On Dec 1, 2:27pm, John Levine wrote:
}
} Then 98% pay with fake versions of whatever it is that they give you
} to say that you have an account. Same problem.
Well, no, it's not the same problem. A fake version of an account ID
matches *somebody's* real account, so instead of 98% of the people
stealing directly from Dunkin, they're stealing from the other 2% of
the customers. Or more likely, they're stealing from a credit card
company who has a few hundred billion units of the US Gov's attention.
} [...] at a donut store you rarely have 1000 people simultaneously at
} 1000 counters trying to buy a donut with the same card that has only
} 50 cents on it.
A donut shop also doesn't have gigabytes of cheap lobby space where it
can make all those customers wait for their donut until it knows how
much is left on the card. I mean, really, is it that hard to require
that transactions on the same identity are serialized to within some
tolerance? You can still parallelize on the number of identities.
Yes, the spammers can also still parallelize that way, but they are at
least limited to the number of identities that have paid accounts,
rather than being able to invent new identities at the flip of a bit.
} >.... Let through unchecked anyone with a history of payment and
} >throttle everyone else (to the point of quarantine without final
} >delivery, if necessary) until you know their history.
}
} That's what Turntide does, except for "history of wanted mail."
} Why would "history of paying" be better?
Revenue stream to cover all the expenses of putting such a system
in place and running it. Disincentive (if only indirectly through
negative feedback to the victims of theft) for the "unwanted."
Of course in a system where this was common, it'd be possible to be
a fraudulent "seller" instead of a fraudulent buyer, but it probably
be a little harder to do so untraced.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
https://www.irtf.org/mailman/listinfo/asrg