Slashdot Mirror
Certified Email Not Here to Reduce Spam
An anonymous reader writes "Goodmail CEO Richard Gingras surprised Legislators and advocacy groups today when he announced that the CertifiedMail program being implemented by AOL and Yahoo is not meant to reduce spam. Rather than helping to reduce spam Gingras claimed that the point is to allow users to verify who important messages are really from, like a message from your bank or credit card company."
Perhaps also to work as an effective, if limited, white list. Not only will it tell you what emails are "important" but it would certainly be an easy to way to keep a small-sized good-guy mailing list.
-dave
http://millionnumbers.com/ - own the number of your dreams
Its much easier to succeed, if you never try anything difficult.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Rather than helping to reduce spam Gingras claimed that the point is to allow users to verify who important messages are really from, like a message from your bank or credit card company
...leading to more efficent prevention of phishing, and ultimately... reducing.. spam... D'oh!
Sendou Wave Kick!!
CAKE
But, I've not had much time to work on it since I've been employed. :-( And it's a much nicer, decentralized solution to this problem that has potentially much less weight and wider applicability than PGP.
Need a Python, C++, Unix, Linux develop
Remember the paper from Harward dealing with phishing and why it works?
People don't even notice security features. They don't notice HTTPS, they don't notice certificates, they don't even notice bogus URLs. Why should they notice a "verified" mail (or lack of this verification)?
And those who do already know how to deal with phishing mails, they are already capable of discriminating between fraudulent and legit mails.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It's all about money. I just can't wait until I get to pay 33 cents to send my Parents an email.
So this is just a paid for whitelist?
Hello, McFly?! If I'm expecting emails from my bank, I'll be putting them on my safelist anyway! Them and everyone in contacts, emails for forum notifications, newsletters that I want.
This doesn't seem to be doing anything other than making money for someone else.
Why not joining bluesecurity.com and report SPAM automatically? At 370K members, it's guaranteed to slow down the spammer's website (spam victims' slashdotting!) until they opt-out the complainers out of their lists.
They got even a Firefox extension for reporting spam with Yahoo, Hotmail and GMail.
Nothing to see here...we already knew it.
In other words, CertifiedMail is here to certify the delivery of spam by the "important" spammers who have the resources to pay for it.
This is my post. There are many others like it. If you don't like what you read here, go try one of the others.
Oh yes, there will be spam..it seems to be here to stay.
Just like every other problem the 'bad guys' face when exploiting the rest of the population, they will find away around this too.
The news will be that if this practice does go into wide usage, spammers will turn toward draining large, anonymous bank accounts to fund their e-mail influxes.
This 'tax' will only create more problems than necessary.
My advice: leave what isn't broken alone and if you do have problems, then I suggest you install a good e-mail filter to pick out the spam that does get through.
Pat
My bank or CC company, or just *any* bank/cc company ?
Don't blame me, I voted for Kodos
We all knew this wouldn't reduce spam. This is just a launching point for email blackmail, along the lines of BellSouth's bandwidth threats. The legal people at AOL are just trying to cover their butts so people don't have a leg to stand on when they complain that they don't get less spam. Totally stupid program.
Xbox reviews.. We think they're funny.
Goodmail's service is built around one single idea: easy to pitch to CEO's of large mail providers.
The providers get paid, and they get a good excuse for charging those fees. End of story.
If Goodmail's intentions were genuine, they wouldn't charge the "businesses" for every separate mail provider, but create globally valid certificates and then discuss with mail providers of accepting them.
However who would care to accept the certificates if he doesn't get the dough (the fees)? So there, we arrive at what Goodmail did.
Can you imagine paying up completely independently to every single ISP in the world so it can accept your SSL certificate? Yea, it's THAT bad...
Not meant to reduce spam but to verify sender...SPF/Sender-ID/DomainKeys anyone?
If many companies do this, then the only "certified" mail in the box really will be spam. And then I really will know--little blue ribbon=spam.
Phew, I thought I wasn't going to be able to tell it apart from my legitimate mail!
It appears that site you posted, http://666.43.123.666/bankofamerica/mylogin.php, has already been slashdotted. Anyone know a mirror where I can login to my account?
Yeah someone's certifiable here.
