Microsoft and Yahoo! Fight Spam - Sort Of

kyndig writes "In a Forbes article, Microsoft claims that 90% of email on the internet is spam. To fight this, Yahoo! has teamed with Cisco in developing DKIM, a signature based email authentication. Not to be outdone, Microsoft is proposing SenderID, which examines an email to see if it is coming from an authorized server. Earthlink's chief technology officer, Tripp Cox, goes on to examine the pro's and con's of each specification and provides practical application results." From the article: "Critics have accused Microsoft forcing SenderID on the industry without addressing questions about perceived shortcomings. The company drew fresh criticism recently when reports claimed that its Hotmail service would delete all messages without a valid SenderID record beginning in November. While AOL uses SPF, many e-mail systems do not. If Microsoft went through with this, for example, a significant portion of valid e-mails would never reach intended Hotmail recipients."

Comments

Let MS do it...

[losman]

If a bunch of hotmail users stop getting email then that will only hurt MS.

Re:Let MS do it...

[natedubbya]

Right, somehow I doubt microsoft would start deleting e-mails. That's just silly. The instant someone finds out a real e-mail was deleted is the instant they switch e-mail providers.

Re:Let MS do it...

[DrEldarion]

If anyone had even bothered to read the linked article, they'd see that it said MS would "flag it as potential spam". They wouldn't just stop getting it.

Re:Let MS do it...

[pmsr]

You don't need an Hotmail account to use Messenger. Hotmail and Passport accounts are two very different beasts. Just register your Gmail account on the Passport.net site.

/Pedro

Re:Let MS do it...

[Iriel]

My biggest concern (and please don't bash me for this) is not about Hotmail users getting all their email flagged as spam. The problem I can see with this is if Microsoft strongarms other servers into using the SenderID. It's almost like the way that the majority of websites have CSS hacks and workarounds for a broken browser(IE) that still won't be fixed in the next version. If enough people are using the proprietary garbage, then people will others will be forced to support it.

If they can muscle thier SenderID onto enough servers out there than less email becomes spam, then SenderID is free to be a gateway for other proprietary garbage that MS may decided to bundle with it. Microsoft has had its overwhelming failures at times, but it also has a record of 'forcing' their way onto enough of the market to make an impact for better or worse. That's just my take on it; it's not what it will do, but what it will allow to happen in the future (should it catch on)

Re:Let MS do it...

[norfolkboy]

Wrong

It won't only hurt MS.

Non receipt of email can hurt businesses not remotely connected with MS.

For example, I run a website with around 52,000 members. Each member has opted to join a mailing list, and they also receive alerts when they have a new message waiting for them on the website.

My own stats show that there are a significant number of users that will not return unless they receive a message telling them they have a new message on the website.

When back on the website their interest for the site increases, and they are likely to upgrade to a paid membership.

I've asked people who only log in from time to time, why they do so, and asside from the reason given above, the other reason is:

"I forget my login details, and the message alert email gives me a reminder".

(Too much effort to use the password reminder tool is it?)

Anyway - users are funny things, and for many similar sites, we depend on email getting through to hotmail and AOL users - they are the bulk of our custom.

So no,

it doens't just hurt MS, it hurts anyone with a significant interest in the 'net.

Re:Let MS do it...

[maotx]

Actually, what we need is a messaging protocol that isn't tied to some website.

Jabber anyone?

Re:Let MS do it...

[BeatRyder]

Hmm, trillian?

Re:Let MS do it...

[lav-chan]

Trillian is OK feature-wise (it supports most of the major protocols completely), but there's also Miranda, which is an open-source 'minimal' client. It's got a ways to go (their AIM plug-in still uses TOC instead of OSCAR), but depending on what you need it might be good for you.

At least it works

[CaymanIslandCarpedie]

Not going to discuss pros/cons of these systems, but at least the do help. Two days ago I got one of those PayPal phishing emails in my hotmail account and hotmail had a big banner on top saying the sender's ID couldn't be verified. This could be a great help to users silly enough to fall for these attacks (assuming they actually pay attention to the warnings).

Re:At least it works

[_LORAX_]

Not really. Once people start seeing that every mail from everyone they know excpet those on hotmail get a warning it will cease to be effective.

False positives are WORSE than false nevatives.

Re:At least it works

[slavemowgli]

And? What would prevent a spammer or phisher from creating the necessary setup to pass verification? Things like SPF and Sender-ID are good for stopping (or at least warning about) mail that some spam clown sent with a forged From: address (which can be highly annoying if the forged address is in one of *your* domains), but it won't do a thing about, say, email that comes from, say, "support@paypa1.com" or so.

Besides, if you want to warn users about phishing, you don't even need any of these tricks. GMail, for example, warns me with a big red banner when it thinks that an email may be a phishing attempt, and so far, it's always been right - no false positives, no false negatives, even without any technical trick that depend on the honesty of the sender (which both SPF and Sender-ID ultimately do, in that they allow malicious senders to set up systems so that tests are passed for spam and phishing mails and the like).

I only wish their spam filter would be as effective... :)

Re:At least it works

[Elwood P Dowd]

Besides, if you want to warn users about phishing, you don't even need any of these tricks. GMail, for example, warns me with a big red banner when it thinks that an email may be a phishing attempt

What makes you think Google isn't using SPF and Sender-ID for those banners? And dunno what you mean "no false negatives". I've seen quite a few fishing attempts on my gmail account that had no banner.

All the SPF and Sender-ID critics continuously point out that SPF and Sender-ID only have the features they were originally designed to have. Ok. That's plenty. How can it not be a good thing to be able to show whether a given SMPT agent is authorized by the domain? Yes, obviously, we all know that spammers will then be able to set up their own domains and spam via those domains with SPF and Sender-ID. That's FINE. That was the entire goal of the technology. All of a sudden, plain old blacklists will work way way better. You won't get spam messages that appear to be from acquaintances. No one ever said that messages using SPF and Sender-ID should always pass through your spam filter.

Re:At least it works

[Shadowlore]

If ebay/paypal published SPF records indicating what servers send valid email for ebay/paypal, and your server checks those, how can a spammer set up a ligitiamte system to bypass that system? They can't.

The only way is to:
* alter ebay/paypal DNS records by some means
* spoof the IP address.

Gmail may well have a very large database of valid email from ebay/paypl and perhaps others, or may be implementing their own version of SPF that doesn't rely on the domains to publish SPF records. They may, for example, have done research to see what IP ranges are used by ebay/paypal or other banks and if it doesn't come from those ranges they consider it likely a phishing attempt. Essentially a form of SPF. We do this on some of our (Fortune 50) email servers; it isn;t hard to conceive of Google doing it.

Mail::SPF::Query essentially does something similar.

but it won't do a thing about, say, email that comes from, say, "support@paypa1.com" or so.

It doesn't have to. Such a domain gets reported as phsihing attempt, ebay/payal goes after the domain to get it shut down, end of that problem. Indeed, they already have. Do a whois on it and you'll fid it owned by eBay. So yes, SPF would work here. eBay can put out an SPF record saying all email from this domain is invalid. Servers using SPF checks can then toss it or mark it as invalid.

Indeed, this use would be an excellent use. If SPF had a field to indicate a domain sends zero mail we can safely discard/block all email claiming to be from there.

If you think google doesn't use a form of SPF or sender verification you are sadly mistaken. Besides, SPF is not intended to be THE solution, just a (good) tool in the toolbox of the solution.

Problem with fighting spam...

[moz25]

It seems that one constant problem with fighting spam is that sometimes the ones who are fighting the spam are doing more damage than the spammers themselves...

Heh

[aftk2]

Perhaps this is Microsoft attempting to leverage (yes, I used it correctly!) what they perceive to be as their market dominance to hold users' feet to the fire. Basically, "We've got a lot of users. If you want to communicate with any of them, you're going to need to play by our rules."

Note: I'm not commenting on Sender ID, whether its technically sound, etc... I haven't really been following this. I just think its interesting that Microsoft tries its old tricks in industries where it doesn't necessarily have the clout to do so, at least with as much success.

Re:Heh

[hal9000(jr)]

It's not just Microsoft's old tricks. Many 800 lb. gorillas (Cisco, IBM, Intel) have done the same with more or less success. Most of the time, wrangling is done in working groups where vendors start deploying products based on early standard drafts, which commits them to lock-in, which then motivates them to fight for thier methods regardless of technical requirements. Besides, market dominant driven standardization is not always a bad thing. The anti-spam market is so fragmented that having a Microsoft force a decision may actually move a resolution.

Bad news

[mfloy]

This has bad news written all over it. These companies are going to try and use their size to push their technologies on everyone else. This will result in systems that are beneficial for Yahoo and Microsoft, but that don't adress the needs of everyone else. If something like this is done, it should be done internationally by a group of companies and individuals from a variety of backgrounds.

Re:Bad news

[kryptx]

Of course, but something like this "should" have been done ten years ago. Spam is nothing new.

I, for one, am glad that somebody seems to be trying to do something about spam other than blacklisting, whitelisting (a la TDMA), or bayesian filtering. I couldn't care less if it's Microsoft, as long as 1) everyone can use it, and 2) it works.

Re:Bad news

[PeterBrett]

I couldn't care less if it's Microsoft, as long as 1) everyone can use it, and 2) it works.

ROFL.

1. Not everyone can use it. Microsoft's supposedly "Reasonable and Non-Discriminatory" patent licensing for Sender-ID is nothing of the sort, and makes free software implementations impossible.
2. It works... for a given value of "working". Whoo-hoo, now spammers need to set up a Sender-ID record for [423.sdlfk2_133dsk.net], [419.sdlfk3_175dsk.net] and [12.dngls4_983duy.net]! Wait until the domain gets blacklisted, then set up a new set of randomly-generated domain names! Maybe I should patent it! </sarcasm>

I could care if it's Microsoft. Hands up if you want Yet Another Broken Incompatible Standard?

delete all messages without a valid SenderID

[Anonymous Coward]

To delete all messages without a valid SenderID is not quite the same as to mark non valid SenderId messages as spam

what should be done

[hsmith]

is all the major companies sit down and design a new email system. the current email system is like a sinking boat they are trying to patch and prevent it from reaching the bottom. now, everyone is going their own seperate way (MS, Yahoo), where there will be no standard. the whole system needs to be scraped and rebuilt from the ground up taking into consideration spam, which was never present when the system was designed.

Naaah...

[TripMaster Monkey]

Never happen...Microsoft would never abuse their market domainance to foist an inferior product upon the industry...

Oh wait...

All things considered, not a good thing

[CdBee]

To be honest I vastly prefer the Gmail approach of having relatively smart spam analysis than a whitelist approach based on authentication.

Think of all the people out there who don't have their own mail server but have SMTP/POP access to a hosting company's machine. A change in the core protocols for email would adversely affect most of them, as even if they all had the knowledge to make the changes, they may not have the ability.

Add to this the possibility that a requirement for SenderID will just result in spammers mounting directory attacks against SMTP servers in order to find logins that work..

All this will really cause is a migration away from hotmail !

Re:All things considered, not a good thing

[b4k3d b34nz]

I agree. Although whitelists are good, they tend to become annoying, much more so than receiving spam. Gmail manages to block about 200 emails of spam per day for me, and lets in maybe 4 or 5.

At least for a while, the SenderID system will end up blocking too many valid emails and will irritate users. I suppose after it's been around for a year or so and they have a decent system and database for the whitelist, the system will see the results that Microsoft wants.

Hotmail sucks anyway...Gmail is far superior in every sense.

Re:All things considered, not a good thing

[scovetta]

I disagree. No matter how good the spam filter is, it always misses a few. False negatives are annoying, but false positives mean that you have to scan your 600+ spam e-mails per day to see if it missed any. A non-perfect spam filter is just a fancy inbox sorter.

I don't think whitelisting is the way to go either, though, for obvious reasons.

I have a dedicated server with a dozen or so domains on it. I'm forced to send mail through my personal ISP because mail coming FROM my domain gets marked as spam by most large ISPs (no, I don't spam, nor is my IP on a specific spammer blacklist). So if I decide to start spamming from my dedicated server, no one will get it (unless I route it through another ISP, in which case now it's their job to check).

Re:All things considered, not a good thing

[Phrack]

SpamAssassin reduces my spam by 98%. That's just one example of filters... the point being that the more filters deployed out there (at ISP's, companies, etc), the more spam gets auto-tossed into the bit-bucket, and the less economically viable it is. Simply starve the market, requiring no protocol changes.

Re:All things considered, not a good thing

[Uncle Grimmy]

SpamAssassin is a great idea for relatively small amounts of email traffic, but utterly impractical for large ISPs that process terabytes of incoming email traffic daily. ISPs must also consider the adverse effects of false positives in their spam filters. (anyone else remember AOL's snafu when they blocked a series of emails from a county government in Florida? )

The other problem, of course, is that spammers constantly use new tricks to avoid filters. "In a race between bullets and armor, bullets will always have an advantage" Purely defensive measures, such as filters and block lists will give the advantage to the spammer as they are more able to adapt quickly than large ISPs are.

Litigation and Criminal prosecutions, combined with efffective and adaptive filtering measures are the best bet. Unfortunately, effective litigation and prosecution is made more difficult by a lack of effective authentication for email traffic. These are things that SenderID and SPF are designed to address. Prosecuting individuals who advertise through spam is another effective measure. (for example, maybe RICO would be useful in going after folks who hire spammers to do their advertising?) There are plenty of laws which address criminal conspiracy, and applying those to the anti-spam laws which have hit the books recently may take some of the economic incentive out of unsolicited email advertising.

Just a thought...

-Grim

Sender Policy Framework

[coolnicks]

There is also Sender Policy Framework (http://spf.pobox.com/), this is very simular to SenderID but it has the majour advantage that its open source, agreed microsoft is trying to push SenderID down everybodys throats, I myself publish SPF on a number of domains and it does a good job. The more people that use SPF the more power it will have over SenderID.

Re:Sender Policy Framework

[tb3]

Except that the Forbes article says that "... a Sender Policy Framework (SPF) record, which is covered under Microsoft's SenderID framework. "

Does this now mean that SenderID includes SPF? Or is Forbes confused?

Anyway, it doesn't get around the fact that SPF generates false positives, according to the article.

Re:Sender Policy Framework

[coolnicks]

I disagree with the false positives statement, I run web and email hosting and cant recall seeing any false positives.

Agreed SPF does a better job at fighting fraud and viri, but it does have a go against spam. A very high amount of spam is from fake or randomly picked real domains, now when all these real domains publish SPF nobody can send spam form them anymore, combine this with checking for existent domains and the only option left is for the spammers to root servers as you said or buy their own domains. Buying their own domains can be sorted quite easily by black lists, as soon as the world and his wife starts receiving SPAM from a new domain it can be blacklisted, and in regards to rooted servers, sure this is a way to get past the SPF, but if people secure their servers/get themselves onto black lists we should be ok.

Nick

Re:Sender Policy Framework

[tepples]

Does this now mean that SenderID includes SPF?

Yes. If you're publishing SPF records, you're already publishing records that are accepted as valid by any conforming SenderID processor.

Multiple e-mail accounts and masking

[Zweideutig]

With several gmail accounts, I never have trouble managing spam. I don't reply to suspicious e-mails, and if I do, I am sure not to use the return e-mail address of my primary account. I keep an account for things like ebay, rentacoder, guru.com, etc., and a seperate account for personal e-mail. I have been doing this for over a year and I have only received six spam messages, and those were in the secondary account. I don't see why AOL couldn't encourage their users to do this. Isn't this why we have multiple e-mail accounts available from ISPs?

The problem... Meetings

[Alex P Keaton in da]

One of the main problems with this, in my OPINION, is that corporations can't keep up with individuals. It is sort of like how Geurrilas, from the time of the US colonies to Vietnam, have been able to put a hurting on huge armies.
Corporations aren't as light on their feet as spammers and internet miscreants (for the most part- I know I am speaking in generalities).
It takes many meetings over years it seems (Meetings- None of us is as dumb as all of us...) to come up with a new policy or system regarding spam etc.- commitees are formed, proposals made etc. Then, someone (or group) without meetings, without authorizations, comes up with a way around the new system.
As has been said a zillion times before on here, by people more intelligent than I- the only way to stop Spam is to make it not pay, by having no one respond to it. It is like Drugs or Prostitution- if there were no client base, there would be no sellers....

Re:The problem... Meetings

[Otter]

I think you have the right analogy and the wrong conclusion. What it is -- it's easier to be destructive and nihilistic than to be careful and responsible. Spammers aren't smarter than the guys who developed mail protocols, they simply don't have to care about negative consequences of their actions.

Incidentally -- Sky Dayton's CTO is named Tripp Cox? WTF? I grew up in Connecticut and went to Yale and I've never actually met people with names like that.

Re:The problem... Meetings

[isotpist]

Except that drug dealers and prostitutes actually supply something:-)
I really don't understand how anyone buys anything from spammers. How many people have the unique lack of critical thinking skills and lack of erections to support all these spammers?

SPF doesn't prevent spam

[jaredmauch]

SPF helps with virii and phishing. eg: someone connecting saying they're billyg@msft.net from a dsl line in bellsouth land. If i'm evilspammer@example.com, I can just publish my SPF records in the same way you do, as long as i send from example.com's authorized SPF records it'll be good.

You're just saying that it's a valid domain-name, but as soon as someones dns servers or smtp servers are rooted, you'll have spam again. The good thing is it'll help let legit people you do business with (eg: your Bank, CC company) say that a message was authorized by them, or at least by the SPF rules.

What About

[Noodlord]

PGP key's? I thought people knew about and used these. With a pgp key, it is signed with an encrypted hash, and you have the option of encrypting the message along side it. Once this is done, you know an email is coming from a valid user because it contains their key. These are already used in workplaces around the world. Why implement a new system when one already exists? Not only does one exist it is more or less and open standard. Yeesh! I wish people would actually stop rebuilding the wheel in the software industry.

90% of messages spam

[aardwolf64]

Lets see... If we write a tool that immediately filters 100% of all e-mail, we can claim that our "Spam filtering tool" gets 100% of Spam with only a 10% false positive rate. Excellent!!!

Re:Two email systems

[brainnolo]

Why would this stop spam? In my physical mailbox i get spam as well and don't tell me they don't pay the shipping fee or the guys that put those ads in your mailbox. So how would this be any different? They could afford to spam before the email, so they can also if emailing becomes a paid service.

I'm not sure I'm affected by HotMails decission...

[Name Anonymous]

I currently do not email anyone who has a hotmail account, so let hotmail go isolate themselves.

With Yahoo & Cisco proposing an alternative to Microsoft's suggestion for a standard there wil at least be some fighting over which design (if either) becomes a standard. Without the competition, the odds are that one might win by default. (Unfortunately.)

My mail servers do have SPF records and when I get a chance, I'm going to setup SPF record checking for incoming email, although initially I'm going to only have it add a header to emails.

At the very least, I recommend eveyone who can set up SPF records for their mail servers even if they can't take the time to set up checking SPF records for incoming email. This would help by enabling places that do check SPF records know if they're getting (possibly) forged return addresses.

MS is just eliminating competition...

[FriendlyLurker]

I have used Hotmail for years for communication with "untrusted" sources. In the last 3 months I was forced, regretfully, to let the account die... Hotmail-Microsoft had begun to allow "legal" spam through to the hotmail account. Week after week, the same spam messages over and again was forcing me to check the account. Marking the emails as spam had no effect, I would get the exact same message the next day-week-month, same email address and all.

I complained, and was told I could use filters for those un-markable spam items. Yeah, right.

Advantages to MS for letting "authorized" spam through
- They get paid, probably very well, to send spam to all hotmail accounts.
- They increase page impressions and advertising revenue forcing hotmail users to check the site when notified of waiting emails.

A Great Idea(TM), something an Accountant more than likely worked out, looks oh-so-great on paper, congratulations.

What they cannot measure is how pissed off I got, and in the end abandoned their system permanently, advising all clients, friends, relatives to use another service for their web based email address. (I have had no such problems of ausorized spam with Yahoo/Gmail... yet).

My conclusion, MS does not give a rats arse about how much spam we are forced to look at... they just want to be on the spam generated profit gravy train via "legalized" spam, and don't want freeloaders competing with them to deliver it.

Kalori.

-
No sig. is a good sig.

Why is this a problem?

[bad_outlook]

Seriously, why is this a problem? At home I have a FreeBSD box that runs mail through scanners and figures out what's what. Works like this:

incoming:25 -> Postgrey (greylisting) -> MailScanner -> ClamAV -> Spamassassin (with DCC, razor checks) -> DSPAM -> Postfix -> users_mailbox

All ClamAV definitions are updated via cron by Freshclam, all Spamassasin rules are updated via Rules_du_jour daily. Using this I get just about zero spam, with a VERY rare occurance of realy mail being labelled spam (and that's usually bad chain-emails sent around by my wife's friends - and I consider that spam anyway ;)). Seriously, I'm no genius, but why can't this kind of solution be bolted on? Even if a company is locked into Exchange, slap a box like this accepting :25, then have it relay mail on after the checks!

I fail to see why a solution like this can't be implemented on a large scale 'free-mail' company like Hotmail or Yahoo! If they could stop (and eventually block) spams, they could help turn the tables on spammers, making them less profitable. What am I not seeing?

Greylisting

[Sanity]

If you run a mail server, and you aren't greylisting, then you need to be.

Its a simple idea whereby your server exploits the fact that most mail servers obey the SMTP standard, while most spam sending software does not, to only accept mail from servers which behave properly. Plugins are available for most popular mail server software.

I implemented this about 6 weeks ago and noticed a dramatic and immediate reduction in spam, perhaps better than any other single anti-spam measure.

Industry announcements

[merc]

Yahoo!: Announcing: Domain Keys!
Microsoft: Announcing: SenderID!

(some time later)

Yahoo!: Presenting: Domain Keys Identified Mgmt!
Cisco: Presenting: IIM!
Microsoft: Um, hey lookie... SenderID!

Re: A blank check for Microsoft.

[FriendlyLurker]

This article "A blank check for Microsoft" more or less confirms the changes to spam policy I have observed while using Hotmail over the past few months:
http://blogs.salon.com/0003364/stories/2005/02/01/ aBlankCheckForMicrosoft.html

Problem solves itself

[Nijika]

I've always considered Hotmail a bit of a UCE enabler anyway.

Re:Two email systems

[hal9000(jr)]

Um, that won't stop spam, but it will increase the likelihood that you will get better quality spam. I have been tracking me snail mail for a few months. 70% of the mail I receive I would classify as spam. Credit card offers and advertising circulars from companies I have never done business with (MBNA, Providian to name two). Then there is the mail I receive from companies I do business with, but are trying to extend thier reach. All that mail costs money to print and mail. I don't know what the bulk rate is, but I bet it is larger than $.05 and the cost to the USPS to actually deliver it must be higher. HOwever, since they are going to spend the money sending out snail mail, they might as well go the incremental cost of making the mass mailing look good so that recipients will open it. I think the same principle will apply with per charge USPS email. No, the driver for the USPS to charge $.05 send an email is pure profit (and to regain control of it's monopoly) because the costs to process and deliver snail mail outpaces the revenue collected to send it.

No single technology..

[Ckwop]

No single technology will bring spam under control. It's going to take a blend of technologies, namely:

1. Spam filtering.

1. Preventing forged headers.

1. Making e-mail sending computationally expensive.

The first campaign, spam filtering, has worked with resonable success. Spammers now have to send a lot more e-mail in order to reach their customer base. Of course, e-mail is cheap to send so this hasn't changed the economics of the situation dramatically and army of slave machines that they've hacked make getting a lot of CPU power fairly straight-forward.

The second campaign on which we are embarking is designed to reduce this army. How effective this will be only time will tell. The principle is concern is about throw-away domains be a problem.

If I set up a domain and tell the SPF address to allow any machine on the internet to send mail then i've totally destroyed the value of SPF. However, it's value in controlling pishing should not be underestimated.

The final campaign in my list it the nuclear option: Using CPU time to create digital stamps. The idea behind this is to take the hash of your e-mail (complete with subject, addresses etc.) then brute force a collision of the last 20 bits of the hash. For the normal user, this wont cause a noticeable slow down, for a spammer it will probably destroy their business model.

The drone armies will be cut down to size. Rather than sending a couple of hundred messages per second they may be able to manage one or two. The CPU load on a drone would be so high as to make the PC unusable and the users of these hacked machines would have to start taking notice: they will have to get their machines fixed. If spammers wanted to send messages directly they would now need supercomputers.

There are disadvantages to the above approach. Mobile devices would take a long time to mint a stamp. This can be combated by setting special rules for the SMTP servers that forward messages from mobile devices.

The same problems also exist for third-world countries where they might be running significantly slower machines. However, even if it took 15 seconds to send an e-mail, I think that's an acceptable price to pay for the service.

Overall, I think the real answer lies in the combination of these three schemes. I believe there is a "critial point" in the fight against spam. Once you start to tip the spammers from profit to loss we will start to see huge reductions in spam. The only way to achieve this is to put the cost on the spamer. Electronic stamps are the way to do this.

Simon

SenderID does not help spam... too much

[ChadL]

I was getting about 40 spam messages a day, before I implemented my new anti-spam e-mail server. Now I get about one or two... but SenderID only blocks about two messages a week. Much more effective are my set of 5 Blacklists, a URL Blacklist, and some simple rules. SenderID can stop fake from addresses, but the people sending the messages will just use servers that do not have SPF entry's, as all the servers will never implement it.

Hotmail has No Spam Filter Whatsover...

[loyukfai]

Even though I classify every email from Hotmail itself as junk, they still kept getting into my Inbox instead of the Spam folder.

Re:Hashcash for mail would be better

[Alioth]

The trouble is many spammers are now using networks (say, 50,000 or more) of pwned Windows zombies. They are doing it on a huge distributed network - they don't care if calculating a hash slows them down. If each zombie only sends 100 emails per day, that's 5 million spam emails sent. You'd have to have an insanely long calculation time to make a dent on a zombie network.

Only as long as few use it

[bluGill]

This works for now. However when everyone moves to it, it won't help at all. It is trivial for spammers to get around this - follow the standard. They don't bother now because most of their mail isn't being stopped by this trick. When it starts stopping a lot of email they will just implement that part of the standard and greylisting will become useless.

Re:Hashcash for mail would be better

[warkda rrior]

many spammers are now using networks (say, 50,000 [my emphasis] or more) of pwned Windows zombies

I would be very interested to hear the source of this number.

Email Authentication Options

[SuperSanta]

I just got back New York and the http://www.emailauthentication.org/summit2005/agen da.html/ Email Authentication Summit that covered all of these topics. Here's the last one page summary on all 3 (SPF, Sender ID, DKIM)

How is validation performed?
SPF - RFC2821 MAIL FROM address, "Bounce" or "envelope from" address
Sender ID - RFC2822 PRA FROM address
DKIM / DK - Designated "singer" address/RFC2822 FROM address

Strengths
SPF - Reduces bounce messages where the victim receives errors for mail they didn't send
Sender ID - Validates the identity most users see and reduces the threat to phishing.
DKIM / DK - Provides end-to-end validation over multiple hops (i.e. forwarding)

MTA Updates?
SPF - Receiving update required.
Sender ID - Receiving update required.
DKIM / DK - Sender / Receiving MTA update required.

Weaknesses
SPF - Only validates the last hop
Sender ID - Only validates the last hop
DKIM / DK - Can be "broken" by imperceptible changes (and FWD: >'s in messages)

Publishing / Signing
SPF - Easy. Publish and maintain in DNS.
Sender ID - Easy. Publish and maintain in DNS.
DKIM / DK - Create keys & publish in DNS.

Mailing Lists
SPF - Easy.
Sender ID - Easy.
DKIM / DK - Hard

Forwarding
SPF - Hard.
Sender ID - Requires a header added.
DKIM / DK - Easy

Performance
SPF - Negotiable. ISPS may cache to improve.
Sender ID - Negotiable. ISPS may cache to improve.
DKIM / DK - 5 - 10% processing CPU

Re:ANSWER THE FUCKING QUESTION FUNNY MAN

[friedmud]

Ok, I'll bite..

"Why should a company not use it's marketshare to leverage it's products?"

Your basic premise is fine... that in general companies should be able to use their marketshare as a selling point. The problem is that in Market economies Monopolies develop (either "naturally" because they are the best, or through illegal practices).

In our economy once a company or product reaches the state of "Monopoly" there are certain rules that they must play by in order to allow natural market forces to continue (rules as in laws). One of those is that you can't use a Monopoly in one sector to force your way into another sector.

Microsoft has violated this time and time again... and to the detriment of consumers and consumer choice. A few recent examples:

1. Internet Explorer. Bundling IE with Windows was how MS pushed itself into the "internet sector" using their monopoly on operating systems.

"But IE is free! How is this bad for the consumer?!". Because MS then put proprietary extensions into IE that only it's web-server and authoring tools (Frontpage and Visual Studio) are equiped to serve/create (ActiveX and extensions to Java). So if you want to talk to IE the best way to do it is with Windows Server after creating it in Visual Studio/Frontpage... and since they used their monopoly to deploy IE... 90% of people are using it.....

2. Windows Media Player (Both the format and the player). This one is the next MS cash cow. They bundle WMP with Windows so everyone has it...

"But WMP is free! And it works well! How is that bad for consumers?!"

Becuase of what they are doing now. They are pushing WMP as the next format for EVERYTHING. Music, Movies, Streaming Media... Have you noticed that the new HD-DVD codec is WMP based? Do you think you'll be able to play those without a license from MS? All MS has to do is start making set top DVD players and they can force everyone else out of the market (by not licensing the codec to them).... wait they already are! (Think XBox 360).

What about streaming wmp?? What kind of server do you need to do that? Oh.. right.. Windows Server.

What about music? Oh you mean WMPs with DRM will only be playable in Windows? Hmmm.

#

For some reason people have a hard time understanding just how evil MS really is. And when I say "evil" I don't mean that trying to make money is evil. That's capitalism. What's evil is trying to make money at the detriment to consumer choice and product quality.

This is really a problem because destructive Monopolies are bad for the entire economy. They stagnate innovation and produce "economic blackholes" where all the money from the economy pours... but nothing comes out (how many billions does Microsoft have just sitting around in liquid assets?)

Ok. That should do, nobody read this far anyway.

Friedmud

Zombies will steal your sender ID

[Animats]

Right now, most zombie machines send using some arbitrary identity. Most of them are just proxies or forwarders, not mail generators. The way the spam industry works is that you rent some zombies at SpecialHam, get a "bulletproof mail server" from Black Box Hosting in China, install Dark Mailer, and go. Dark Mailer runs on the "bulletproof mail server" and generates the messages, which are sent via your rented proxy farm.

If sender ID goes in, the software that takes over a target machine will just have to use the normal sending identity for that machine, or, more simply, transmit it back to the bulk mailer so the mailer can construct the outgoing messages accordingly.

MX Logic reports that, as of March, 9% of spam already has valid SPF markings, and 0.83% have valid Sender ID markings. So the technology to bypass SPF and Sender ID is already deployed.