Slashdot Mirror
Would you Warranty Your Email?
Kurt writes "A team from the University of Michigan is proposing an economic solution to spam. Instead of relying on technical solutions or government regulations, they use a sender warranty system. In some cases, they argue, it can even be superior to a perfect filter with zero cost, and no errors. Their working paper is available at SSRN. With the caveat that some infrastructure is necessary (isn't it always?), they also claim their approach restores control to the recipient, halts spam, and creates a marketplace for valuable information exchange."
If I start rejecting all email which is not from a verifiable sender, I'll quickly cut spam, and impose some costs onto those who wish to sent me email. I'm willing to pay those costs when it becomes my turn to send an email. I would start with the recent authorized sender protocols, in addition to Public Key Infrastructure, to begin to authenticate a sender.
Once PKI starts to take hold, there would be an incentive for the spammers to start creating throw-away identities, which we could counter with a reputation system for the sender's domain. We could also create a "web of trust", automatically managed by our mail servers, or ourselves, to nip the counteroffensive.
So, there it is... my alternative... sign and validate all email.
--Mike--
One benefit to having email is the ability to post information anonymously in order to avoid possible repercussions. Slashdot has that feature with the "Post Anonymously" checkbox (which should be pointed out, is not 100% anonymous and can be tracked by IP and logged-in account name) and it also exists with anonymously emailers.
Forcing someone out into the open by the use of such 'warranties' imposes a chilling effect on free speech through email.
I hate spam, but I hate the idea that important speech could be stifled by the use of badly considered spam 'solutions'.
I have been pwned because my
The primary problem I see with this is getting enough people to start using this system. The majority of people probably aren't going to bother with it unless they have to, which means that most emails will be accepted whether or not it costs the sender money, good or spam, because most of a given recipient's contacts will not have the escrow set up. Unless creating the escrow account is mandated, which makes it no different than most of the 'tax' systems, I don't see this model working any better than what we have today.
What looks good in an academic paper doesn't always translate into the real world. Would their idea work? Yes, with sufficient participation. Will there ever be sufficient participation? No. Look at pgp keys/signatures. There are means of validating the sender's identity now that would stop spam, but they are not used because it requires people to opt-in and most people don't care enough (no matter how much they complain about spam).The bigotry of the nonbeliever is for me nearly as funny as the bigotry of the believer. - Albert Einstein
There we go. It creates a marketplace!
If it didn't, wouldn't it be one worthless invention?
No I didn't read the FA, but you do not "warranty" things. You *make* representations and warranties which are legally-actionable promises that give rise to damages when you break them. ie. This muffler will last 20 years. If it doesn't, the giver is liable. They can give limited remedies like replacement. They are generally contractual terms.
I have no interest in EVERY email being a contract with the recipient subejcting me to contractual remedies.
I already have a contract with my ISP specifiying terms of use which restrict the way I can use their services. I think you will find that many of those agreements ALREADY INCLUDE contractual requirements that I don't spam and specific remedies if I do so-> suspension, termination of service.
Why would I add any more legal mess?
The problem is, there are a TON of moderators that will go and mod-bomb people because they don't like them, regardless of how well-reasoned their post is. Posts are supposed to be moderated, not individuals, but that's not how a lot of people do it.
evil adrian
They spend way too much of their paper on analysis of why this would work, but nothing on how to implement it securely.
And because you ARE talking about money, it would have to be secure.
why does evry problem in life have to be solved by creating a free and open market?
I for one think that there are some things that can not be solved simply by attaching a price tag to it.
do you want to polute? how much money do you have to buy pollution credits?
do you want to send email? how much money do you have to buy a warenty?
do you want to get laws passed how much money do you have to "lobby" with.
sigh...:(
--meh--
It seems like everyone is coming out with their own pay email scheme these days. and they always boil down to 2 things
i wish these people would stop writing these elaborate papers when the solutions are so clear
So these guys want our computers to spend our money? First they have to secure every machine. Of course, once you do that, you don't have DDOSes, nor proxy spam. The first step of their solution *is* the solution; the remaining steps would be a waste of time.
-russ
Don't piss off The Angry Economist
After having introduced the concept of "whitelists" for known senders the article continues:
In the case of strangers, the warranty mechanism is more suitable. Analogous to a standard bond mechanism, delivering email to an inbox requires an unknown sender to place a small pledge into escrow with a third party. In the case of screening, recipients determine the size of this bond, which they can dynamically adjust to their opportunity costs. The email is delivered only after the recipient receives suitable confirmation that the bond has been posted. When the recipient opens the email, she may act solely at her discretion to seize the pledge. Taking no action releases the escrow after a period of time.
IMHO this means the end of mailing lists - what would prevent me from signing up (automatically, of course) to thousands of mailing lists and collecting all the bonds placed for messages posted through these lists ?
"Of course mailing list operators would first get your approval that you let through all their messages".
This is where it starts getting complicated. And complexity is exactly what I don't want with email - it is simple, and shall remain simple.
Therefore I am perfectly willing to put up with the current spam levels - hey, I can deal with those five to ten messages a day which pass through my Bayesian filter. On certain days I get more than that in my smail box.
Nice idea but it can't work. What happens in mailing lists? If someone is mailing hundreds or thousands of people legitimately then how much bond money are they going to have to risk?
What about the temptation to abuse the system? If someone doesn't spam you but you say they do to take their money, what happens?
We need to continue developing better filteds until Congress eventually decides to tackle spam rather than jump in bed with RIAA to take our rights away.
Comment removed based on user account deletion
...it assumes that all the mechanisms for posting and collecting these bonds are perfectly reliable, perfectly secure, and unhackable.
Right.
If they aren't this just opens fresh avenues for abuse.
For example, you receive an email saying "Your PayPal account will be suspended if you don't reply." You find that in order to reply you will have to post a bond of $0.0001, which is the going rate for such things, so you do so without thinking about it. Later, you discover that due to some cunningly-engineered HTML, the part of your screen that you THOUGHT was telling you that the bond was $0.0001 was somehow faked, and that really you posted a bond of $1000 which the sender has collected.
Or whatever.
"How to Do Nothing," kids activities, back in print!
Ohhh look another "best idea on the internet" that's the same old "charge them" idea that many others have had that's still stupid.
Basically this idea annoys everyone and solves nothing. There would be a lot of rich people who simply spend all day signing up on lists and then collecting the "fine" when they get e-mails.
The way to stop spam that doesn't require messing with STMP is to use web-forms. The web-form on my mail server is written in PHP and is basically a custom e-mail client. It connects to the mail server and sends to exactly one address that's hard coded in the script. Giving it random letters and numbers would prevent spammers from guessing it and users wouldn't care because they don't have to remember it. My particular PHP script only sends text only e-mails as well.
If you use a non-generic web-form with a unique filename and unique variables, it makes it quite impossible for spammers to make bots to whore their spam automatically.
What would be really clever if you want to prevent bots entirely you just have an array of images. And an array of questions, one for each picture. And the user has to answer the question like "what color is the apple?"
No amount of image scanning by a bot is going to figure that out.
Then instead of telling people an e-mail address you just give them your domain. It's still SMTP so you can contact people out side the script if you want.
The other method I use on the server side is filtering domains that spammers use to host their product pages or images. I've gotten hundreds of e-mail attempts according to RinetD's logs and only a couple spams with domains I hadn't added to the filter yet have gotten through. Since the PHP script goes through the mail server and doesn't actually send the e-mails itself, all the spam prevention is also applied to the web-form. And since no legitimate e-mails use those domains, I've had 0% collateral damage.
I get virtually no spam and have yet to break SMTP or charge anyone anything just to send me an e-mail. It's really not that hard.
Ben
Work Safe Porn
Email is one of our last few partially anonymous methods of communication. Emailing (and posting) as "Anonymous Coward" is a seriously useful thing and taking it away from people will probably be more disasterous than originally imagined.
There was some drama recently around an anonymous e-mail communication this past few weeks at my roommate's place of employ. What did the sender use? Hotmail.
Hotmail, yahoomail, and other free mail services use ciphers to identify people as human beings, and track IP's to resist automated signup scripts, but the medium is still essentially anonymous. Except for the IP address of the sender, which can be masked via a little wardriving or a trip to the library, the system is as anonymous as the sender wishes.
The ______ Agenda
Good enough summary?
The sender deposits money with a third party to send an email. Once enough money is in, the email is delivered to the recipient.
The recipient can choose to take the money for whatever reason (needs a beer etc). If the recipient doesn't do anything, after a while the money returns to the sender.
The recipient can put the sender on a white list which means the sender doesn't need to put up money.
The authors/proposers say that the alternative of making everyone digitally sign their emails doesn't work. I don't see why that is harder to implement than this approach, esp since digital signing involves a lot less money AND there is no need for trusted third parties to be trusted to hold millions of bucks in escrow. It is very easy to blacklist CAs who certify spammers, CAs can always insist on valid IDs - so spammers will have to keep hiring Joes to send their spam for them, and ISPs and Antispam software can easily detect the unusual case of a single Joe sending 1 million messages.
So digital signing can work if everyone uses it. But would everyone use it? Similarly would everyone use this money deposit thing? You have to set up even more infrastructure than digital sigs (already many email clients support s/mime, and there are plenty of CAs).
This has many of the disadvantages of digital signed emails and few advantages.
Imagine when the next email worm makes tons of random people very rich and millions of stupid people poorer just coz some kid in Belarus thought it would be funny.
Stupid idea.
It also won't be approved by Banks/Govs/etc because these ppl like to keep track of money transferred around. Think: "money laundering", and keep thinking some more.
Stupid idea.
Is it different than what we currently have?
If so, it won't work.
Looks, spam, spam mail, telemarketers all exist today due to profits. People profit from them, so people will continue to do it.
"But take away the profit then!" far easier said than done. And even if you could, I would argue that you shouldn't. At least not legislatively. Let's see someone be half as creative in the private market as the spammers are. If they are creative, and their system works, then they get to be rich beyond belief. What's that? You don't want to pay for a spam solution? Well, believe me, those little things called Taxes? You're paying that judge to sit and preside over your case and you're paying those hundreds of Congressmen to sit and chat about this e-mail spam problem. It ain't free people.
If there was no market for spam, then it wouldn't exist. There is a market, you don't like it and I don't like it, but it does exist. People aren't sending chunks of steak through the mail unsolicited because that wouldn't be profitable.
www.jackasscritics.com
not regarding e-mail or telephone calls.
If you want to be annonymous, participate in the public debate. Post to Slashdot, whatever. I'm all for "AC"s - as you might notice by this very post.
But when you target me, by name, using my resources, and DEMANDING my personal attention, I have an absolute right to know who you are.
I also think the World(tm) should equate forged e-mail for what it is - identity thieft. Jack spamming right up there into Felony territory right along with mis-appropriation of Credit Card numbers.
What about the third parties who are supposed to manage the escrows? There would doubtlessly have to be very few of these companies (maybe even just one) doing the job, otherwise you have the problem of trust -- with thousands of companies holding escrow like this, you may well be wary of a company that comes along and says "don't worry, we've got the escrow, now give us your bank account number..." So we're primed for a monopoly of sorts. And whatever megacorp comes along and fills this position, they will have access to the e-mailing habits and history (not to mention financial records and perhaps even buying habits) of potentially billions of people. Anyone else scared by this prospect?
... that i have no mod points.
I agree completely and emphatically. Email is not a free-speech/privacy issue, and i think people are forgetting that.
There is no provision in the constitution that guarantees an audience for free speech, yet this is precisely what anonymous email does. It puts a burden on me, the recipient, to sort through the garbage of others.
If you want more anonymous speech, get a blog, post to a web board, post to usenet.
Your freedoms stop when they infringe on the freedoms of others. Your freedom to be heard is wholly consitutionally blocked with my right to post a no soliciting sign.
I see no reason why I can't effectively put a similar sign on my email box. (let alone my meatspace mailbox)
the only reason bulk mail persists, is because it's effectively privately subsidizing the outdated and inefficient USPS. Spam, on the contrary, is wholly an economic drain on the delivery system. there is no benefit to anyone to retain spam, except those corporations who wish to have no responsibility to maintain an honest opt-out policy.
sure, spam finds willing recipients, so someone must want this garbage - but so do door to door salesmen. And I'm perfectly within my rights to forbid them from coming onto my property. a right which does not in any way infringe on their right to be heard, or their ability to simply bug my neighbor.
// "Can't clowns and pirates just -try- to get along?"
I disagree with your position. The fundamentally different thing about this warranty idea is that it presents a payment system which would permit cost free maintenance of legitimate mailing lists. When a user wishes to subscribe to a mailing list they send an email with warranty to the list maintainer, who claims (or puts this sum in permanent limbo) the warranty funds, which should exceed the warranty demands of the subscriber. The subscriberwould then remain subscribed at no additional cost until such time as they either request to unsubscribe (under which circumstances the funds are released back to them) or they claim the warranty on an email sent on the list... which would be detected by the list maintainer and effect a termination of the subscription. I personally suspect a very low warranty value would prove remarkably effective... $1 associated with each of millions of spam messages would get expensive, whereas tying up $20 for a typical user with only a handful of messages in limbo at any one time is unlikely to be a significant burden.
