[Asrg] Washington Post: Earthlink to Deploy a Challenge-Response System

Just came across this article reference at SlashDot.org:

http://slashdot.org/articles/03/05/07/1342245.shtml?tid=126&tid=111

The original article can be found at the Washington Post:

http://www.washingtonpost.com/wp-dyn/articles/A22390-2003May6.html

The article is as follows:
--------------------SNIP---------------------------
washingtonpost.com

EarthLink to Offer Anti-Spam E-Mail System
'Challenge-Response' Technology Rejects Messages Unless Senders Are Cleared 
by Recipients
By Jonathan Krim, Washington Post Staff Writer
Wednesday, May 7, 2003; Page E01

A system that backers claim will eliminate e-mail spam is about to be 
deployed by a major Internet service provider, giving a boost to an 
emerging technology that if widely adopted would change how people 
communicate online.
Atlanta-based EarthLink Inc., the country's third-largest provider of 
for-pay e-mail accounts, will roll out test versions of the system for its 
5 million subscribers this month.
Known as "challenge-response" technology, the system thwarts the ability of 
spammers to reach their intended audience with millions of automatically 
generated e-mails. When someone sends an e-mail to a challenge-response 
user, he or she gets an e-mail back asking to verify that the sender is a 
live person.
Once the sender does that by replicating a word or picture displayed on the 
screen, the original e-mail is allowed through. The system automatically 
recognizes future e-mails from the same sender, so the verification needs 
only to be performed once. Without the verification, the e-mail is not 
delivered.
Some experts see problems with the technology and doubt that consumers will 
warm to a process that adds another step to e-mail delivery. The technology 
is available from a handful of small vendors for a fee, but the customer 
base is small.
EarthLink is betting that customers will put up with a little extra effort 
in order to stem the tide of unsolicited messages pushing diet fads, 
get-rich schemes and pornography.
Like arch rivals America Online Inc., Microsoft Corp. and Yahoo Inc., 
EarthLink has spent millions of dollars developing software to block spam. 
But spammers have found ways to defeat them and spam accounts for 40 
percent of all e-mail.
"The limitations on filters are truly very daunting," said James Anderson, 
EarthLink's vice president of product development. Even as filters improve, 
users must constantly adjust them so that they don't block messages they 
want to receive, he said.
The challenge-response system will be optional and free for EarthLink 
subscribers, Anderson said. It will allow users to automatically clear the 
e-mail addresses of friends, family members and other associates in their 
electronic address books, so those people would not receive the challenge 
e-mail.
Executives at EarthLink's three top competitors, who recently formed a 
coalition to combat spam, said they are evaluating challenge-response 
technology. Yahoo and Microsoft's MSN and Hotmail networks already employ 
challenge-response when someone seeks to open an e-mail account.
Yahoo also recently started using a variation of the system when an account 
holder is sending high volumes of mail, to crack down on spammers using 
Yahoo accounts.
America Online spokesman Nicholas J. Graham said that for now, AOL is 
concerned about putting too many burdens on users and that the technology 
is "not a one-size-fits-all panacea."
In addition to requiring senders to verify themselves, users would have to 
use special e-mail addresses when registering to purchase goods online, 
because vendors often send sales confirmation notices by computer. The 
special addresses are designed to route such messages to a user's regular 
in-box.
The new system could slow delivery of some e-mail. For instance, a sender 
might walk away from his or her computer after sending an initial message, 
not noticing until hours later that a challenge had come back.
Phil Goldman, chief executive of Mailblocks Inc., a Silicon Valley start-up 
that provides a challenge-response service, said people will quickly get 
over those hurdles.
"It's about social habits," said Goldman, a former Microsoft executive 
whose service launched a month ago. "When the rotary telephone first came 
out, people said, 'You mean I have to dial seven numbers?' "
Goldman said developers of the Mailblocks system own patents on the 
challenge-response technology. His company already is seeking to enforce 
its two patents against another small provider of the technology, Spam 
Arrest LLC of Seattle.
Brian Cartmell, manager at Spam Arrest, said his company is vigorously 
contesting the Mailblocks claim. He said Spam Arrest, which has been 
operating since April 2002, has "many thousands" of customers but he 
declined to be more specific.
Anderson said Goldman's patent claims are "not relevant" to the product 
EarthLink developed inside the company.
Goldman acknowledged that the system is in its infancy and needs ongoing 
refinement. It is probably not best suited for businesses that sell 
directly to customers, he said, because consumers might resent having to 
send verification when they want to make a purchase.
Others see deeper problems.

"Challenge-response will indeed block the vast majority of spam," said John 
R. Levine, a computer consultant and co-author of "The Internet for 
Dummies." But he said a lot of people will never respond to a challenge, or 
will think the challenge e-mail itself is spam.
Levine said that already, spammers are disguising e-mails as challenges to 
get people to open the messages. And he worries that if large numbers of 
people begin to use the system, user address books will be a target of 
hackers seeking to obtain lists of approved addresses.
Some viruses launch attacks using computer address books, and if that 
happened, confidence in the challenge-response system would erode, Levine said.
"The consequences of spammers' response to challenge-response will be 
really ugly," Levine said.
Boosters of the system remain confident that challenge-response can 
effectively combat spammers' attempts to sabotage the process. "This is as 
close as there is to the silver bullet" against spam, Anderson said.
© 2003 The Washington Post Company
--------------------SNIP---------------------------


---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <research(_at_)solidmatrix(_dot_)com>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg