A paper I am writing addresses these schemes:
The problem with schemes of this sort is that they reduce the spam problem
for the user by increasing it for everyone else. Each time someone who is
not on the 'whitelist' of approved senders tries to send an email to the
user they will receive a message that according to the definition used here
is spam. The challenge message is indiscriminate and unwanted. It is also
unnecessary and not that effective, as we shall see later this type of
simple challenge/response scheme is easily evaded and there are much better
methods of checking who sent a message.
The thing I find most objectionable about the users of these schemes is the
smug manner in which they will loudly proclaim that they have never had
anyone complain. Of course there are no complaints when the people who find
these schemes objectionable can't talk to you without using them.
I recently got a message from a student asking me for some information on a
protocol I had designed. While I rarely have time to respond to these
requests in this case I did and spent ten minutes or so answering the
question, even though the student could easily have found the information
themselves by using the Web and reading the specification for themselves.
After taking this trouble however I received a message from the student's
mail service asking me to prove I am not a spam sender by answering a
challenge, this after she was the person who had originally asked for help!
If someone sends an email they should accept a reply from the same person
without this type of performance. Equally nobody should ever be asked to
respond to a challenge the second or third time they send a message to the
same person.
These challenge/Response schemes are a minor irritation today when few
people use them but expect resistance to them to grow if the number of users
increases. After receiving the fifth spam challenge I was irritated enough
that my policy now is to never respond to them in any circumstances. If
someone I need to get in touch with uses this type of scheme I send them a
fax or a Fed-Ex, making sure to put in a covering note, 'Tried to send this
by email but you need to fix your email'.
-----Original Message-----
From: Claus Assmann [mailto:ca+asrg(_at_)esmtp(_dot_)org]
Sent: Wednesday, April 02, 2003 9:48 PM
To: asrg(_at_)ietf(_dot_)org
Subject: Re: [Asrg] Turing Test ...
On Wed, Apr 02, 2003, Art Pollard wrote:
Why not allow the e-mail client to pose a Turing test to
anybody that is
not in its whitelist?
Depends on your whitelist.
A group of people is supporting some open software so we get a lot
of questions via e-mail. A reply can come from various sources.
Which of the sources do you whitelist? Whenever I get a "TMDA"(?)
challenge as a response to my reply I delete it. If I knew in advance
that the person who asked the question uses such software I wouldn't
waste my time to provide free support for them.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg