Slashdot Mirror
Could Fake Phishing Emails Help Fight Spam?
Glyn Moody writes "Apparently, the US Department of Justice has been sending out hoax emails to test the security awareness of its staff. How about applying a similar strategy to tackling spam among ordinary users? If fake spam messages offering all the usual benefits, and employing all the usual tricks, were sent out by national security agencies around the world, it would select precisely the people who tend to respond to spam. The agencies could then contact them from a suitably important-looking government address, warning about what could have happened. Some might become more cautious as a result, others will not. But again, it is precisely the latter who are more likely to respond to further fake spam messages in the future, allowing the process to be repeated as often as necessary. The system would be cheap to run — spam is very efficient — and could use the latest spam as templates."
The spam problem will not be solved with laws or pretty tricks like this.
It is a technological problem, and as such will be solved by technological changes: the SMTP protocol is outdated and totally unadapted to the modern uses to which we put it. Let's replace it with something that authentifies sender and receiver properly, and that allows for efficient transmission of binary data.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
In my experience, many of the people clueless enough to respond to some spam email are also the ones who wouldn't understand the reply that came back to warn them of their behavior.
(Heck, you wouldn't believe how many people I've had to help out, because a free version of their Windows anti-virus software expired, and they couldn't figure out what to do with the windows popping up to tell them they needed to download the newer version. They thought that stuff meant their anti-virus "broke" because they got a virus!)
Sending more spam in the name of eliminating spam is not eliminating spam. It's still creating a mess on people's email servers and personal computers, and storage for much of it adds up, especially at the server level. How about we simply improve our educational system and teach marketing majors a bit more about business ethics and ethical advertising?
This idea is awful for the same reasons that I don't want the local police department entering my home to show me how easy it is to pick my locks.
The idea smells of John Ashcroft appointees.
Let me get this straight -- we should suggest to people who are highly credulous that there is the possibility that they might receive legitimate email from "suitably important-looking government address"?
That will never cause bigger, more successful phishing scams.
No.
Spam persists because a tiny (absolutely, infinitesimally small) proportion of the recipients actually respond to it. Whether that's due to stupidity, greed (oooh - I might get something for nothing), boredom, accident or simply curiosity (hmm, I've never replied to SPAM before, I wonder what happens).
The costs of sending it are so low, that it is still worthwhile, providing there's one idiot in a million who takes the bait.
How do you cure this people problem? I don't know. Even if you spend you whole life telling children not to put dirt in their mouths, some still will. You'll never get rid of spam until all the dirt-eaters and spam-responders get a dose of common sense, and that'll never happen.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
to go right with your metaphor, the "condom police" picks up a girl/guy in a bar, takes s/he to a hotel room, asks if they can go bareback, s/he says yes, receives a fine and a slap on the wrist (possible mandatory safe sex lessons) and goes home. Seems sensible to me.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
my school district did the same thing, and it works great.
Really? Sounds ridiculous to me.
Sounds to ME like there's a testable hypothesis here, which someone should think about testing rather than just saying it SOUNDS ridiculous.
Your post advocates a
( ) technical ( ) legislative ( ) market-based (X) vigilante
Sending out spam to counter spam is bringing justice by breaking a law.
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
These mailing lists as well as end users would have to deal with additional volume of spam.
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
(X) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches (you need to compete with spam filters)
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(x) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers (they never learn)
( ) Dishonesty on the part of spammers themselves
(X) Bandwidth costs that are unaffected by client filtering (you're adding to the volume of spam bandwidth)
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
(X) Countermeasures should not involve wire fraud or credit card fraud
(X) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
I once had a signature.
The person just told you it worked and you reject it anyway!? It's stubbornness like yours that prevents simple solutions like the one the article proposes from even being considered.
Its unfortunate how this problem has been labeled "impossible" and now slashdotters spend enormous energy to explain why "No spam solution will ever work.", but its all BS from the pseudo experts. The fact is that not much has even been tried. Its like the misguided fools who say you can't find every bug in a program. Of course you can, you silly fool. Don't project your failures on the problem itself!
The simple solution to spam is to require intelligent throttling of all email coming from downstream internet connections. Noncompliance results in blocking. And yes, you could resolve a number of other problems, like zombie DoS bots, with this simple and obvious solution.
Yes, this would require ISPs to actually show some responsibility and to actually communicate with their peers and customers, but it would work. Its not too hard to find the sources of spam and block it if everyone does their part. But ISPs aren't doing their share because they've built the $9.95 a month business model that does not budget for responsibility. Screw them. They can go bankrupt and maybe internet will cost $11.95 a month but at least somebody will answer the phone.
The top level ISPs can implement this solution by policy alone and that is all you need because the policy can be required to be applied downstream by contract.
Of course, stupid people will flail around trying to explain why this won't work. I might even get the "Why your Spam solution won't work" form filled out for me by some loser script kid, but you know, it really isn't funny anymore.