Hashcash and signatures are non-starters (or deserve to be) for the
simple and
immutable reason that compromised spambot zombies will pump out large
numbers of
hashcash-certified, signature-carrying spams.
AGAIN, THIS DOES NOT SOLVE THE PROBLEM. It only makes the system more
complicated and expensive.
I don't buy this argument, because the "large numbers" of mail will be
significantly smaller than the "massive numbers" we're seeing today.
Instead of each zombie being limited only by it's pipe, it'll be
limited by it's CPU, so the resource pool available to spammers will be
orders of magnitude smaller than it is today.
Since when is that such a weak argument?
I added the idea of a simple signature because it's clear that PGP and
S/MIME haven't taken off - so are they too complex and/or intrusive for
Joe User? We need *something* to whitelist against. Each signature,
incidentally, will be valuable only for the number of recipients who
have whitelisted it, which for Joe User will normally be quite a small
window. The signature will not say anything about the contents of the
message, merely where it's stamp came from.
Once a machine has been compromised, of course, it needs a new signing
key after being cleaned up, but that's easy to arrange.
--------------------------------------------------------------
from: Jonathan "Chromatix" Morton
mail: chromi(_at_)chromatix(_dot_)demon(_dot_)co(_dot_)uk
website: http://www.chromatix.uklinux.net/
tagline: The key to knowledge is not to rely on people to teach you it.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg