Re: [Asrg] Re: Asrg digest, Vol 1 #133 - 14 msgs

On Fri, Mar 28, 2003 at 10:41:03AM -0500, Kee Hinckley wrote:
> I think most people have agreed on this list that address 
> verification would be useful in preventing fake addresses.  It 
> wouldn't stop spam, but it would help stuff the spammers into a 
> smaller box.
It wouldn't even reduce the amount of spam.
Is it just me or why do I get the impression that a lot of people think
that spammers are dumb idiots and that telling them "nanana, you can't
do this anymore" will change a thing?
I am rather sure they are on this list and watch closely to be prepared
and they are no idiots.

Has anybody noticed spam like e.g. (addresses are envelope information):

unknown:66.118.181.5 HELO gfpqkw.com
unknown:66.118.181.5 rejected: <jicgpmdiehc(_at_)hotmail(_dot_)com> to 
<bob(_at_)space(_dot_)net>
unknown:66.118.181.5 rejected: <ucowrngrdcq(_at_)hotmail(_dot_)com> to 
<bob(_at_)space(_dot_)net>
unknown:66.118.181.5 rejected: <wgrcmjflvib(_at_)hotmail(_dot_)com> to 
<bob(_at_)space(_dot_)net>

What's so unusual about it?
It's not a  1:n  relation, but a  n:1  relation in one connection from
the same host. Spammers no longer depend on the multi RCPT_TO feature
and it still works.
It shouldn't be too big a problem to combine pairs from their databases
(just like a lot of outlook viruses already do from the addressbook)
and use the same ole algorithms.
Or let the software abuse the domain of the abused mailserver (ok, that's at
least more fair than using the domain of anyone unrelated).
The changes to the existing software should be minimal, I'd assume.

The spammers software is evolving and the time when it was "dumb"
is long gone.

I have skimmed over Williams slides at
   http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf
and what I am really missing in the scenarios are e.g. the thousands of
small companies on a dynamic DSL connection that depend on running their
own mailserver, because they are connected to "ISPs" that don't offer
this service. Have you ever asked them what they think about DUL?
What will they think about validating services or RMX? From my
experience 80% won't even understand what you are talking about.

I really don't know ... does hotmail, yahoo etc all provide SMTP
relay services or do you have to use their web interfaces?
If they don't provide SMTP relay there is also missing a solution for
the thousands of public mail service provider users that use those
addresses for this and that, from Internet cafes or from their
mailbox.

We need a rather easy and widely adoptable solution or it won't work.

And really I don't want to "attack" all the discussed solutions, but if any
such system should be a workable approach, using a "all or nothing" system
if probably the worst. Also a solution that needs a "if you support system
X it's nice, if you don't I'll take it too" is rather absurd.

When designing such a system
- think about universities ... will they set up validation mechanisms
  for ten thousands of users?
- think about medium sized companies ... will they change to the new
  system?

The more we burden the end user (and in this area small/medium companies
qualify as end user) the system will fail, because they won't go through
the hassle. And if they don't do it nobody will. As an ISP I can't change
to a system on 1.1.2004 that is used by 5% of all users and tell my
customers "too bad. And no it won't stop spam but it makes it harder,
and sorry that you cannot talk to your clients any more". And if there
are reasons ISPs can't (easily) migrate, they won't at all.

IMHO an integral part of all those discussions should be

- benefit
        how much spam will it stop MORE
- costs
        how much will it cost to install and maintain the system
        What is the cost of adding one new user to the system.
        (think small companies .. hiring a technician and paying big
        bucks for adding an email account will distract them).
- usability
        how much has every user to do more to send email to another
        person? How complicated is it? Will they want to do it?
        Do they need new software?
- transition
        are there pitfalls during a transition period? Will hosts
        that have [not] changed be isolated? How much percent of email
        users in total will take part right at the start at a specified
        date. what is the estimated period that we expect users to switch
        to the system.

Besides I am not too convinced behind the ideas of all systems discussed,
most badly fail at least 2 of the above topics.
And no, I don't have a resourceful solution. If I had I wouldn't discuss
here but wade in money.

        \Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg