FTC Wants Comments on Email Authentication

An anonymous reader writes "Groklaw has the scoop. The Federal Trade Commission and National Institute of Standards and Technology (NIST) will co-host a two-day 'summit' November 9-10 to explore the development and deployment of technology that could reduce spam. The E-mail Authentication Summit will focus on challenges in the development, testing, evaluation, and deployment of domain-level authentication systems. The FTC will be accepting public comments until Sept. 30, 2004 via snail-mail or email (authenticationsummit at ftc.gov). The FTC has a list of 30 questions they would like answers/comments to. The list available in this PDF of the Federal Register Notice." In a related subject, reader Fortunato_NC submits this writeup of the sequence of events that led to Sender-ID's abandonment.

Comments

spam about spam

[metallikop]

Seems like slashdot is being spammed with stories about spam.

My comments?

[cuzality]

I will be sending my comments immediately by email. They'll know who I am.

Re:My comments?

[orthogonal]

I will be sending my comments immediately by email. They'll know who I am.

THIS AUTHENTICATED EMAIL
HAS BEEN APPROVED
AS CHRISTIAN AND PATRIOTIC
BY THE
REICHSPROTECTOR OF INFORMATION
FOR THE UNITED HOMELAND
by direction of
JOHN D. ASHCROFT,
REICHSMINISTER OF JUSTICE

We want all your papers, please!

And yes, we do know who you are, Citizen!

CC: PATRIOT DATABASE, REICHSMINISTRY OF INFORMATION

Re:My comments?

[Taladar]

*searches for the +1 Scary Mod-Option (again)*

for all the bots...

[Anonymous Coward]

authenticationsummit@ftc.gov

Re:for all the bots...

[Anonymous Coward]

what does that accomplish?

They won't be happy.

[Anonymous Coward]

These guys aren't going to be happy until we have to hand over our credit cards, photo ID and social security number just to send an email.

Re:They won't be happy.

[unknown_goth]

. . . . . urine sample, first child, your dog's footprint, and a letter from your mother. the list can go on and on but the key factor here is . . . ah shit i just had that list and that's all

Re:They won't be happy.

[fleener]

Correct. My primary e-mail accounts have been spam-free for 3 years, since I started watching where and how I give people and web sites my address. Through a few simple measures you can protect a new address without the need for spam filters, with no need to hinder your regular personal and professional correspondence (assuming you don't correspond with spammers).

The *only* spam I receive on my permanent accounts is an occassional worm-sent e-mail and a guessed-address spam every 3 or 4 months (and those have never led to more spam).

People who piss and moan about spam (basically everyone) are refusing to accept that they live in a dangerous world. There was a time when people left their front door and windows unlocked. An ounce of prevention is worth a billion pounds of cure, in terms of spam.

I'll never support an authentication system that costs me more money to send e-mail because I have zero need for an authentication system.

People who don't use throw-away accounts for risky correspondence are having anonymous sex without a condom. Go ahead, mod me down because you don't believe me and think spam is just the cost of doing business on the Internet. It's not.

Re:They won't be happy.

[Arngautr]

You are largely correct, but I strongly disagree with the conclusions you draw. Why should we have to use images for email addresses just so a bot doesn't pick it up, why should we bow down to the spammers and hide contact info:

fleener
(email not shown publicly)

Wouldn't it be nice if we could actually use email as it was intended?

Re:They won't be happy.

[dubl-u]

The *only* spam I receive on my permanent accounts is an occassional worm-sent e-mail and a guessed-address spam every 3 or 4 months (and those have never led to more spam).

Then you're a lucky fellow. A few months back I enabled a bunch of aliases for common dictionary attack names, and those aliases are rising rapidly in volume. (That's fine with me, as they're just fed right to the Bayesian training program.) But eventually, it will spread, and your oh-so-pure address will be compromised.

Re:They won't be happy.

[Hatta]

Absolutely. What business does the government even have getting involved in this? You're free to use any authentication scheme you like now, why do we need the government to mandate something like this?

Re:They won't be happy.

[sl4shd0rk]

> These guys aren't going to be happy until we have to
> hand over our credit cards, photo ID and social security
> number just to send an email.

As long as we can still spoof the info, who cares?
Muhahahaha!

Re:They won't be happy.

[Anonymous Coward]

What was your email again?

Re:They won't be happy.

[Anonymous Coward]

People who don't use throw-away accounts for risky correspondence are having anonymous sex without a condom.

This is slashdot; this is the closest to anonymous sex you're likely to get.

NOTHING but an open standard.

[garcia]

From Groklaw:

7. Whether any of the proposed authentication standards would have to be an open standard (i.e., a standard with specifications that are public).

Of course the standard would have to be open. This shouldn't even be up for discussion. No argument can make security by obscurity work and no argument can get me to change my thinking that we should all be using closed SMTP servers.

Spam is "horrific" and all (BTW I don't get more than 5 a year) but we certainly shouldn't even be considering ending it by choosing applications that will eliminate an open society.

Re:NOTHING but an open standard.

[Anonymous Coward]

we should all be using closed SMTP servers.

Oh sure, closed SMTP servers, right -- but of course they would have to be open as well.

Re:NOTHING but an open standard.

[Anonymous Coward]

> BTW I don't get more than 5 a year

Do you have an email account? Does it work?

Re:NOTHING but an open standard.

[Anonymous Coward]

Do you have an email account? Does it work?

Do you sign up for offers on every website you visit? Do you openly hand out your email address on every postcard/website/business you see? Do you run your own mail server? Do you let people email you on group lists without masking your address behind a BCC?

If you don't, I have no sympathy for you. Hide yourself and protect the rest.

Re:NOTHING but an open standard.

[JabberWokky]

Spam is "horrific" and all (BTW I don't get more than 5 a year)

And I get 1800 a day. That's because I am the public contact for several companies with some of my email addresses dating back over 10 years. In conjunction with theater groups and businesses, my email appears in press releases, on fliers, ancient usenet posts, and otherwise all over the place.

Individuals using their email account to talk to friends don't have as much a problem as people who use their email address publically for business and publicity.

My phone number and address are also published. I don't, however, get 1,800 unsolicited calls every day and my junk physical mail is quite reasonable.

--
Evan "I'm not even saying Spam is bad, I'm just saying it costs me serious time"

Re:NOTHING but an open standard.

[Anonymous Coward]

You might want to re-read your post because it is a logical disaster. You basically said you sympathize with people who sign up for every offer, openly hand out their email address, run a mail server, and let people email you without masking behind BCC.

I do only one of those things (run my on email server) and I can tell you that spam is a nightmare. I get bombarded with every possible name @ my domain name. On one tiny, hardly known site I get over 2000 emails a day - 85% are blocked or deleted outright and 1% is actually legit email. The rest are viruses and spam just marked or quarantined but not deleted.

Re:NOTHING but an open standard.

[Anonymous Coward]

Spam is "horrific" and all (BTW I don't get more than 5 a year) but we certainly shouldn't even be considering ending it by choosing applications that will eliminate an open society.

Why do you think Government inserted itself so awkwardly into the Spam Situation to begin with?

Bipartisanship in any political matter is something you should always be suspicious of. Some people in high places in the US Government salivate for control of the Internet just as much as the totalitarian PRC.

Re:NOTHING but an open standard.

[Anonymous Coward]

I'm afraid it's pretty rare for me to receive spam either. Here's how I do it, I guess: I don't put my e-mail address on any web sites. I don't give my e-mail address to any web registration forms. I don't get my e-mail address on huge mailing lists that don't BCC, and I discourage all of my friends from propagating chain letters, at least to me.

Lastly, I discourage my friends from using Outlook and Outlook Express, if they intend to put my name in their address book. That part's really the tough one. But apparently it works. Probably six or seven spams in a year, and most happened right after my wife's Outlook-using grandpa got a virus.

Re:NOTHING but an open standard.

[JimDabell]

an open standard (i.e., a standard with specifications that are public).

In my mind, an "open standard" isn't just one anybody can read, but one that is open to anybody implementing it - which means patent-free. It's no good everybody being able to read the specifications if nobody is allowed to do anything with them.

Re:NOTHING but an open standard.

[Chief Typist]

Individuals using their email account to talk to friends don't have as much a problem as people who use their email address publically for business and publicity.

And this, my friends, is the real cost of SPAM. It's not about the bandwidth, it's about the lost business.

In my business, the cost of a losing a customer because of miscommunication far outweighs the cost of the bandwidth SPAM uses on my server. If customers/reviewers/resellers get lost in the flood of SPAM it costs me money.

And then there's the cost of having someone spend time weeding through all the crap (SPAM identification tools help, but human intervention is still needed for false positives, etc.)

It's good to see that the FTC is getting involved -- this is a business/trade problem, not a communication problem.

-ch

Re:NOTHING but an open standard.

[cayenne8]

"It's good to see that the FTC is getting involved -- this is a business/trade problem, not a communication problem."

Hmm..yes BUT, the internet/web/email...were NOT developed for business, in fact business use of it came along quite late. It just seems by this statement, the business needs for email or other internet protocols should dictate their use/design over all other concerns. I would have to disagree in that case. It should continue to develop and grow for all concerns, both public and private.

My $0.02,

:-)

Re:NOTHING but an open standard.

[thisissilly]

Sez you. Business use of the Internet happened quite early in the history of the net -- the Department of Defense could exchange email with Defense contractors (and academic researchers). Defense contractors are most assuredly "business".

The Hardest Issue

[Nos.]

Is to keep email easy to use. SPF is a nice idea, but doesn't cope with a couple issues. The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM. Secondly, its not expensive to register a domain and flood SPAM for a few days until that domain is blacklisted. Wash, rinse, repeat. I'm not saying a solution isn't out there, just nothing that I have seen really talks to these two issues.

Re:The Hardest Issue

[thogard]

You only found 2 issues with SPF?
How about a few more

Since I wrote that, I've managed to come up with SPF rulesets that cause DOS on some of the common implementations, my dns has been scaned countless times looking for SPF records and I've had over 1000 spam messages with valid SPF records.

Re:The Hardest Issue

[CodeWanker]

I still like the pay as you go approach: if you had to pay a nickel for every unsolicited e-mail you sent over the internet (as opposed to a company's intranet), spammers would be shut down overnight.

Of course, there's the logistical issues to deal with, but having escrow accounts for every ISP and "approved to receive" lists for no-charge e-mails would allow us to get past this annoyance.

Right now, we've got people selling snake-oil penis enlargements, counterfeit prescription drugs, and fraudulent stock tips. This seems to me like a reasonable price to pay to clamp down on that kind of crime.

Re:The Hardest Issue

[glesga_kiss]

SPF is a nice idea, but doesn't cope with a couple issues. The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM.

No, but when the luser finds out that their e-mail is broken, they might just do something about their trojaned machine. Which is in fact fixing the problem and not the symptom. Any "authenticated user" idea for SPAM prevention has to account for the fact that there will need to be a "compromised" flag on the account to mark if mails are suspect.

Re:The Hardest Issue

[perp]

The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM.

Yes it will. Almost all of those trojanned machines send mail directly to the receiving server, not through the mail relay of the spoofed sender. If the email purports to be from jblow@someplace.com, the receiving mail server can check someplace.com's spf record and see that the ip address of the trojanned machine is not allowed to send mail. That is the very essense of what it does.

You are correct that a spammer with a server can publish an spf record, but he is much, much easier to blackhole than a rapidly changing large selection of compromised dsl machines.

Re:The Hardest Issue

[qtp]

"I've had over 1000 spam messages with valid SPF records."

That's likely due to the sending ISP having lax policies.

SPF only provides methods of communicating the sender policy and of checking wheter or not an email is compliant.

OTOH, this does allow us to determine if an ISP is lax about allowing their users to spam, or if it is doing nothing to let their users know that their machines have been compromised.

Re:The Hardest Issue

[AnotherBlackHat]

You only found 2 issues with SPF?
How about a few more

I agree with most of the comments, but I don't quite understand the "No sane firewall is going to let TXT records through" one.

I don't know of any firewall that blocks a specific type of UDP packet.
To a firewall all DNS replies look alike.
Sure, it could parse the data part of a DNS packet in the firewall, but AFAIK no firewall actually does.

-- Should you question authority?

Re:The Hardest Issue

[iabervon]

It doesn't cope with world hunger, the war in Iraq, or many other issues. SPF doesn't really have anything to do with unsolicited email. Its only intented effect is to make solicited email more distinctive. This can eliminate some significant false positives in spam filters (email that would be spam if it weren't sent from a government agency that you had applied for a grant from, for instance).

SPF will not prevent or help mark any email as SPAM. It will mark a lot of phishing scams as forgeries. It will let people avoid having spam sent with their address forged on it. It will give people sending non-spam to people who know them a way of marking their email as non-spam in a way that is very difficult for spammers to imitate.

Re:The Hardest Issue

[Rellik66]

At least SPF prevents sunburns ;)

Re:The Hardest Issue

[Anonymous Coward]

I've bought snake-oil in the past, but I've never put it on my penis. Thanks for the tip!

Re:The Hardest Issue

[Anonymous Coward]

they are called Application Gateways, or Application Level Firewalls, or Application Proxies.

They are out there, and they have been used for years & years.

I've been preventing version.bind's for years with these.

Re:The Hardest Issue

[whoever57]

You are correct that a spammer with a server can publish an spf record, but he is much, much easier to blackhole than a rapidly changing large selection of compromised dsl machines.

But the spammer can easily and cheaply change the domain name used. While ".com" addresses cost ~$8, ".org.uk" addresses can be bought for even less (about $4). Is it such a barrier to spammers? Spammers that may have paid many dollars to use the network of zombies?

Re:The Hardest Issue

[perp]

But the spammer can easily and cheaply change the domain name used. While ".com" addresses cost ~$8, ".org.uk" addresses can be bought for even less (about $4). Is it such a barrier to spammers? Spammers that may have paid many dollars to use the network of zombies?

I guess we will see. Currently, the vast majority of the spam that hits my domains comes from trojanned dsl machines. If domains are so cheap and easy, why use zombies? Perhaps when the zombies become ineffective due to spf, spammers will start using cheap domains, and the war will have escalated again.

Re:The Hardest Issue

[ajs]

Repeat after me, "SPF DOES NOT PREVENT SPAM. SPF DOES NOT ATTEMPT TO PREVENT SPAM. IF YOU EXPECT SPF TO PREVENT SPAM, YOU WILL BE DISAPOINTED."

Ok, yelling done (sorry, but this comes up so often, you'd think the "S" stood for Spam). What SPF *does* do is validate that mail was sent from a machine that was (or was not) authorized to send it by the originating domain.

It's nothing more or less than that. As a first-pass on the roots of the problem of spam, it's a great tool, but I would never suggest that anyone treat it as an actual solution for spam per se. Joe Jobs are mitigated and you can also begin to build a reputation with the sources of SPF-identified mail. Once you get spam from a machine that's listed as a valid SPF sender for that doamin, you have a great deal more information to apply ot that domain's reputation than if you recieved spam from a non-SPF sender.

It's not perfect (SPF has its warts, though I think many of your concerns are too minor to be blasting them over), but it is an excellent start, and combined with various other systems out there, helps to address many existing problems.

Re:The Hardest Issue

[cdwiegand]

Um... trojan'ed machines won't match the SPF filter record, and will be rejected. I'm already reaping some benefits, as most viruses sent to us "appear" to come from our business partners - as they've started to deploy SPF records, we're seeing the # of virus emails go down as they get rejected. I understand that SPF has some issues, particularly with forwarding, but sometimes you have to break an egg to make an omelet.

Re:The Hardest Issue

[slashname3]

The best protection against trojan'ed machines sending spam is greylisting. Why? Because the trojan'ed machines do not try to resend messasges. They dump and run. And when/if the spammers modify their programs to queue the message and resend you combine greylisting with several of the rbls out there. By the time you accept the spam message that machine is probably on a block list so you reject the message. I have seen grey listing reduce spam from 3000 to 6000 messages a day down to 5 to 10 a day. And those are caught by spamassassin. And by forcing the spammers to resend the messages you eat up more of their resources making it much more expensive for them to send spam. Ultimately that is the real fix. Make it so costly for spammers to send messages that they will choose not to do it. To that end going after the products is an excellent way to discourage spamming. Obviously they make money doing this. So someone has to be able to connect back to a an actual buisness. Take those buisnesses to court, make them pay huge fines, and they will not engage the spammers services anymore.

Seriously, the combination of greylisting and spamassassin has worked wonders. All isp's should implement both immediately. But they don't because the ISPs are making money by hosting the spammers and selling email address lists to the spammers.

Re:The Hardest Issue

[bigtangringo]

Registrars however may take away your domains for spamming. Possibly backlisting your CC#, getting a new credit card number if you want to keep using that registrar IS a pain in the ass.

Re:The Hardest Issue

[pjrc]

These have just gotta be the lamest excuses I've seen yet. Maybe it was a joke and I missed the punchline?

Its parsing is too complex

It's really pretty simple, and there are free reference implementations.

No sane firewall is going to let TXT records through
No sane firewall is going to let TCP DNS packets through

Most "sane firewalls" are either going to allow DNS queries to originate from the intranet and replies to be received (eg, simple NAT routers)....

Or they're going to block all DNS and a caching nameserver is going to hear requests from the internal network and perform the queries.

Both cases work fine.

The parsing can loop forever

Example, please?

It will increase DNS scaning as spamers hunt for broken SPF records

Wow, there's a solid reason not to do something... it'll cause spammers to waste everyone else's resources.

They already do lots of scanning, connecting to random domains and mounting dictionary-based guessing attacks. SPF scanning is just one simple query for each domain. The term "one drop in a bucket" comes to mind.

Its too complex to be implimented inside the MTA where it needs to be done

Reference implmentations exist and work (well, in beta). Cost is minimal. Extra delay for DNS queries is on-par with existing checks many MTAs do. CPU usage is minimal. Message can be rejected BEFORE data is sent, which SAVES bandwidth.

It can't be properly parsed in sendmail

Milter

ISO 8839 8859 59-15 utf-8 issues for domain names may kill some dns servers

These domains are already publishing their names with servers that can do this. Anybody successfully communicating with these domains (not typing the IPs manually) is already successfully querying them.

Re:The Hardest Issue

[thogard]

Ok... I'll give more details...

The parsing is too complex: It can loop in scary ways where you end up eating up memory forever or take up time forever. Both are bad in an email system.
The parsing is too complex: It can't be done as a sane add in for most mailers and requires a largeish library for what it does. Compare that to DNSBL which does exactly the same thing but is very tiny.

I'm not going to put an example up here about loops.

Can't be properly parsed in sendmail: The key words there is "in sendmail". overhead of milter is very high compared to other options.

There are some complex problems with the ISO 8339 type codes and how they are delt with and all the bugs haven't been worked out yet.

What I don't understand is why do this the hard way when the DNSBL has already shown the way to do it the easy way. Why not just use an A record and lookup $IP.$USER._at.$DOMAIN?

Re:The Hardest Issue

[CynicalGeek]

It's fairly simple - this is just another piece of information for a filter. Good practice for an MTA is:
- Check if the (purported) sender implements some form of sender identification.
- If so, check that the sending IP is as expected
-- If it mismatches, drop the mail as (possibly fraudulent) spam
-- If it matches, give the message negative spam points (in a point based system) and pass it on (e.g. it's a bit less likely to be spam)
- If the sender doesn't implement id, pass it on, possibly with a small positive spam rating (it's fractionally more likely to be spam)

I recently worked at an email security vendor, and my sense is that most commercial tools will support incoming sender id (using any protocols they legally can) within the next year or so.

The open source world will just have to:
1: live without Sender_ID
2: create an anonymously authored and distributed, unofficial, illegal plugin for sendmail and whatever..

Re:The Hardest Issue

[mabinogi]

SPF and Sender ID are not the same thing - though they perform the same role in similar ways.
I don't believe SPF is patent encumbered like microsoft's Sender ID was.
It's also simpler.

Re:The Hardest Issue

[CynicalGeek]

I was using the term "sender id" generically - hence the lower case..

The big argument against this kind of thing is that spammers will just register a domain, send a million emails on it and sacrifice it when it gets blacklisted.

One scenario for the future is that more TLDs will require positive ID to accept a registration. That will allow an anti-spam system to:
a) give mail from such TLDs a lower spam probability
b) blacklist people and companies rather than domains and IPs

Also, it will allow anti-spam laws to be actually enforced. Theoretically, a registrar could require that domain owners provided a continuing credit card authority that would get charged in the event of abuse (rather like when you rent a car in many countries and get a traffic ticket).

This all remains voluntary - if you don't want to be identified, choose a TLD that doesn't require id - your mail will still get through unless it looks spammy in other ways. (e.g. it discusses well known prescription drugs with a white font colour and a subject line consisting of random words).

Re:The Hardest Issue

[Anonymous Coward]

The problem is that in the past during every discussion of spam (and not regarding SPF) a large number of comments would smugly interject:

" just use SPF, blah fucking blah blah"

I find it interesting that as the cracks in the SPF veneer are widening the number and volume of backpedaling comments is increasing
We have gone from SPF will grow roses in the desert to "Well, SPF was never meant to do that or that or that"

The numerous problems, forwarding, etc
The unrealistic adoption time frame
The misguided alliance with MS (has anyone ever come out of an alliance with MS a winner?)
The aftermath of MS driving the combined standard into the ground

Let's chuck SPF and start over - I'm tired of bad ideas that keep snowballing, eg OO, XML, IPSec

Let the patent wars begin

[TFGeditor]

8. Whether any of the proposed authentication standards are proprietary and/or patented.

Standards

[TheJavaGuy]

Does this mean that the government will now enforce standards?

Re:Standards

[Anonymous Coward]

...the government will now enforce standards?

No, that's what we have the National Institute of Standards and Technology for.

/never mind the .gov

Why not go after the merchants?

[14erCleaner]

You know, I can't figure out why we can't combat spam by making it illegal to send unsolicited ads via email (or maybe the can-spam act already does this), but then go after the companies who are actually trying to get customers. After all, they either provide valid contact information, or nobody can buy from them. If nobody can sell anything via spam any more, the reason for it would go away.

Re:Why not go after the merchants?

[garcia]

Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?

Spam is here to stay no matter how much fucking legislation is out there.

Re:Why not go after the merchants?

[Sneeper]

Spammers will render that system useless by sending out spam for innocent companies. You could attack your competitor by anonymously sending spam for them.

Both guilty and innocent merchants will claim they aren't sending out any spam. Who do you believe?

--Sneeper

Re:Why not go after the merchants?

[Trigun]

Given that those are our options, that's easy. The innocent ones.

Re:Why not go after the merchants?

[Basehart]

"Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?"

Enough with the rest of the world crap - it all starts here:

10097 Cleary Blvd, Suite 203, Plantation FL 33324

and here:

ESI, 5072 N. 300 W. Provo, UT 84604

and....you get the picture.

Re:Why not go after the merchants?

[gowen]

Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?

The majority of spam originates in the US. Much of the rest advertises sites owned and operated from within the US, and hosted elsewhere.

Arresting these people wouldn't solve the problem overnight, but by christ it'd be a bloody good start.

Re:Why not go after the merchants?

[Anonymous Coward]

It doesn't matter who you believe. You go after the one who cashes the checks.

Re:Why not go after the merchants?

[Anonymous Coward]

,i> Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?


oh yes we can...

we got frigging nukes man, and one of these days we will elect a nutcase that will use them.

Re:Why not go after the merchants?

[garcia]

Arresting these people wouldn't solve the problem overnight, but by christ it'd be a bloody good start.

yes, just like the drug war right? We know that most of the drugs come into the country at certain points and all we have to do is arrest the people behind the importation at those points.

Cut one head off and another one rises to take its place.

Re:Why not go after the merchants?

[Elwood P Dowd]

(or maybe the can-spam act already does this)

Nope. The CAN-SPAM act explicitly legalizes unsolicited ads via email. It requires that those unsolicited ads comply with a few (totally useless) requirements. The recent lawsuits under the CAN-SPAM act (read "The Yes, you are allowed to SPAM act") are because many spammers do not comply with those totally useless requirements. So the ISPs can go after them, even though spam is legal.

Re:Why not go after the merchants?

[gowen]

Except everyone knows who the US spammers are. Drug importation is a massive business, employing millions of people worldwide. There are only a dozen US spammers individually responsible for nearly all the western world's spam. Your analogy is idiotic.

Re:Why not go after the merchants?

[RAMMS EIN]

You cannot go after the companies whose products are being advertised. How would you know if they auhtorized the campaign, or someone is trying to harm their reputations?

Also, a lot of unwanted email I get is virus mail. What do you do about that?

What I can't understand is why SMTP is still unauthenticated. This is why spam is so hard to trace, and since authentication is already done for virtually every other major Internet protocol, the solution seems easy to see and implement.

Re:Why not go after the merchants?

[Basehart]

" It requires that those unsolicited ads comply with a few (totally useless) requirements. "

Even the email spam I get from my wireless provider - AT&T Wireless - requires that I go to their website and actively opt out from getting it. I also had to do the same to stop the text message spam they were sending to my cellphone.

This was spam trying to sell me ringtones, so it was a third party who was ultimately spamming me through AT&T.

On both occasions nothing happened within three months and I had to make the usual threatening phone call with excessive attitude to work my way up the chain of command to speak to someone who actually had a clue what they were doing and turned it off.

And that's a company I give $127 a month to.

Which box did, or didn't I check to get roped in to that deal!?!

Re:Why not go after the merchants?

[Anonymous Coward]

Ignoring the obvious point about the international aspect of the internet... For the same reasons that organizations aren't fined for posting bills on streetlamps.

Re:Why not go after the merchants?

[Have Blue]

Spam is a social/technical problem (people want to spam, and plain SMTP provides no way to prevent them), so it requires a social/technical solution (convince everyone not to buy things through unsolicited email pitches, change the protocol to shift the costs of email traffic and make spam unprofitable). It's the best example of the tragedy of the commons in history.

Re:Why not go after the merchants?

[sxmjmae]

True. But is the company is from Ding Dong Village in some small dink hole country? The US governement may try to control the world's OIL but they can not control millions of small companies that would gladely pay for someone to flood the internet world with new news about their product.

Re:Why not go after the merchants?

[madcow_ucsb]

SMTP certainly can be authenticated. Hell, *all* of my SMTP servers now are. My ISP, the one I run for a few friends, my work, and both my old schools at the very least required a login to IMAP first or they needed a user/password.

The standards are there, the software support is there both for the servers and the clients. And if I could manage to hack something together to make it work with my god-awful, unmaintainable virtual domain setup then any competent IT person should be able to figure it out.

Re:Why not go after the merchants?

[BigDu]

Its nothing so simple as checking/not checking a box. You (and I) live in the U.S., which has gone with an opt-out system for most advertising such as you mention. Thus you have to waste at least a full day over 2 or 3 months to get off the lists. :)

Re:Why not go after the merchants?

[RAMMS EIN]

The problem is not that authentication is not supported, but that it's not required. I know the historical reason for this is that SMTP was originally meant to be used for transfer, not submission, but todays requirements certainly demand a different solution.

Re:Why not go after the merchants?

[Anonymous Coward]

No, we give them PRAYER. IN CLASS. Oh, and a pledge of allegience.

Same difference.

Re:Why not go after the merchants?

[firewood]

You go after the one who cashes the checks.

And just how is a business supposed to determine whether a paying customer was brought in by the link or phone number in their magazine ads (etc.) vs. the *identical* link or phone number inside Joe job spam?

Re:Why not go after the merchants?

[Jesus IS the Devil]

And exactly how does that discourage the millions of phishing emails that go out every day?

Re:Why not go after the merchants?

[Anonymous Coward]

Parent mod'ed as Flamebait?
I am putting it on my bookmark list of insightful stmts about spam and spam "solutions".

But as far as the crime/cops/guns remark, in California at least the cops are doing pretty well at killing un-armed civilians (take San Jose for instance - shot in the back while running away, shot when brandishing a vegetable peeler, shot while brandishing a cigarette and throwing a chair into a parking lot) and the prison system has been condemned by a federal judge as spectacularly corrupt and broken, so non-criminal civilians having guns probably isn't a big factor.
In fact in AZ, they recently allowed concealed weapons and the state police bigwig said that non-criminal civilians having concealed weapons has not increased nor decreased violent crimes there.

Re:Why not go after the merchants?

[sumdumass]

ahh the opt out system. This is the fabulous system were you contact the spammer and verify your email adress is legit so he can compile a list and sell it to other spamers in an effort to make for the lost add revenure when you don't click thru anymore.

Is that a run on sentance or what? Anyways everytime i opt out, it increases my inbox size by by a factor of 2 usually. It generaly takes around 2-6 months of nothing to bring it back down

Re:Why not go after the merchants?

[sumdumass]

What does smtp have to do with stoping spam email?

No Free Software radicals allowed

[sphealey]

I would be willing to wager a small sum that the only invitees to this meeting will be representative of large, commercial, for-profit software vendors and ISPs. That there will be no representation of/by the Free Software community. And that the FTC will reject any comment not from a commercial software vendor/ISP as having "no standing".

Just a guess.

sPh

Re:No Free Software radicals allowed

[Anonymous Coward]

Based on the questions they are asking, they have at least heard most of the arguments that we are making. They want answers about open standards, proprietary/patented solutions, interoperability, etc. I expect there are people at the FTC that real Slashdot, and want to make sure that they are doing their job as a public agency.

Whether they allow just any random hacker to show up and talk is a question, but I expect they would allow a representative of OSI or FSF to take part.

Re:No Free Software radicals allowed

[slashjames]

I tend to agree with your assessment. However, I wonder what they would do if, say, the lead developers of Sendmail arrived. They certainly aren't people of "no standing" with regards to email!

Yes, I know alternatives such as Qmail and Postfix are out there, but Sendmail is pretty much the standard MTA.

Re:No Free Software radicals allowed

[JamesTRexx]

Seeing that about 75% of mail is handled by open source mta's, they can't afford to go with ip, moneygrabbing, patentfilled solutions.
The only standard that will get accepted will be an open, patentfree one supported by the free software community.
Any closed or patented ones could only be used between the commercial mta's, so it would have little effect on the amount of spam.

Re:No Free Software radicals allowed

[sphealey]

he only standard that will get accepted will be an open, patentfree one supported by the free software community.

You are insufficiently paranoid ;-(

How about an FTC regulation banning the use of any MTA which does not have commercial indemnification guaranteed by a licensed reinsurance firm? Because clearly in these dangerous times we cannot trust our e-mail to software written by Communist hippies who might even be from other countries.

That is the kind of thing FOSS will be facing in the next four years.

sPh

Re:No Free Software radicals allowed

[Frank T. Lofaro Jr.]

Right, because as we all well know, no big companies care about linux.

Re:No Free Software radicals allowed

[JamesTRexx]

Well, the FTC can try banning it, but I doubt they'd get it done outside of the US.
I think at that point the internet would break into a US, and a non-US part. Most likely because people are getting tired of the industry driven agenda currently dominating the US itself.
Another option might be the birth of a new, free internet as it was in the beginning.

Another war on....

[Null537]

That's what I envision.

"Today, we must fight a war, they clog our mail boxes, they offer us penis enhancements, drugs like v1ag|2a, stuff we don't need, they make our wives leave us for believing we go to porn sites and give out our e-mails to just anyone. Today we start the war against spam"
-[Insert head of newly formed organization here]

Re:Another war on....

[gCGBD]

And another czar. The "Spam Czar".
Great.

More wars and more czars. Just what this country needs.

Re:Another war on....

[JamesTRexx]

Will precision bombing be optional?

DNA Readers

[nurb432]

Just have DNA scanners attached to our PCs..

That would ID you back to your other documents, such as SSN, bank accounts, credit history, what you ate for dinner, your life history of every webpage you viewed, or document you read...

Re:DNA Readers

[maxwell demon]

DNA scanners cannot distinguish between identical twins. Therefore in addition to the DNA scanner, a second system must be applied. Maybe an RFID chip that everyone must get implanted if he wants to use email?

Re:DNA Readers

[nurb432]

It was more of a joke then anything else anyway..:)

RFC1413

[jcuervo]

Just use ident. Maybe return a little extra information, like an "@sitename" suffix.

Yes, it would require immediate global adoption, but not if you just assign a higher score (towards spam) to messages that came from sites with no identd running.

Re:RFC1413

[slamb]

That wouldn't work:

• It requires a connection back to the originating MTA. Slow.
• The information returned would be useless - my machine would always say "postfix". Unless you're talking about a new identd linked with the mail server. But that's not what RFC1413 says. It says the "owner of that connection" - that's always going to be postfix.
• It includes no provision for telling if the machine shouldn't be sending this message at all.

A good SASL setup, along with SPF, does far, far more for authenticated email. My machine has this: it rejects any inbound email claiming to be from one of my user's domains unless SASL-authenticated as that user. And has SPF records so other servers can reject messages from these domains unless they come from my server. Thus, it's very difficult to forge an email from my users' domains to a server with SPF checking enabled.

Re:RFC1413

[Pharmboy]

And this would stop spam from zombie Windows boxes, HOW, exactly? Since that is the source of most spam, even IF identd could not be spoofed (yea, right...) it would be useless.

Re:RFC1413

[Anonymous Coward]

Ident as a concept is flawed from the start. Whoever 0wns the sending machine can put an ident server on it that will say whatever it wants to say. It could look at the current "sender" email address its using to spoof your MTA and just return that as the "owner", or Mickey Mouse for that matter. They will even change their zombies to open the ident port and "verify" its own connections. Ident adds nothing that any compitent spammer/hacker could not get around easily.

Re:RFC1413

[Anonymous Coward]

Ident as a concept is flawed from the start. Whoever 0wns the sending machine can put an ident server on it that will say whatever it wants to say.

It was a good concept, in a time long gone. People shared huge machines. People worked from their own account or a compromised user account. Having root access was rare.

But as the situation stands now, you're right. ident is worthless.

how much!

[Anonymous Coward]

My main question is, how much money do you plan to waste on a system that will be hacked in days?

A stopgap measure

[grasshoppa]

An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

This way, zombie'd machines wouldn't have a chance to spew their virus/spam emails to everyone, I could still run my home email server, and the ISPs would save on bandwidth.

I wonder why this ISN'T yet in place, to be honest.

Re:A stopgap measure

[Mr Guy]

I'd bet because the ISP's wouldn't open it back up again. Your TOS most likely says they don't have to.

Re:A stopgap measure

[Muerte2]

The ISP that I work at did exactly that. We were getting on average 2 to 3 complaints a week about spam leaving out network from customer IP addresses. We're a relatively small ISP too! Not to mention the only fix was to call said customer and explain what an open relay/trojan is and then help them fix it. The time required to do this for each customer was pretty horrendous.

So we decided to block that port outbound for all IPs unless a customer requests it (if they're running a mail server etc...). Very few people even notice, it works out pretty well actually.

Re:A stopgap measure

[Anonymous Coward]

An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

Assuming that they will open up any port, *no questions asked*. If they ask a few questions or charge for it, then there will be trouble.

Re:A stopgap measure

[Anonymous Coward]

An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

They don't even need to open it up then. The customers can use third-party email through the submission port, which exists for this purpose. MTAs typically accept mail on either the smtp or submission ports but require SASL authentication for submission. Thus submission is useless for spammers but perfect for MTAs.

Re:A stopgap measure

[TheTomcat]

Both of my ISPs do this. It's not a problem. I either use their SMTPs for outgoing mail, or tunnel to my own SMTP via openvpn/ssh, or use SMTP-AUTH on a different port.

All traffic on both of these ISPs, on port 25 gets blocked before it hits the real world.

S

Re:A stopgap measure

[relapse98]

I wish videotron.ca was actually was doing this.

So far today we've rejected 307 attempts from modemcable*.*.videotron.ca. (52 unique hosts).

So I'd agree that one of your providers is playing along, however the second one might not be finished with the filtering of everyone yet.

Re:A stopgap measure

[TheTomcat]

Hmmm. Perhaps this policy is only for incoming connections on 25. If so, I apologize.

My Videotron link is currently down (supposed to cancel service on the 30th.. probably pulled it early), so I can't test.

S

Re:A stopgap measure

[Anonymous Coward]

Because many people use mail servers that are not hosted on the ISP's network. Blocking all outbound port 25 traffic kills legitamate uses of email. It would be like condemning all the republicans because of what W has done. ISP's understand that with the level of intelligence that their average tech posses's people are going to have to call back every 3 or 4 days and spend hours explaining why they need that port open. Why go through all that trouble when you could just switch ISP's ?

Re:A stopgap measure

[maximilln]

Because, of course, no spam virus or trojaned box can 1) use a relay on a different port or 2) intercept the username and password.

Blocking port 25 is blanket punishment. It's no different than making an entire class stay after school for 30 minutes because a single student was misbehaving. But don't let me dissuade you. Corporations can make up any excuse to stroke their authoritarian egos.

Re:A stopgap measure

[grasshoppa]

Get the stick out of your ass, it was a suggestion, and a damn good one at that.

Tell me, what does your average user need with outgoing port 25 to anything other than their ISPs mail server? Most wouldn't even notice it, and those that do, I'd want to be able to call up and have it opened up for them.

The only people that wouldn't like this, amazingly enough, are spammers and virus writers.

So, which are you?

Re:A stopgap measure

[grasshoppa]

I don't agree. I can tell you that I, personally, would be thrilled if comcast did just what I am describing. I'd be more than happy to spend an couple minutes describing that I need port 25 open, if the trade off was i would get a significant decrease in my virus and spam.

Re:A stopgap measure

[maximilln]

Most wouldn't even notice it

Most wouldn't notice anything unless it came leaping through their window. That doesn't make it the right thing to do.

The only people that wouldn't like this, amazingly enough, are spammers and virus writers

And those of us who realize that ISPs aren't going to happily reopen port 25 just because we ask them to.

Again. Don't let me stop you. Most ISPs already do block port 25 and have shown that it statistically reduces 99.9% of their spam... for the first 15 seconds until all spam trojans are replaced with relays or authentication mechanisms.

Re:A stopgap measure

[dasunt]

An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

The only problem is that it then becomes trivial to send spam through the ISP's email server instead.

Re:A stopgap measure

[Anonymous Coward]

The only problem is that it then becomes trivial to send spam through the ISP's email server instead.

...which knows exactly who is sending the message. And can implement throttling, ensure they do not forge headers, etc. So, no, this is not a problem.

Re:A stopgap measure

[Anonymous Coward]

and where is the relay, on another trojaned PC?

Do you actually have any figures for this kind of problem or are you just making it all up? It seems to work well for quite a few ISPs.

Only one way to fight spam:

[chris_mahan]

The only way to fight spam, which is going to be inconvenient as hell for most people, is to autoblock any machine that sends or relays spam.

Of course, email systems will buckle and fall, and people won't be getting mad as hell because their emails are bouncing or just not getting there.

Then ISP and other companies will actually spend money (120K+) on very competent email admins and fix their damn servers.

Each spam sets the clock forward by 1 week for domain and IP block.

I guarantee there won't be any spam in 1 year.

Of course, 99% of emails will be /dev/nulled for a few months, but that's the alternative to living with spam.

Publish SPF now, be the 126519th...

[pjrc]

If you want to advocate SPF, publish a SPF record for your domain, and then register it. Already, 126518 domains have published SPF records (at the time of this writing).

By the time the FTC's summit comes around, it's looking like SPF is going to be pretty well established.

Re:Publish SPF now, be the 126519th...

[qtp]

I'd like to know how many of those domaines actually are applying effective policies.

SPF is great for communicating a domain's policy and for allowing the reciever to check for compliance, but this does little if the originating domaine's policy is lax (or worse, "no policy). This brings us back to what I have seen as the heart of the SPAM problem since the beginning, ISPs are all for protecting their users from SPAM, but as soon as you ask them to do something about spam originating from within their domain, they act as if nothing can be done. Only if the ISP is willing to set an effective policy, and is willing to take measures to enforce it, does SPF help to reduce spam.

That said, SPF does appear to be the most effective and implementable tool that has been proposed for ISPs to use in the fight against SPAM so far. I just hope all of those participating ISPs have admins that are capable of using it effectively.

Re:Publish SPF now, be the 126519th...

[wayne]

Actually, I have a list of around 650,000 domains in .COM, .NET and .ORG that have SPF records. These should show up in the SPF Adoption Roll Real Soon Now. Surveys of the .DE and .FR TLDs have also been done, but I don't have the results of those.

I'd like to know how many of those domaines actually are applying effective policies.

In the survey of the .COM domains, I found the top ten SPF records to be:

159416 "v=spf1 mx -all"
147883 "v=spf1 -all"
51245 "v=spf1 ip4:10.0.0.0/24 ip4:10.0.0.0/24 ?all"
28206 "v=spf1 a:smtp.example.net -all"
21437 "v=spf1 mx ip4:10.0.0.0/19 ~all" ""
19733 "v=spf1 mx ~all"
15245 "v=spf1 a:smtp.example.com ~all"
9488 "v=spf1 ip4:10.0.0.0/24 mx -all"
6371 "v=spf1 ip:10.0.0.0/24 ip:10.0.0.0/27 ip:10.0.0.0/24 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ?all"
5842 "v=spf1 ip4:10.0.0.0/24 -all"
(I have munged the domain names and IP addresses for privacy reasons.)

As you can see, it is very common to define strict SPF record with the "-all" at the end. Those domains that use the softfail option of "~all" are somewhat more lax, but still moving in the right direction.

The complete survey results are available to people who follow the IETF MARID list and/or the SPF discuss list. I'm not going to post a link to them here 'cause I don't want to be slashdotted.

Re:Publish SPF now, be the 126519th...

[phutureboy]

If you want to advocate SPF, publish a SPF record for your domain

I'd love to, but I use Register.com's DNS servers for most of the domains I manage, and their web interface doesn't allow the entry of TXT records. I suppose I should bug them about that.

Here's the system...

[RecycledElectrons]

Every eMail that is sent (by SMTP - the Simple Mail Transport Protocol) should be considered "unconfirmed." This means that it may or may not be from the return address.

I propose that we add a new layer called CMTP - the Complex Mail Transport Protocol.

CMTP simply takes an unconfirmed eMail (sent by SMTP) and sends a packet back to the sender. This packet asks for verification of the message. The packet includes a checksum, the length, to, from, subject, and the time/date that the eMail was sent.

The sending mail server receives this CMTP checks all of that information, and replies with a CTMP confirmed message or a CMTP not confirmed message.

There is no limit on the number of times that a mail server may be asked to confirm an eMail. There is a limit that messages should not be confirmed more than 24 hours after they are sent. This may pose a small problem in that SMTP does not place a time limit on mail messages.

CMTP does require that every mail server maintain a list of the eMail it has sent. That COULD be time consuming.

CMTP also adds 2 packets to every eMail sent. SMTP was designed to be dead simple. They thought that they could not afford 2 extra packets. In that time, eMail was 80% of all internet traffic. Today, eMail is such a small percentage of all traffic that trpilling it would not be noticed.

Andy Out!

Re:Here's the system...

[PitaBred]

For any email server with a moderate load, do you even realize how much computation that is? checksumming isn't a trivial process computationally. Besides, it'd make spam even easier. The checksums, etc. would all be the same, so all I'd have to do is respond with a canned reply to any query on a spam I (theoretically) sent. All the while this imposes a PENALTY on LEGITIMATE mail, because of the necessary individual calculations.
Nice idea. It has some major flaws, though.
And according to NetFlow, mail still accounts for 1.19% of all packets, which isn't anything to sneeze at.

Re:Here's the system...

[Anonymous Coward]

For any email server with a moderate load, do you even realize how much computation that is? checksumming isn't a trivial process computationally.

And scanning incoming messages for spam is?

Re:Here's the system...

[RecycledElectrons]

"For any email server with a moderate load, do you even realize how much computation that is? checksumming isn't a trivial process computationally." Let's drop the checksum if it's too heavy a work load. "And according to NetFlow, mail still accounts for 1.19% of all packets, which isn't anything to sneeze at." My concern is not the network traffic; it's the load on the server when it has to dig back 23 hours on its hard disk for one packet it send yesterday. Given that we add 2 packets onto each eMail (which may altready be MANY packets) we are not adding that much. I'd be really surprised if this added 0.5% to the Internet's total traffic. Eliminating spam would probably decrease the load by more than we increase it. "all I'd have to do is respond with a canned reply to any query on a spam I (theoretically) sent." That's the point. We make spammers acknowledge that their severs are the ones sending the spam. We not have it traced to an IP, and they can not deny it. The reson the current anti-spam laws are not enforced is that we can not easily prove where the SPAM is coming from. Next, we shut down the mail servers that are spamming. Let's yank their ISP connection. If the ISP does not respond to a demand to take down the spammer in 24 hours, we go upstream and yank their ISP. We'll just disconnect anyone who verifies SPAMs as coming from their computers. It would take an agreement from the operators of the core routers to get it done. The new anti-spam law would make it illegal to verify (not send) anything meeting the definition of "SPAM." You could send any unverified eMail you wanted to. (This would help in retaining true free speech on the Internet; if you want to look in the "unverified" folder. then feel free.) Andy Out!

Getting rid of spam is easy...

[Anita Coney]

There are two ways to get rid of spam. Stopping spammers and stopping people from buying via spam. The former never works because spammers will always find ways around it. The latter could work, here's how:

First, equate spam with child pornography and terrorist activity. Get Congress to make it illegal to buy products via spam. Start arresting and imprisoning those who do buy via spam. After a couple years, spam will stop.

Re:Getting rid of spam is easy...

[Lumpy]

First, equate spam with child pornography and terrorist activity. Get Congress to make it illegal to buy products via spam.

why that will not motivate anyone.

Equate spam with Violating copyright and hacking. that way we will get jack booted ATF thugs busting down their doors, they get held in prison without a trial for months and laws making it worse than outright murder get passed.

child pornography and terrorist activity does not excite anyone in congress, that is why they pretty much ignore it. yet they want to almost inact the death penalty for "hacking" and downloading and sharing a bad pop music song.

Sorry but getting the government involved is the worst thing to do.

Re:Getting rid of spam is easy...

[Anita Coney]

Actually, my entire post was a joke. Sort of a parody on what's happening to P2P technology. Sorry it wasn't funny enough.

Re:Getting rid of spam is easy...

[JudgeFurious]

A dead spammer wouldn't find a way around it.

And yes, I have absolutely no problem voting in favor of capital punishment for sending spam. For that matter you could tack on writing a virus to that and I'd still be for it.

Re:Getting rid of spam is easy...

[statusbar]

Great! Then I can get you "capital-punished" if I can hack in, change your SPF record, send spam that looks like it is from you. What other proof would be necessary?

--jeff++

Re:Getting rid of spam is easy...

[Anonymous Coward]

you're a fucking idiot. Either you're fishing for Funny points or you're completely deluded. this is probably one of the most irrational proposition I've ever heard.

Re:Getting rid of spam is easy...

[Anita Coney]

God, I must be losing it. I thought it was hilarious and obviously a joke. I guess I'll stick to more serious posts and drop the humor from now on. Sorry!

Re:Getting rid of spam is easy...

[JudgeFurious]

I see you've stumbled upon one of the valuable side effects of my anti-spam/anti-virus program. End users with a vested interest in keeping their systems secure instead of idiots clicking "OK" on every box that pops open in front of their faces is just one of many additional benefits!

Re:Getting rid of spam is easy...

[Anonymous Coward]

Not quite, but try arresting the owner of the pr0n site that *paid* the spammer to send the mail. Spammers can hide, but you can't sell something and stay hidden. No employers, no spam! Simple. You think the spammers would send spam for free? Not likely....

Well I can't arrest the pr0n site owner but I always (given enough time) do a little homework and cause the financer just a little heartburn in return. Sometimes its as simple as tying up their web server connection, "feedback" submission form, or placing bogus orders for those male enhancers as Donald Duck. Muck with their cgi signup or order entry programs. Sometimes I'll just take their orders@spammerfinance.com or cheepDrugs@nowhereUknow.biz and submitt the business address to every "please dont spam me anymore" web pages i've ever been invited (lol) to. You know, the ones that are really made for collecting valid addresses, that way *they* get LOTS of spam too. Spread the wealth? I like to share. I sometimes turn the table and use a temp address to check out the remove-me form to *verify* that it should be added to my list of good places to store all my "friends" (pr0n & drug order sites, not yours) email addresses. Ok, the solution is not always as creative as I would like, but it is fun, though the point here is I do *something* equal to what pleasures they had shown me. Nothing distrucive, but just equaly as considerate. ;)

Re:Getting rid of spam is easy...

[Anonymous Coward]

You've done it.
The wolves are circling. Such carelessness. " There are two ways..spam..here's how..child pornography and terrorists..arrests and prison confinement. " To spoof, deceive..the parody in our instance lacks humor. This web, this document..is licensed. The property of..others. Both, you and I have willingly signed a contractual agreement. The nature of the agreement implies..access. Realize, if you will..the entirety of this " web, " in its earliest inceptions..was funded through taxes. Sadly. The information highway is increasingly privatized. Profit margins. Commoditization. Hence. Our discussion.

An international group wants desperately to find a working solution. On the agenda: spam and phishing. We're walked through an e-mail transfer. Each step clearly described. Introduced to the interactions of Mail Transfer Agents( MTA ) requesting and receiving the correct address(es) from a Domain Name Server( DNS ) which in turn negotiates permissions with Simple Mail Transfer Protocol( STMP ). Most protocols( language-rules-permission) allowing e-mail functionality, interoperability and in general, ease of use..are, and have been, licensed under the auspices and authority of the open source community. Now. For our problems.

There is a company. A powerful multinational corporation..intent upon meddling with this internet connectivity. How e-mail functions. Its claim..intellectual property rights. Authorized and submitted to the United States Patent and Trademark Office. All efforts - curtailing and or eliminating spoofing - toward research and development..implementation of tools( software )..Sender Mail Framework( SMF ). Meng Weng Wong's work. Authentication. With the cry, " Intellectual Property Rights. " Seventy-five percent of the internet community will be left adrift. Open Source. Tax monies. Circumvention of ethical behaviors..for profit. And. Control.

Accountable behavior. Responsibility. Concern for others. Freedoms. Knowledge. To actually encourage growth. Non-profit. Healthy competition. Willing cooperation. A helping-hand. These will keep off the wolves.

As if you didn't already know this was important..

[museumpeace]

Let me undescore the impact the conference is likely to have by pointing out that when NIST speaks, the DOJ listens. Here is a quote from a rejected submission of mine that found other documents NIST has authored that Ashcroft and co. now use.

Feeding the fascination many /. readers may have for the escalation of technique and counter-technique beteween hackers and computer forensics experts may not be as valuable as keeping clues about how to avoid getting caught out of the hands of the hackers but I just can't resist... Sciencedaily.com pointed me to something hackers and other criminals might want to study carefully: the PDF guidebook that NIST wrote for the DOJ's first responders to computer crime scenes. Though it has John Ashcroft's name at the top, a glance at the document's time line shows that it was authored by experts mostly from outside the DOJ and completed before the current administration's appointments: the imprimatur of Justice Department on the document may not be ironic.

Drat! I'm gonna get modded for flamebait but with a sig like mine, who'd notice?

Email's role on the net

[Schezar]

Let's face it: Email doesn't (and can't) fill the role it used to.

There was a time when you shared your email address with everyone. It was on your resume, it was on your web page (if you had one), it was in your sig. Email was the universal, simple, fast, reliable communication medium of the internet.

I used it to get my friends together on a weekend. I used it to organize events and meet people. I used it to share information.

Nowadays, IM fills that role. I've realized that nearly everything I used to use email for can be done just as easily over IM. It's reliable, fast, relatively secure, easily encrypted, etc... Furthermore, it is largely immune to spam for a number of reasons.

I find now that I only use email when registering for something (throwaway address), or for confirmation when I purchase something online. Everything email used to do, IM can do (if used properly... Staying online, logging, offline messages, confirmation, not using the AOL client, etc...)

IM is by-and-large safe from SPAM due to the numerous restrictions placed on its use. Rate limits, authentication, etc... These things provide a layer of security, but also a layer of inconvenience.

Were email to incorporate such restrictions, it would remove the last reason in the world to even be using it in the first place! Email is completely open. If email were to be restricted, it would become nothing more than a slower version of the current capabilities of IM.

Re:Email's role on the net

[praedor]

Yeah, right. IM. Pa-leeze. IM requires that the person you seek to contact has their fat ass planted 4-square in front of their computer or leaves it on 24/7. Email is very nice. It works no regardless of the type of client you have. It will sit there waiting for you to check it, perhaps after a vacation, after actually getting off your ass and away from the computer to exercise, or whenever you decide to either fire up the computer or turn on your email client. Oh...IM also requires that your contactee be somewhat in the same timezone (besides sitting on their ass forever awaiting IM messages). Try to IM from California to NYC late in the afternoon. Try to IM someone on the opposite side of the globe.

IM is cute, it is a nice way to reduce your productivity at work and waste time "chatting" back and forth about unimportant nonsense (movies, your new pants, the hot chick from apartment A, etc). Email ain't going away, and it most assuredly wont be replaced by IM, Jabber, IRC, ICQ, Yahoo Messenger, etc. Email works regardless of software/hardware platform, has not propriatory hooks in it (Microsnot tried with their SenderID scheme to add a proprietory hook into email). Nothing beats email for convenience and easy time-shifing.

Re:Email's role on the net

[Have Blue]

Authentication? Most IM programs can be configured to store the necessary password and server information, so this only has to be done once.

The real difference between email and IM is that the former is store-and-forward and the latter is direct transmission. Real-time email conversations are the exception, not the norm, and people are often completely unavailable through IM.

A 100% open, anonymous, and unrestricted communications medium (like email) is not feasible in the real world in the long run. It's too easy to abuse and too hard to counter said abuse, and both of those traits tend to become stronger as the pool of users grows.

Re:Email's role on the net

[Anonymous Coward]

WTF?! I have a half-dozen email addresses that I've been using for the past few years, with little or no spam. I simply don't display these email addresses on any publicly accessible places (websites, usenet, etc). I give them away to friends and customers, put them on my resume, use them for mailing lists, etc. They do a great job, I keep contact with everybody without ever using IM, and a filter or two take care of the few overzealous contacts who start spamming me.

Just because one or two ways of using email invites spam doesn't mean it's complete trash! You folks must stop thinking in Black or White. You do nothing but hurt yourself and make yourself look foolish.

Re:Email's role on the net

[jridley]

Really? So if I want to be contacted, I have to sit around, logged into my machine, 24/7? Do I run 3 or 4 different IM clients because the systems don't interact? Does it work with cellphones? Blackberries?

I'm on an active mailing list of about 400 people, about 75 to 200 emails a day, and as far as I know about 10 of them have IM, and of those 10 there are people on each of several incompatible systems.

If you can get Microsoft, AOL, ICQ, IRC, and whoever else to transparently transport everyone else's messages, and to provide some kind of buffer for when people are offline to hold the message until they log back in again (let's call this, oh, say, a "Mailbox") then you might have a contender.

Of course, you will also have just re-invented email.

Re:Email's role on the net

[Anonymous Coward]

yea, riiiigggghhhtttttt....

Ever heard of a spambot? Thos anoying programs that spew spam via IM's? They have already made life with an IM client like playing space invaders, with you just trying to close all the stupid IM windows that pop up all over the desktop and get in your way when trying to do "real work". Thats bad enough, but when the IM client steals the focus of your keyboard and your cut and pastes send your latest company financials document to some prOn spammer you might be reconsidering how great IM's are. its fine for getting to know someone before a date, but not much else!

Re:Email's role on the net

[Anonymous Coward]

I agree with your general points, but you make it sound like IM'ing across time zones is an impossible problem to solve. California to NYC is nothing. I live in the midwest, and have become quite good friends with a number of people in Australia who are currently 15 hours ahead. Yeah, it's a bit of a hassle, but I don't find it overly burdensome to IM them. It was more a matter of deciding that it was, indeed, important to me to chat with them from time to time; after that, it's been pretty much cake.

I kind of liken it to the "I don't have time to _______" argument. Almost always, the case is you didn't make time.

Re:Email's role on the net

[SunPin]

IM is teh sux.

It sucks because *people can reach me* whatever _they_ want to reach me.

Email is convenient and non-intrusive. I'll respond to anybody but only a few can get me right away.

That's how I like it.

I'm against email authentication. I don't have a spam problem. People have to learn to manage addresses like they learn to drive. If you don't learn, you will crash. Your fault.

Re:Email's role on the net

[calethix]

You don't actually use IM do you?
So if I want to be contacted, I have to sit around, logged into my machine, 24/7?
I primarily use ICQ so I may be wrong here but I thought most IM clients allowed you to send offline messages that would pop up whenever the receiver connected.

Do I run 3 or 4 different IM clients because the systems don't interact?
boo hoo. Use something like trillian that connects to multiple IM servers or convince all of your friends to use the same thing.

Does it work with cellphones? Blackberries?
Again, I could be wrong here as it's not something I typically use but I thought you could send SMS messages at least through ICQ and Yahoo.

I'm on an active mailing list of about 400 people, about 75 to 200 emails a day, and as far as I know about 10 of them have IM
Have you taken a poll? Pretty much everyone I know uses some IM service.

Re:Email's role on the net

[droleary]

Yeah, right. IM. Pa-leeze. IM requires that the person you seek to contact has their fat ass planted 4- square in front of their computer or leaves it on 24/7.

Does it? Is that really a requirement for a chat, or is that merely how most people use a chat application? To put it another way, what is the real difference between a chat client and a email client, beyond the interface of how messages are presented? The only difference seems to be expectation. You could just as easily have chat-to-email and email-to-chat gateways as you could have any single- or multiple-protocol chat-to-chat clients.

I point that out not just to refute you, but to refute the OP. Using chat to avoid spam is, at best, a temporary solution. Hell, there is already chat spam (cham? spim?), just not to the level of email spam. Unfortunately, the level of anti-spam software for chat is also nowhere near that of email.

Re:Email's role on the net

[ekhben]

How odd. I'm going to focus on XMPP (Jabber) here, since that's the protocol I'm most familiar with these days.

XMPP routes all messages through a server. Just like SMTP. XMPP works with any XMPP client, just like SMPT works with any SMTP client. XMPP spools messages on the server when the client is unavailable, just like SMTP. XMPP is an open, patent free IETF standard, just like SMTP. XMPP works regardless of software/hardware platform, just like modern SMTP.

XMPP immediately delivers messages to the final recipient if possible, unlike SMTP. XMPP has reliable support for foreign languages, unlike SMTP, which still has the odd hiccup with messages that aren't 7-bit ASCII. XMPP is extensible, unlike SMTP. XMPP has controls for high volume and unrequested messages, unlike SMTP.

In short, there is nothing that SMTP offers that XMPP does not already do, yet there is plenty XMPP does now and is capable of doing in the future that SMTP cannot hope to achieve.

You can try emailing me about it if you like, but chances are good your mail will be lost in one of the hundreds of junk mails I get each day. My IM client is sitting there though, junk free.

Re:Email's role on the net

[mysticalreaper]

So you feel that you, your company, and even the government should run on an IM system owned and operated by AOL/Time Warner? Or Yahoo, maybe. Or prehaps Microsoft.

What about attachments? Or long messages? What about (web)servers sending automated messages due to an error condition?

Remember, there is no IM standard, which is a key reason why it sux. If you do not see the parallels in the lack of standardization of IM, and also the lack of standardization of SPF, i cannot help you.

Email is GOOD, people like it. Witness it's massive popularity, despite it's problems. Suggesting IM system will displace them is foolish and shortsighted.

However, thanks for raising the issue, i think it's a good one.

Re:Email's role on the net

[jridley]

Have you taken a poll? Pretty much everyone I know uses some IM service.
I've asked on the email list and at group parties. I found about 10% that used IM, but didn't use it all the time.

No, I don't use IM. I've tried, and the simple fact is that most of my friends don't use it, so there's no reason for me to keep it going.

If you aren't sitting at a computer all the time, email is better. I check my mail from home, from work, from other people's computers, from library computers, kiosks on vacation, etc.

I can imagine if I was using IM, at a friend's house I'm visiting on vacation:

me: Can I check my ICQ?
friend: what?
me: My IM messages. ICQ.
friend: I guess.
me: I just need to install this piece of software on your computer first...
friend: Get bent.

No mention of sender pays

[gr8_phk]

There was no mention of sender pays postage as a solution. Anything that prevents anonymous email has an inherent central control which the internet doesn't need more of.

Re:No mention of sender pays

[otis wildflower]

There was no mention of sender pays postage as a solution.

Sender pays _today_. You can't send a single email without a data line and at least client software running on some form of computer. All these things cost money to _someone_ at some point, so while the sender costs are minimal they exist. And yeah, they don't pay per-msg postage. The point is there's no reason to have two extremes: untrusted anonymail _or_ per-message postal fees. It's a false dichotomy, which only benefits those that hold those positions.

Anything that prevents anonymous email has an inherent central control which the internet doesn't need more of.

Fair enough, there should always be an option to send mail anonymously. However, don't be surprised if anonymail becomes a Nth class citizen if we start ranking transports and exchangers by trust.

Re:No mention of sender pays

[Frank T. Lofaro Jr.]

How are you going to handle payments and payment verification anonymously?

That is, without using some anonymous e-cash system that will help the terrorists.

Re:No mention of sender pays

[firewood]

How are you going to handle payments and payment verification anonymously?

Very few people need to receive completely anonymous email (maybe rape crisis centers, police tip lines, and the like). So the load of filtering out spam created by the anonymous tragedy of the commons can be placed on only those with this special need.

For most of the rest of us, our long lost friends and business customers can afford the cost of some sort of e-stamp; and we can either whitelist the authentication method of, or forward some e-stamps to, our favorite impoverished mailing list.

Re:No mention of sender pays

[droleary]

There was no mention of sender pays postage as a solution.

Any reasonable look at "sender pays" solutions died the day spammers took over their first Windows box and turned it into a spam zombie.

Re:No mention of sender pays

[Sein]

Sender Pays, ePostage, or whatever other name you want to put on it is a completely broken idea.

This comment and analysis by John Levine http://www.taugh.com/epostage.pdf/ will show you exactly why, in excruciating detail.

If you want to see some more commentary and analysis on why it's bad for all of us, you should look up Paul Myers at http://www.talkbiz.net/ramblings/comments.php?id=1 8_0_1_0_C
If you can't be bothered, the most pertinent quotes are:

One almost universally negative aspect: Hobbyist lists, run by people who are simply passionate about their interests, would be gone from email. That would kind of suck, huh?

I don't believe for an instant that Microsoft is interested in this because of some altruistic desire to rid the world of spam. Not their style. Not their style at all. If they're involved, it'll be for one reason only: Profit. Profits from selling their (almost certainly broken) implementations. And/or a belief that it will help them expand their monopoly. Or maybe they hope to get a cut of every "stamp" that's sold and passed through their systems. I don't have a problem with profit, honestly earned. I rather like it, actually. That should be pretty clear from the title of this blog, if nothing else. I have a serious problem with anyone breaking the entire email system beyond repair to attempt to wrest or extend monopoly control on something that's become this integral a part of modern society. And I have a real problem with it when that same someone regularly breaks protocols in order to push people toward using their borked standards.

e-Postage is a bad idea under any circumstances. The cost of metering, keeping records and moving the money would far exceed the cost of providing the existing service. According to Mr. Levine's estimates, (conservative indeed), creating the necessary infrastructure and systems could cost hundreds of billions of dollars. Maintaining it would cost unguessable billions more annually. But not to worry. The system will never be fully deployed. Email as a medium of communication would break down under the weight of the "solution" long before it got that far. Isn't that a cheery thought?

That last is what scares the living hell out of the DMA. It's why they want laws that protect opt-out email (spam), and why they wanted to set things up so that they could pay ISPs to deliver UBE (spam) to their customers. But only if the ISPs got rid of the "bad spam" first. (Meaning: Not from their members.) The Internet scares the post office and the phone companies and every government that thinks it's losing tax revenue to online activity. It scares the traditional music industry and every other dinosaur that lives by paying slim percentages to creators based on the dinosaur's control of distribution channels. It really scares companies that sell commoditizable goods, like software, to general markets. That includes Microsoft. Think about it... If you could get software that had the capabilities you wanted from the Microsoft Office Suite and more, for free, would you spend hundreds of dollars for MS Office?

You really should read the whole thing though, quoting just bits of Paul doesn't really do him justice. But epostage is a completely broken concept and untenable solution to the spam problem. Of course, you may choose to disbelieve this.
In that case, the first time you get the $10,000 invoice for the cost of running a developer's list is the moment you'll realize your mistake - unless you act to head that idea off at the pass.

Re:No mention of sender pays

[gr8_phk]

" How are you going to handle payments and payment verification anonymously?"

I was refering to proof of work methods. The receiver [software] requires proof that the sender did a certain amount (receiver adjustable) of computation in order to accept a message. The computation is hard to do but easily verified. It depends on the content of the message and header so that it must be done for each message. This adds a computational cost to sending email but not receiving it. Sending billions of messages (spam) would be prohibitive due to the significant real money cost of the computation hardware. Sending a few emails would be free because most computers are under used when they are on anyway.

People bring up the zombie networks that could offload the cost to the spammer, but 1) that's a different problem that requires a solution of its own regardless of the spam problem. and 2) People would notice something wrong when their machine runs slowly because it's caclulating postage all the time for spam.

There are implementations of this already. They just aren't in widespread use right now. Google for it.

Oceania has always been at war with Eastasia.

[Anonymous Coward]

Yeah, remember when we won LBJ's "War on Poverty"?!!! And when we used to have a drug problem, but then the government declared a "War on Drugs"?!!! And now we're fighting the "War on Terrorism".

It's a stupid metaphor, and leads to superficial "solutions". Why not try taking a better look at the roots of the problem and deal with that instead of just declaring a "War" to incite the proles?

Re:Oceania has always been at war with Eastasia.

[Kehvarl]

You make a good point, but where's the follow through? What are the roots of the problem as you see them? How can we go about fixing it? Where do we start?

and most importantly.. how do we profit from it?
(note, I'm probably joking about the profit part)

Why the FTC

[Anonymous Coward]

Isn't this an issue for ICANN/VERSIGN? Why is the FTC spreading to Internet??? Hmmmm....

I know... XSMTP

[hey]

Clearly the solution is to change SMTP to XML. Its so old fashions that it uses a line-by-line converation. I propose XSMTP which goes like this:

[xml]
[huge header]
[line value=helo]
[/xml]

That oughta fix it.
I am joking.

Re:I know... XSMTP

[Anonymous Coward]

Your proposition is accepted. Now go back to work!

FTC A Global Entity?

[Muerte2]

Last time I checked email was a global technology. Am I the only one that thinks it's strange that the (FTC an entirely US organization) is making decisions about something like this? Isn't there a more appropriate internation technology body that should be handling this? Ultimately this will have to become an ISO standard to get implemented across all mail serving platforms. Wouldn't it make sense to get a global consensus before the US starts making decisions about how best to deal with SPAM.

I live in the US, but if I didn't I wouldn't want the US government telling me how to handle SPAM.

Re:FTC A Global Entity?

[still cynical]

You're right. We need a global, truly international and cooperative body addressing this on a worldwide level. An organization with global reach, full participation by all nations, and a proven track record of efficiency. This sounds like a job for a U.N. commission!
</sarcasm>

Seriously, it has to start somewhere. Increasing the size or scope of the committee is not an improvement.

Re:FTC A Global Entity?

[dubl-u]

Isn't there a more appropriate internation technology body that should be handling this?

Yes. It's called the Internet.

Forget the official government bodies, especially the international ones. The real power lies with the myriad people who make decisions about implementation and adoption. The Internet enables those people to communicate and self-organize in ways that are more effective and efficient than a government bureaucracy could ever be.

I read about SPF here. It seemed like a good idea, so I implemented it for my servers, for both incoming and outgoing mail. If it works well, I'll keep it and tell my friends. Eventually, either SPF will take off or die out. Nowhere in this process is the need for a government mandate.

Re:FTC A Global Entity?

[Frank T. Lofaro Jr.]

Maybe we shouldn't use TCP/IP anymore, after all it was invented by the US, and the gov't no less (specifically the military).

If a good idea is born in the US, there is no reason for the world to ignore it because of that fact.

Re:FTC A Global Entity?

[Muerte2]

The "internet" was never designed to be a global communication network. It's grown well beyond what it was intended.

The FTC assuming that it can make a decision for the Internet as a whole regarding email seems presumptuous though.

spammers demand a clarification

[Anonymous Coward]

The FTC will be accepting public comments until Sept. 30, 2004 via snail-mail or email (authenticationsummit at ftc.gov).

It won't be too long untill this email is bombarded by zillion of nigerian scam zealots commenting on wether FTC should really go on with this plan and wether it is a good move infront of the national economy.

MX certification

[otis wildflower]

IMHO the real way to lock mail down is to use PGP keys to authenticate legitimate MXs, and blacklist/expire certs that misbehave. Add an X header that signs the payload hash with its own seckey, then send to the destination to have it verify before delivery.

'Trusted' sources (including national post offices) could generate and certify keys for these servers, and expire/blacklist them if they're abused. Put the pubkey into a DNS record for the MX.

Legacy mail not in this system could be flagged as 'untrusted' and jailed appropriately.

Or, to be super cheap...

[otis wildflower]

(bad form to self-reply, I know :p) ... How about those 'trusted' sources running DNS servers that provide MX resolution for domains? Granted you'd need DNSSEC to trust them that far (and RFC3445 kinda kills the 'put the key in DNS' idea) but the USPS, various national posts, UN, verisign, etc could run DNS servers that handle MX resolution for domains so you can point your MX configuration at those domain servers ala the RBL. Extra sneaky points to building an entire root DNS dedicated to MX.

It's more of a TWL (Trusted Whitehole List) than an RBL (Realtime Blackhole List).

Of course, it goes without saying that all of this is pissing in the wind as long as people's pain threshold is still higher than the bother of implementing all this.

Spam solution

[Anonymous Coward]

Why can't this work? You sign up for an e-mail account. Let's use MSN Hotmail as an example. Your get your username. So it's username@hotmail.com. Then you get a selection of keys. Perhaps you have username@291.hotmail.com. This key could be set to temporary (such as one week) or permanent (requires manual removal). Then there would be a catch-all option, which would catch all e-mail sent to username@hotmail.com AND username@*.hotmail.com. Perhaps you have username@452.hotmail.com for contacts that are your friends. Or maybe username@news-me.hotmail.com for whenever you contact a news station. This would really hurt spammers, as now they can't simply hit a username, but also hit all possible combinations for that specific username.

Re:Spam solution

[realmolo]

Yeah, a few of the webmail providers do exactly what you're talking about. They generally call them "temporary addresses".

It works, but it makes using email more complicated, and it creates a situation where even MORE e-mail traffic is going to be flying all over the place, mostly to all those diabled temporary addresses.

What we really need is a single registry for email servers, similar to how DNS works now. If you want to run a mail server (and not have your mail rejected by other servers), you need to "register" it with some big, monolithic organization. If you're not on the authorized list, you get rejected.

Yeah, that kills the "openness" of email. You'll no longer be able to setup a usable mail server without jumping through some verification hoops. But so what.

Re:Spam solution

[Anonymous Coward]

> Why can't this work?
> Perhaps you have username@291.hotmail.com.

Well lets see...

/* spammer.cpp Version 1.1 */
char command[8000];
char sucker[8000]="username";
char domain[8000]="msn.com";
for (int n = 0; n999 ; n++)
{
sprinf(command,
"cat spam.txt |\
mailx -s \"enlarge your Johnson\" \
%s@%d.%s",sucker,n,domain);
system(command);
}

That took about a whole 60 seconds to write, now you'll get even more SMTP traffic than before, and the spammers won't care. Ten minutes of coding and the rest is all free money. Its just *a* machine that spends the time swamping your network while they catch a game of pool down at the local pub, and its not even their machine at that! Change the "standard" format and they rewrite a few lines of code, and we are back to square one with spammer.cpp "Version 1.2"

Re:Spam solution

[Anonymous Coward]

Lets say the key limit it 16 characters. Lets say A-Z, 0-9, -, and _ are allowed. That's 38^16. That's 18,903,296,479,567,620,845,142,016 possible keys per username. That's essentially 18.9 * 10^24, OR 18.9 septillion. (Correct me if I'm wrong.)

Re:Spam solution

[Anonymous Coward]

So what? You just closed off e-mail to businesses, the same people who hire the spammers.

Actually, maybe that would be a good idea. Move everyone, including the spammers, to an authenticated business-stylle e-mail system, and a month later reinstate SMTP without telling the business people.

Let's hope so

[Anonymous Coward]

Let's hope that's what happens. Then some community will come up with an alternative system that is similar to the current email, but hopefully a bit more spam-proof. The masses can continue to use the crappy current email, while the rest of us will switch to the new system complete with an old-email gateway. Yes, the masses will eventually catch-up and crap on that system too, just like they did with the internet (web, email), rinse, repeat. But that's the way it goes.

Isn't this a bit too late?

[irate_canadian]

I don't know about everyone else - but I hardly notice spam anymore. I mean, between gmail, thunderbird, and even hotmail (obviously not a definitive list) - I don't see it anymore. It's all filtered out automagically. I think this is a case of the government, once again, being a bit too slow on the uptake. Thanks for the thought guys, but we seem to be dealing with it fine ourselves.

Re:Isn't this a bit too late?

[Anonymous Coward]

>It's all filtered out automagically.

Yes, it is. But how much *real* email do you *not* recieve in the process? I bet that number is more than you think. No automatic filter can do 100% filtering with 0.000% false-positives.

I have personally found places that don't receive valid emails that I have sent, even though I, and my providers servers, are not on any black-list I know of. They are not "randomly" dropped, and the content is obviously not spam. As a sender you can't know what they are using to filter on, and thats by design. But when filtering causes problems with lost messages due to agressive filting then the *solution* is the problem. But in your case, you'll never even know you have a problem.

Why not do what the RIAA does?

[telstar]

Why not do what the RIAA does ... and sue the people receiving the spam? Seems like that'd fix the problem ... right? Right?

Uh no

[Anonymous Coward]

Obviously you have never had to be the one running the email servers that get millions of spam every day which costs you in bandwidth and server resources. Just becuase everything is peachy for you doesn't mean it is for everyone else.

F/OSS will certainly be a main issue there

[wayne]

Anyone who attended or watched the videos of last year's FTC anti-spam conference will know that the FTC very much has a clue about the spam problem. They showed far more clue than even the average slashdotter, let alone the general public.

Not only do I expect many F/OSS people to be allowed in, I expect the concerns of deploying anti-spam solutions in F/OSS mail servers to be front and center. I also expect there to be people who don't give a flip about F/OSS to be there too, along with a bunch of spammers^Wethikal bidnizmen.

SPF may be patented

[SiliconEntity]

The article by Fortunato explained that one reason for the failure and disbanding of the IETF MARID working group was that Microsoft's patent application was published last week and turned out to be much broader than expected. As written it would seem to cover SPF, which is odd since the patent was submitted four months after SPF got started.

The truth is that patent applications are written as broadly as possible and it is common for them to be whittled down by the patent office to only those claims which are truly novel and useful. But this still leaves us with considerable uncertainty about just how broad the Microsoft patent will turn out to be when it is finally issued. We won't know the answer for years, given the usual speed of the patent office.

Worst case scenario

[ajs]

I'm willing to bet that one of the schemes that the FTC is going to propose is one where it becomes illegal for "unlicensed" nodes to connect to a "licensed" MTA unless it is one with whom they have a standing agreement. In other words, you can't be an MTA without getting FTC approval, or "downstreaming" off of someone else's server.

This won't really help SPAM, but it IS something the big ISPs want in order to begin to control where their competition can come from.

Re:Worst case scenario

[pontifier]

You know... that almost makes email sounds like it could fall under the jurisdiction of the FCC. possibly not a bad idea.

they issue radio licences, they could issue email licences, and could hold and distribute a public key for you. You might have to take a basic computer literacy test, but that'd be easy for someome who would want to run an MTA.

spam is kind of like a broadcast, and i wish spammers could have their email licences revoked.

just go with whitelisting

[maxpublic]

Whitelisting is an acceptable solution to the problem of spam. Most of the people who use email are *not* businesses and they only get mail from friends and family; a whitelist will leave their inboxes spam-free. If they want to get email from someone they've met on a forum or elsewhere they can easily add that person to their whitelist.

As for companies it doesn't matter whether they get spammed or not. They aren't part of the target base that make spammers money. If everyone is using white-listing except for businesses, the spammers will go bankrupt; mass white-listing for individual consumers will solve the problem for businesses as well, if indirectly.

I really don't see what the problem is here. The vast majority of email users aren't interested in getting mail from people they don't know. Those that are interested can forego whitelisting, and since this will probably be a small fraction of the population spammers will *still* go out of business since their costs will exceed their returns.

Seems to me that people are making a mountain out of a molehole, and one that already has a solution. Hell, the solution is already part of most email services!

Max

Re:How will it effect?

[cayenne8]

I wonder how this will affect email 'nym' servers...that redirect, strip off info..and make your emails truly anonymous?

The Government

[WMNelis]

Do we really want the government more involved with the internet. Yes spam sucks, and I have had some thoughts that I would prefer not to share about spammers, but getting the government involved is a double edged sword. We don't want them censoring what we see (China), yet we want to get them to do something about spammers. My opinion: Bad idea.

Not always an option.

[thisissilly]

I use throw-away accounts for risky stuff. But...

My primary email address, which I have had since 1992, has been published on the web (in documentation I have written), posted to Usenet (back when I wrote and maintained a FAQ), used in communication with online vendors like Amazon and ebay, and more. It receives lots of spam. It is the account at the educational institution where I work. While I can get a new account elsewhere, and tell my friends to use that email address, I cannot change the address my workplace has assigned me, and I cannot abandon it--it's where other employees (rightly) expect to email me.. So I have to deal with lots of spam.

AC Wants Comments on Color Authenticity

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/09/28/1 534229

What if?

[Anonymous Coward]

1) MTAs are required to have a FQDN in DNS and have a matching RDNS.

2) The FQDN must have the substring 'mail' or 'smtp' in the hostname.

3) if an email came from a host not matching 1 and 2 the email is rejected.

What does this do to stop spam?

Rule 1 forces all MTAs to be registered with someone (Not gov). Since most ISPs do not delegate RDNS this means the MTAs are registered with their ISP and they are easly found at arin.net. Complaining to an ISP stops spam because they do not want their IPs blacklisted.

Rule 2 forces MTAs to declare themselves as MTAs. Emails from 0wned-boxen-by-virus-or-activex-dsl00032.spamevery one.0wn must be relayed through their ISP. Wow ISPs responsible for their traffic, humm..

Rule 3 says play by the rules or don't play at all.

Overhead? a regexp on a DNS lookup that already happens.

Downside, every MTA must have their own IP.

Electric Shock.

[jellomizer]

When Ever some one sends an email they get an electric shock. Very minor a little tickle for normal use this is not an issue. For a spammer this will be far more hazardus.

Re:Electric Shock.

[Roman_(ajvvs)]

I was going to mode the parent funny, but then I realised that could kill my mother...

She sends out pics of her latest flower arrangements to a large group of friends, and her heart isn't as good as it used to be...

If anyone wants authentication in SMTP

[ZuperDee]

Why not check this out? I think this seems like a good solution, myself. Sure, people will say:

1) It will (for all practical purposes) eliminate the possibility of geeks who want to run their own mail servers on a DSL line. So what? There's no good reason for them to be doing that, except for fun or for malicious purposes.

2) It will be a blow to anonymity. So what? There has GOT to be a line drawn between anonymity and the need to hold people accountable for abuse of mail servers. Period.

Until people start to understand that there are tradeoffs in these things, things will be going nowhere.

Re:If anyone wants authentication in SMTP

[Cederic]

Well done, you've picked out two reasons which are more than adequate to prevent it ever being implemented.

>> except for fun

What better reason could there be? Why do you think I'm connected to the 'net anyway?

>> GOT to be a line drawn between anonymity and the need to hold people accountable

Yes. And where I come from, that line is firmly set on the side of anonymity. I demand, I insist, I must be able to send anonymous email.

Admittedly I haven't, not since last using anon.penet.fi, but I'm talking about the ability..

Any solutions that prevent that aren't worth having.

~Cederic

Re:If anyone wants authentication in SMTP

[Anonymous Coward]

Want a system without the geeks? Send a snail-mail or pick up the (non-cell) phone.

Let us have our e-mail servers in peace, don't try to make *our* playground into your private "no geeks allowed" business area. SPAM is close enough to doing that already.

Greylisting

[Anonymous Coward]

I don't like greylisting, primarily for one reason. It destroys the possibility of near real-time message exchange between persons that have never exchanged e-mail. Consider, for example, a salesperson and a potential customer. Waiting an hour for information someone "just now sent" can be costly. Obviously there's no guranteed e-mail delivery timeframe without SPF, but in practice, it typically arrives before I'm off the phone. Because I cannot turn it on or off as an individual mail recipient, I find it somewhat draconian and inappropriate for admins to impose artificial delays on my communications.

Re:Greylisting

[Anonymous Coward]

"SPF" should read "greylisting" in parent. Guess I should just log in.

Re:Greylisting

[slashname3]

Email was never intended to be "near real time" particularly for people that have never communicated before. If you want instant messaging then use instant messaging. Any sales person that throws an email out there on an important deal that can cost money and does not follow up with a phone call is a bad sales person. Once you have talked with someone sent an introductory email and added them to your white list then communications flow very smoothly. Until they track down the spammers and jail them along with the companies hawking unwanted goods greylisting is one of the better tools out there to block spam. One company I worked for was just about ready to disable email completely since it cost so much time to sort through the spam. Implementing spamassassin helped a lot, implementing greylisting for them made email a usable tool again. It was really that bad.

whitelisting? Useless by itself.

[dwheeler]

Nonsense. Many businesses want to talk to strangers (except they have the curious phrase "potential customers" for them). And don't you get email from long-lost friends/relations?

Sure, whitelisting alone helps SOME people. But for many people that's not enough.

Re:whitelisting? Useless by itself.

[maxpublic]

Reading comprehension might be of some use to you. Try taking a gander at the post again to see if you can comprehend *why* businesses need no spam protection if Joe Consumer is white-listed.

And apart from businesses, most people don't want email from strangers any more than they want phone calls from them.

Max

Proof Of Work tokens and HashCash

[speaker4thedead]

I'm amazed that I haven't seen more about Proof of work tokens for spam-fighting.

Proof of work tokens are hashes (like md5's) that take a relatively long time to compute and are very quick to validate. For most purposes, adding a few seconds to the delivery of email is unnoticable. For spammers, however, it greatly decreases the number of emails that can be sent out within a period of time.

Even though this does not completely eliminate the problem, it can significantly reduce the amount of time spent sifting through spam. Used in combination with public-key cryptography, it could even allow for mass-mailings from known users. (For instance, the Red Hat mailing list.)

The current problem with spam is a result of the fact that it takes almost no money to send spam. Increasing the amount of time spammers need to use in order to send out email is the only way to make a dent.

Links:

HashCash.org

Reusable Proofs Of Work
Currently down, but look at the google cache

Re:Proof Of Work tokens and HashCash

[Sein]

Interesting concept, but still a broken idea.

I'll refer you to my complete posting up-page, but:
http://www.taugh.com/epostage.pdf/

Ordinary users and hobbyists don't have 10,000 0wn'd zombie boxes to do their hash-cashing computations for them.

Spammers do

And with hashcash, you've just given them an extra incentive to not stop using 0wned boxes that's been listed on a RBL - which hardly seems like what you're after in this context.

Re:Proof Of Work tokens and HashCash

[speaker4thedead]

(btw... the link is broken: http://www.taugh.com/epostage.pdf)

That paper provides a weak argument against PoW tokens. PoW tokens change the numbers of emails sent out by orders of magnitude. Certainly, a spammer can use cracked boxes to generate hashes, but that also reduces the utility of cracked boxes by several orders of magnitude.

PoW tokens are most effective when used in combination with other means of spam protection/prevention. Consider grandma, from the paper you linked, with her 100 Mhz 486. Almost all of the people she will be emailing are people that she already knows or is trying to establish a business relationship with (shopping at Amazon.com) Once identity has been established, it's no longer neccessary to use the tokens. Instead, whitelisting via digital signatures could be employed. This technique would also allow solicited bulk mail, such as mailing lists, to continue to be computationally cheap.

Moore's law does cause one to pause when thinking about PoW tokens, untill you realize that the size of the tokens is variable. Since they're merely there to denote that the sender has spent some of their own resources to make (initial) contact with you, then the size of the token could be used to show you how much that person cared about getting in touch with you. The larger the token, the greater the confidence in the message. In other words, the tokens grow with computing power.

The bottom line is that PoW tokens, while not a silver bullet, could add some barbed wire to the battle-field of spam. Since I've had the same email address for 14 years now, I would be happy with a 5% reduction in spam.

p.s. I didn't mean to minimize the importance of security here. In addition to locking down the email protocols, we also need to lock down the average user's computer. The fact that spammers have 10,000 0wned boxes is significant to the spam problem, but something to be considered elsewhere.

Slippery Slope

[bill_mcgonigle]

Tell me, what does your average user need with outgoing port 25 to anything other than their ISPs mail server? Most wouldn't even notice it, and those that do, I'd want to be able to call up and have it opened up for them.

You can make the same argument for only allowing 110/25, 53/udp inside the ISP, and only port 80 and 443 beyond the ISP.

90% of customers would be happy and it would prevent a fair number of worms and trojans from propogating.

Would you advocate such a position and why or why not?

Re:Slippery Slope

[grasshoppa]

Depends. I'll explain:

With just port 25 being closed ( or a select few ), it's much less administrative overhead, and a much lower chance that something will break. And it's easier to train your higher level techs what to look for in abusers ( I openned port 25, and the traffic has spiked and hasn't gone down since...hmmmm ) with a few select ports.

That said, I'd love to see AOL implement this. You just KNOW their target market wouldn't even realize this is what is going on, and it'd cut back, dramatically, on the amount of crap out of their network.

So it's a toss up, but I can't see any reason in the world why local level ISPs don't block the "dangerous" ports by default.

Good

[darnok]

One of the key inhibitors to fixing the spam problem has been the lack of ability for any solution to be widely enforced quickly. SPF et al are nice and dandy for what they are, but the time it takes to implement them globally is just too long. Each ISP is faced with two choices:
- enforce new anti-spam technology, and accept that paying customers won't get their email for a while until the rest of the world falls in line
- don't implement it, or wait till everyone else implements it, or partially implement it so that no customer misses their email

Neither of these options will work.

From a purely technical perspective, a lot could be done today to reduce spam dramatically. However almost all suggestions fail on the point that they require every ISP and/or user to adopt the new solution simultaneously, or risk losing email.

If the US FTC is hosting a forum on this, *and* they get support from equivalent bodies in other countries, then *just maybe* a technical solution can be put up and accepted on the understanding that (on some nominated date/time) every significant ISP worldwide will turn it on simultaneously.