0500

> and declare victory in the spam war.

I do that already. Trace information would let me do it sooner, and with
greater precision. Also, I can be more selective in my blocks, rather than
having to block entire countries (not all of whom are in Greater Asia)
because some ISPs have multiple netblocks or move around frequently. In
this regard, being able to identify an idiot ISP gives me finer-grained
control over that idiot's access to my network.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/