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
This really isn't news. This is just an acknowledgment of the deceit behind their earlier statements. They did a real crappy job of deceit though, as everyone saw this as something that wouldn't block spam. Instead I'll have spam with little blue ribbons that was paid for. And then I'll have spam that I can't tell apart from my normal mail because it wasn't paid for, but it made it through the spam filter (except really we all cann t311 1t apart fr0m 0ur normal mail for the 0b>i0us reasons).
Email address, Web URL, refering party -- each should be bulletproof BEFORE you extend your trust. Otherwise, you might get scammed.
Take this article. We know it's reliable and trustworthy. How?
Well it was submitted by "anonymous reader," who has posted many a fine gem on this here site.
Then it was filtered by an "editor" named "ScuttleMonkey." How can you not trust a monkey? Monkeys rock!
Then, when you click on the link, you see you have been taken to "Spam Daily News," a bastion of journalistic integrity that makes the New York Times look like the New York Times before Judy Miller got fired.
Finally, the whole thing originated from a little place we like to call "Slashdot." I think the quality of this brand needs no elaboration.
So as you can see, it is not hard to recognize a secure, reliable, not-at-all-misleading-or-shady chain of Internet links. Happy surfing!
Is this just going to be RSA message-signing in a shiny package?
Silence is golden... and duct tape is silver.
Are you kidding? This is what they've been saying all along. The media frenzy has been... inconsistent with what AOL, Goodmail, and Yahoo! have actually been saying in their press releases.
Of course, AOL wasn't terribly consistent even with themselves early on, but if you think Goodmail billed this as an anti-spam solution, you've clearly only been paying cursory attention to the story.
I spent an hour beating them up on a number of issues, much to the embarrassment of my 'far too ready to sign anything' CTO.
Their VP kept harping on how "it will tell users they can trust your mail". My point that the real challenge was getting users NOT to trust things was not well received, to say the least. I also mercilessly attacked their constant assertion that their widget is "unspoofable", on the simple grounds that a similar widget in a similar location would be sufficient to fool many users.
My CTO has been asking me when we're going to implement Goodmail ever since. Khaaan!
Wait. I don't get it. If the purpose is to ensure the sender really IS the sender, why do I have to pay up again?? If I'm the BankofSlashdot and I send emails to my customers from the email accountdetails@bankofslashdot.org, why is it they can't just add me to a registered senders list with my server's IP recorded? Why's that suddenly cost money?
If the purpose isn't to reduce spam, what does this new pay-for-being-recognized service offer that current ISPs don't already? Most ISPs will begin taking actions against your spam if you start spamming without contacting them anyway, and you are looking at legal trouble if you spam with forged headers or people who have opted out. Through whitelists and regulations, the framework is already in place for the legit spammers to spam. AOL already has whitelists. AOL already negotiates and limits email volume with mass email marketers. AOL already uses blacklists. And this whole thing isn't even mandatory!
So I'm really not sure what this pay system is supposed to do except earn AOL an extra dime at no added cost.
say you're the bank of america, and you send your "transactional" mail with this GoodMail thing turned on and the little flag set. what about your other emails that you don't pay for? if any of your mail is sent uncertified, then phishers can just impersonate that "oh this is just one of those uncertified emails we the bank of america send you occasionally - click here to see our latest offers (requires SSN)".
so suddenly you have to pay for _all_ your mail just to maintain your credibility. and then what if you cross the spam-complaint level goodmail sets accidentally and they throw you off their system (as they are contractually obliged to do)? does that mean that nobody will ever trust your mails again? do you get to send out one last certified mail saying "okay from now on pay no attention to that little flag?"
it seems a really bad idea for a big company to place their credentials in trust with a third party and then let them charge them for every mail they send
I already sort my incoming email, by many categories. What purpose is there to having two classifications: "important" and "other"?
So there is clearly a need for someone to help the average user discriminate between legitimate and nefarious email. The need could result in a significant market opportunity if an ISP developed appropriate technology and backed up the technology with a meaningful guarantee. People will pay for security, even shallow security.
I also believe this will reduce email that maight be strictly catagorized as spam. Not the broad definition of unsolicited email that has resulting in no meaningful agreement on how to deal with the problem, but email that has a misleading subject, spoofed headers, clearly obtuse text content meant to disguise the HTML rendered message, and links to shady websites. If the ISP allowed users to set up a list of safe addresses, provided the level of protection that the USPS service does for unsolicited mail, and provided a good customer crisis line, that would provide a big competitive advantage. If, however it is just charging spamers for email while the user dangles on the vine, that it is quite useless.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
The US Postal Service demoed just such a thing many, many years ago. They had an email encryption and delivery service to verify that the message was not altered. I suppose the problem in certifying the sender and receiver and proving delivery (to a person - not a mail spool) were technical issues they couldn't handle.
The difference of the USPS vs. Goodmail is that the USPS has official legal authority for such thing as mail tampering and proof of delivery.
I suppose if they were to offer the service now, Goodmail would buy a law to prohibit to USPS from competing against a private business as Sen. Santorum is trying to do with the weather service.
Ever dream you could fly? Get up from the Flight Sim. I Fly
uh, isn't this what PGP/GPG are for?
The email is being send from "bigfootinteractive.com".
I use the raw ASCII message to get the link and when I past it in the browser, I get that reject message.
So, we have more examples of the bank making phishing EASIER by going through a 3rd party and linking chase.com to that 3rd parties email.
It's funny that Chase includes this bit on their email.
Again, all the links go to chase.com and I've verified that in the raw ASCII text of the message, but the response emails come from bigfootinteractive.com......
Seriously, how easy does Chase want to make a phisher's life?
Hey, Chase! Use your own fucking email servers you morons!
If you're still wondering, let me know and I can post their response email for you to check yourself. I've replaced my domain with "DomainReplaced.com" and fucked up the id string, but other than that it is pure.
GnuPG / PGP signing, with peer-based levels of trust. Or even better: get the public key direct from your bank when you first log in to your account. Added bonus, you have the option of turning on encrypted email.
This might bring up the question of encrypted spam, but your keyring would act as a whitelist. If some random person sent you an encrypted or signed message, then you would be presented with a message asking if it should be accepted.
All we need is a simplified way to do this for the general public. Too bad Thunderbird doesn't come with Enigmail preinstalled. We'd probably need something else for webmail. (FF extension?)
Can I ask what happened to using Personal certificates?? Why, when we use SSL certificates to verify that a website we are visting is actually the true company, can't we use personal certificates to verify that the email we are reciving is actually from the company?? Surely they could configure their mail servers to filter out email on this basis without requiring a 3rd part solution that makes you pay for it. Hate to state the obvious but this is just the big companies way to getting their hands in on a great free thing that the internet provides
Functionality may be limited.
I only mod funny =D
Automatically? Surely if there existed a way of reporting spam automatically, then it would be trivial to apply the same technique to filter out spam automatically.
Pardon me. It's not automatic in the recognition algorithm, but it's much faster than having to do a whois and then reporting to the ISP for each SPAM that gets to your inbox.
Let me describe the Blue Frog algorithm.
Suppose your e-mail is somedude@myinbox.com . When you set up a blue frog account, you get a "honeypot" address like somedude@report.bluecommunity.com. The reports are analyzed (by whom or what, I don't know) and then your bluefrog software receives a request to report at the spammers' website asking for opt-out (the opt-out just tells the spammer how to download the "do not intrude" registry, it doesn't give out any e-mails).
The point is that this software actually gives an incentive (html form "SPAM") to spammers to stop sending e-mail to your account.
What I do is sending the SPAM that gets into my junk mail folder at the honeypot account. So, filtering is necessary as a first step, but after a while, you don't have to filter the junk mails, because they don't get to your e-mail in the first place. In my case, I use the firefox extension to send my Yahoo! junk-mail to report the SPAM to blue frog.
Then I just let my blue frog software do the dirty work.
Because it's just a matter of time until the non-certified mail messages are almost discernible from the certified ones, and you eventually end up having the exact same problem you have now.
Of course not, that way when it does not reduce spam, they can't say CertaifiedMail was a failure.
It's not meant to limit SPAM (unless your idea of email, as some want it to become,
is a communication medium where you only accept people you "trust" and reject the
others). It's meant to protecte trademarks, and push responsibility away from the
sender (i.e.: "you should have checked who the mail came from, ours are signed).
Yahoo, and of course banks and other institutions who want to defend their
credentials love SPF and similar systems. They don't care about SPAM, they just
don't want to get blamed by customers and their insurers for phishing mails and
the like.