Re: [Asrg] Spammer proxies using legitamate mail relays

> Most hashcash proponents are already for a hybrid system that would 
> skip the
> computationally intensive part for relatively strong authenticated 
> senders.
> For example, senders from reputable domains that comply with SPF and/or
> SenderID or maybe even domain keys should be allowed to skip hashcash.
SPF alone isn't sufficient reason to skip hashcash, as your original 
post should make clear.  The concept of "reputable" is also woolly, in 
non-obvious ways - it's much simpler and less "gameable" to just 
require hashcash regardless.
> For bulk senders, they should have to have a registered (or bonded) 
> domain using
> DomainKeys because of it's non-repudiation for any spam they spew.
You're right - a bonded-domain system could be another string to the 
bypass bow.  It doesn't really break the system, though, it's just an 
addition to consider.
> For all
> other email that hasn't been verified by SPF/SenderID/DomainKeys, they
> should be brutally punished with a one minute computation (on a dual 
> 3.6 GHz
> XEON box) for every message they want to send.  If they don't want to
> compute it, too bad.
That, I'm afraid, discriminates unfairly against ordinary users with 
old machines on small, backwater ISPs, which is one of the reasons 
plain hashcash doesn't quite work.
> The only problem for hashcash is that spammers already
> have a massive SuperGrid available to them in the form of Zombies that
> currently act as SMTP proxies.  I guess that means we'll either need 
> to flag
> them as suspicious and place the messages in a quick flush folder or 
> we'll
> just need to drop them.
The 27-bit (plus) hashcash cost actually takes into account the 
potential zombie population.  Strangely enough, we were able to 
discover a point where spammers' profit-per-message went through the 
floor, even when they could get as many zombies as they liked for free.
> As for Moore's law, the major CPU vendors have been in violation of it 
> for
> nearly 2 years now.  Intel's been stuck in the 3 GHz funk for 2 years 
> now
> and they're going to start resorting to multi-cores like every other 
> CPU
> vendor.
When it comes to computing SHA-1 collisions, there are a number of 
special optimisations which are unlocked by newer processors.  The 
Motorola/IBM processors have *not* been in violation of Moore's Curves 
in recent history, and thus the current crop of PowerPC 970s is capable 
of 9 million collisions per second (at 2GHz, per CPU), a long way ahead 
of the P4.  AMD have also been steadily improving *their* chips, which 
are also usually faster in real terms than the P4.
At the moment, the sweet spot in price/performance, when it comes to 
hashcash, is the Mac Mini.  It's small and power-efficient, so you can 
put lots of them into a colocation shelf, without paying over the odds 
for air conditioning.  It's also cheap, at $399 for about 6 million 
collisions per second.  I advise using that figure for any cost 
calculations.
> Bottom line is, anti-spam technology is getting better but the 
> spammers are
> still one step ahead.
Yes, they are at the moment.  But that's because the general e-mail 
industry is highly inertial, and it takes some time to convince them to 
adopt each incremental change.  So we introduce one measure - SPF - and 
by the time half the ISPs have started using it, the spammers have all 
adapted so that it's having no effect on overall volume, even if it 
happens to make the next step much easier to implement.
I'm trying to put forward a solution that actually reduces volume, and 
cannot be sidestepped.
--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     chromi(_at_)chromatix(_dot_)demon(_dot_)co(_dot_)uk
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.


_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg