ietf-asrg
[Top] [All Lists]

Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

2005-06-13 11:17:36
I also disagree with the burden that my system will cause to networks.  On 
average email providers will receive a 1000:1 ratio of spam to challenge 
email if 99% of spam is filtered before a challenge is sent, and if 10% of 
spam uses a forged address.  The cost of buffering the challenges will likely 
be trivial relative to the cost of dealing with routine spam.

Please stop using one-long-line-per-paragraph.  If you can't even
follow rudimentary mailing list etiquette, why should we pay attention
to your opinions on any other email matter?

I also disagree with the burden that my system will cause to
networks.

Have you run - or even worked at - a large (or even small!) email
provider?  I don't recall your saying anything to indicate that you
have; until you have, I think you should, maybe, just maybe, listen to
the people who have - who seem to be unanimous in the opinion that the
difficulties will be excessive.

On average email providers will receive a 1000:1 ratio of spam to
challenge email if 99% of spam is filtered before a challenge is
sent, and if 10% of spam uses a forged address.

(1) What is your basis for choosing those numbers?  Personally, it
    seems to me that more probable numbers would be 75% and 99+%.

(2) Even if so, this makes your position "but my spam is OK because
    it's such a small fraction of the total spam", as far as I can
    tell.  That's certainly not acceptable to _me_, at least.

The cost of buffering the challenges will likely be trivial relative
to the cost of dealing with routine spam.

Possibly.  Possibly not, too.  Do you have implementation experience to
back your opinion up?

Many email providers, such as Yahoo and Gmail, routinely keep a copy
of every outgoing email in your sent message folder.  Thus the data
for the challenge filter is instaneously available.  A trivial
software update can prevent any erroneous bounces from ever becoming
visible in a user's inbox.  Other email providers can briefly buffer
incoming challenges if need be to update their bounce filter.  I
still have trouble seeing how this is a real difficulty, especially
relative to Bayesian filtering.

Maybe that's because you've never done it.  Go on, implement it.  Run
it at an ESP with at least two widely separated mailhosts.  Heck, run
it at even an ESP with only one but at least a few thousand users.

Maybe you're right that it's trivial to do this.  The opinion of people
who've actually worked with such systems seems to disagree with you.
Maybe you have something new that will cure this, but if so, you
certainly haven't convinced us.  Go on.  Demonstrate it.  Show us.

I disagree that a number of people have raised detailed weaknesses
with my proposal that have gone unanswered.  Rather what I do is
respond to a legitimate query once or twice and then I stop
responding when the issue is repeatedly brought up.  Examples
include:

     The porn proxy attack-  I've had to respond to the practical
     impossibility of this form of attack on two different locations
     on my website, as well as repeatedly on this list.  Please,
     think about it yourself.  Crunch the numbers.  It is beyond
     trivial.

I don't see why.  Do you perhaps mean "it would be beyond trivial if
most mail used this system"?

     Spammers will just pretend to be someone on your whitelist-
     [...]  The whitelist as I describe it is of a very personal
     nature and spammers cannot determine it's contents.

Why not?  Why can't they scrape it with malware on the user's machine
the same way they scrape everything else in sight?

I appreciate it when people point out flaws in the answers I've
given, but I'll need more convincing before I concede that the
difficulties in enacting a challenge filter are so great that a
system that would otherwise eliminate spam should not be considered.

The difficulties of implementing it, such as demanding some kind of
saved information for every outgoing mail - you haven't answered this;
simply expressed your opinion that it is not a significant problem,
contrary to the opinions of those with direct experience in the area.
Given a choice between numerous informed opinions which agree and one
uninformed opinion which disagrees... :-/

Eliminate spam - it eliminates spam only for people "protected" by it.
It increases spam for everyone else.  That is an unacceptable tradeoff
for me - and apparently for numerous other people too.

Perhaps you're right and we're all wrong.  Go on - convince us.  Show
us an implementation that won't spam non-adopters.  That works fine
across multiple widely disparate mailhosts.  That works for the blind.
That isn't vulnerable to the free-pr0n proxy attack.

To put it bluntly: put up or shut up.

/~\ The ASCII                           der Mouse
\ / Ribbon Campaign
 X  Against HTML               
mouse(_at_)rodents(_dot_)montreal(_dot_)qc(_dot_)ca
/ \ Email!           7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg