Slashdot Mirror
A Look At Google's Email Spam Prevention
CNet has a story about the security measures Google employs to protect their email systems and fight the never-ending war on spam. Their Postini team, acquired two years ago, has a variety of monitoring tools and automated response systems to find and block undesirable messages. Quoting:
"The system scores each message on numerous combinations of criteria, assigning a weight to each and then comparing the score to those in a database of several hundred thousand message types that have been flagged as good or bad from Postini honey pots and customer spam reports. ... To block fresh spam attacks not covered by existing heuristic technologies and viruses not covered by existing signature databases Postini relies on proprietary Zero-Hour technology to identify new outbreaks that show up in the traffic patterns and quarantine them for later rescanning. Customers can also create and build out their own white lists of message senders they trust and blacklist others they don't trust. It takes an average of 150 milliseconds for a message to be scanned by the antivirus engines that Postini licenses from McAfee and Authentium.
I now get a couple of shed loads less spam. I used to check the apam directory for false positives. Don't bother doing that either.
:-)
Go gmail
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
My previous ISP switched me over to Postini with no advance notice (we got a cheery note from marketing after the deed was done). Blocked half the spam and half the ham. They told us how to disable the filtering "features" but it turned out that all the filtering could not be turned off.
I'm not with that ISP any more.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
but what I really want to tell you is that I've inherited a great deal of money and I need someone to help me transfer it to the US. I live in Nigeria. You all seem to be great gentleman, so I will pay appropiately.
Contact me.
part of gmails phishing filter seems to do this
if(hyperlink in email ends in .exe)
{
isphishing = true.
}
Even if this is an email from someone in your whitelist and is merely quoting text from your own message you sent them. .exe in it to be marked this way :(
And there seems to be NO way to prevent a message with
DRM-free indie games for the PC and Mac: Positech Games
They can filter out the obvious spam mail, but some spammers are so clever and so well hung - because they've taken some DrMaxMan to acquire an enlarged sexual wand with which you can perform better and be bigger for f.r.e.e - that they can actually embed their spam offers inside real messages in such a way as to be completely undetectable by filters.
Comment removed based on user account deletion
This is great for business mail too... small company where I work was literally BURIED with spam until we moved to gmail. Since their mail addresses were "in the open" on our website for years, some of them get 200+ spams a day. Now, if 1 in 1000 passes, it's a bad day. Also, in my private inbox, I had an VERY old mail address still redirected to gmail address... turned out that was the source of 1/2 spams (100+ / day). But those were filtered too without problem. So far so good... not a single false detection for ham. Nothing but praise so far. Disclaimer: I do not work for gmail. I am the genuine satisfied customer with smile on my face, from "after" picture, as seen on TV!
At least 75% of my spam is addressed as though it was sent from *my* gmail account. Of course, it's easy to set up a filter to reject all such spam, but then I lose the ability to send reminder messages to myself. Seems like it would be extraordinarily simple for google to outright reject messages that claim to be sent from their servers that in fact were not. I sure wish they would!
So by using gmail, am I indirectly making money for McAfee?
...because it's actually not working - Gmail spam filter recently became very ineffective - i have to classify about 5-10 Viagra spams daily. (Google, have you heard of it? geez!) then it occurred to me that a while ago Gmail captcha was cracked, so I imagine spammers send themselves hundreds of spams only to classify them as "non-spam". - as a consequence, spams are now slipping through the crowd-sourced filter because the crowd is infiltrated. c'mon google this can't possibly that hard to fix!
I signed up with Postini just as it was acquired by Google. Before that I'd used SpamSoap, which worked great but was declining in effectiveness (more false negs) but not in price ($30 per month is a lot for a small business). Postini and then Google were far more reasonable at just $3 per year per address (for the less-flexible controls). I get maybe one or two delivered spam per week, usually when I also see a corresponding spike in filtered spam which indicates a new attack of some kind. I get only one or two false positives a month.
The biggest thing I have noticed lately is that the spammers have started collating domain name "from" lines. I now routinely get a lot of spam (in the quarantine) listed as coming from the other valid e-dresses in that domain. This is new as of a month or so ago.
The real problem with Google/Postini is that, as others note in this discussion, they don't answer tech support AT ALL. You either take what they offer, or you don't. The control panel (for the $3/month option) is rather limited, and you have no blacklist features. There seems to be no way to tweak things, ask for assistance with filtering issues, etc. You just get what they offer.
For me, for a savings of $27 per address per year, that's a tradeoff I'm willing to make.
And by the way, I provide filtering for my family for free... it costs a few dollars extra per year, but I figure it's money well spent since Mom and Dad and the less geeky in my family don't get infected and I do less tech support than before.
--Brandon / Split Infinity Music
150 milliseconds sounds fast, but equates to only 7 messages per second.
Sure that may be faster, presuming it's a deep intensive scan, than what one can do on their home PC, and yes Google has zillions of boxes ... but anyways, my point is that 7 messages per second illustrates the very real, high cost of dealing with spam; scanning of just a million messages, which is a fraction of the spam volume, at 7 messages per second, takes well over a day of computer time.
Ron
What I find telling is how my SPAM volume rises and falls according to the American holidays. Whenever the Yanks have a holiday, SPAM drops to a trickle.
That to me is a clear indication that most SPAM originates in the US even though it mostly gets relayed through Asian proxies.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I counter your anecdote with my anecdote! No, seriously - not to be an a$$ or anything, but I haven't gotten a single spam in GMail in over two years. There is none in the inbox, and none in the spam folder (label) either. I'm not sure why you are getting them, but it is clearly not everyone who is so afflicted (thankfully!). I'm not sure if it has something to do with accounts on different back end systems or what, but mine hasn't gotten any spam in one heck of a long time.
Keep in mind folks, Gmail's Spam filtering is seperate from Postini.
From the article:
"Google's Gmail antispam efforts are separate from those of Postini, which Google acquired two years ago, although it follows similar computerized operations and the teams have started to integrate the processes."
I've had email at an ISP that uses Postini, and I have email at Gmail. IMHO, Gmail > Postini.
As an email administrator - I wouldn't give a user the ability to disable virus filtration on their email account - even if I knew they weren't a direct threat to any known virii. Too many stupid people out there know how to use the FWD button.
I know what you're saying, but since you're probably the smartest user out of the tens of thousands that use your email server - they're not likely to give you a one-off option.
Did you have an easy to guess username?
Just because you didn't send email from "robogun@gmail.com" doesn't mean your robogun@att.net isn't on a spam list somewhere. How do you increase the size of a spam list exponentially? strip all the domains from the addresses and find common names... then generate one email address for each domain you want to hit.
Ta-da... spam email sent to accounts that were never used. This could indicate that google's directory harvest attack identification methods need some fine tuning, but I doubt its maliciously allowing people to spam you, that's just plain stoopid.