I agree that the infrastructure would be considerable - but I for one, remembering how useful email was a decade ago, would be willing to pay whatever it takes to establish a system in which any individual can contact me easily but where a few dozen arrogant cretins don't bother me every few hours with their typically criminal mass mailed proposals. I like the idea of warranties far more than I like the idea of micro-payments which (in my opinion) are likely to prove a far more significant burden for honest email users.
And there are so many more situations like this.
I have a hard time believing people don't see the necessity of anonymous communication, I think people without guns and freedom have a much more keen sense of how important it is to have a voice and criticize without revealing yourself to the oppressive powers that affect you - your government, religion, police, family, boss, "moral leaders", etc
As much as I hate spam, I try to keep it in perspective. Anonymous communication has the power to create social change and reform. Why do you think there is so little known about and so little reform of the US prison system? Specifically, because anonymous communication is not possible. And the local pothead deserves to be there and get fucked in the ass no more than you do for downloading songs, so its not an easy "they all deserve it" situation.
No one has died because they received too much spam, but countless people have died after being tracked down for disagreeing with the powers that be.
From the parent: Warning Signs of a Flawed Proposal
And I would say at least these apply:
(Quoted from the site above)
# You have discovered the Final Ultimate Solution to the Spam Problem (FUSSP).
# You are the first to think of the FUSSP.
# You started looking for the FUSSP after observing that it is impossible to filter more than 99% of spam with fewer than 0.1% false positives by currently available mechanisms.
# You don't plan to make a fortune from the FUSSP, but you do expect fame as its generous and public spirited netizen inventor.
# You are deeply hurt and angry because you are not respected as "spam fighter."
# People don't see the value of the FUSSP because they have axes to grind, are jealous, or are too stupid to understand it.
# You learned how to stop spam during the more than six whole weeks you've been fighting it.
# The FUUSP assumes that your attention is so important that strangers, other than advertisers, from will pay money to send you mail.
# You cannot name several potentially fatal flaws in the FUSSP.
# All you need to do to get the FUSSP implemented and deployed is to publish an RFC or get a law passed.
# You don't recognize any significant difference between deploying and implementing the FUSSP.
# You plan to publish an RFC mandating the FUSSP but have never heard of RFC 2223 or RFC 2026.
# Inventing the FUSSP did not require that you know the difference between RFC 821 and RFC 822 or that they have been replaced by RFC 2821 and RFC 2822.
# You don't know the relevance of "consensus" or "IESG approval" to publishing RFCs.
# Spammers won't ignore, subvert, or exploit the FUSSP if you publish it as an RFC.
# The FUSSP depends on spammers or mail recipients changing their behavior without any immediate gain.
# The FUSSP won't be effective until it has been deployed at more than 60% of SMTP servers and that's not a problem.
# Your job is done after having explained the FUSSP to the IETF or The Industry..
# Programmers will drop everything to implement the FUSSP.
# You know that SMTP has no authentication and have never heard of SMTP-AUTH, SMTP-TLS, S/MIME, or PGP.
# You know that the failure of SMTP servers to authenticate the SMTP clients of strangers is a major bug in SMTP instead of an expression of a primary design goal.
# The FUSSP requires a small number of central servers to handle certificates, act as "pull servers" for bulk mail, account for mail charges, or whatever, but that is not a problem.
** Well, in this case worse -- It requires a whole banking system!
# The FUSSP requires that anyone wanting to send mail obtain a certificate that will be checked by all SMTP servers.
# You have found that most Internet users would be happy to pay $5/month to avoid spam and do not know the prices of anti-virus software or data.
# You have never heard of RFC 2554 or RFC 2487 and the FUSSP includes fixing the lack of authentication in SMTP.
# The FUSSP involves replacing SMTP.
# Your definition of spam differs significantly from "unsolicited bulk email."
# You frequently use math, statistics, and information theory, and almost as frequently notice people hiding grins or stifling laughs.
>> Your comment then gets bumped up to "+5, via
>> Warranty."
If the person changes their online identity, then they'd automatically be back to +5. It would more sense for that person to increase to +5 via moderation, that would give people incentive to keep the same indentity.
where (gasp) you might not like what the person is saying!
I find this is where MetaModeration enters the picture for me.
Moderating, I get so few points (how are you ever going to do a good moderating job with just 25 points, I mean) that I'll use them up quickly, mostly doing +1 on well-written, well-reasoned posts that I agree with, and maybe 10-15% of the time pushing trolls and flamebaits down into the basement.
But Meta Moderating I've re-inforced +1 ratings that other Moderators have given to well-written comments that oppose my own views.
Is there anything more boring than listening to like-minded people? Are we so insecure that we need constant ego inflation that "we're right. we're good. we're valued."?
"Provided by the management for your protection."