ietf-asrg
[Top] [All Lists]

Re: [Asrg] POSTAGE, was The fundamental misconception about paying for mail

2008-12-03 05:58:04

On December 3, 2008 at 00:56 johnl(_at_)taugh(_dot_)com (John Levine) wrote:
We still seem to have some problems with weak analogies.

Something like that...

Why can't I buy one SSL cert and put it onto as many sites as I like?

Because each site has a unique DNS entry.  I don't think a system that
requires a DNS entry for every message you send would work very well.

I am straining to imagine why you would say this. Seriously. I'm
mildly boggled. So forgive me if my response misses your point:

A system creates a stamp for a message.

That system, the one with the "postage meter", has to have something
akin to an SSL cert to generate that "stamp" so the stamp would pass
basic authentication by the receiving host, much like any browser can
spot a phony SSL certificate.

In the case of a consumer ISP, port 25 blocked and all that (tho
that's not necessary but it simplifies the imagery), one would expect
the consumer ISP's MTAs generate the stamp and affix it to the
outgoing message.

I don't see where "a DNS entry per message" enters into something like
this at all any more than a "DNS entry per web page" would in a web
server SSL cert context.

But the point is if I can distinguish between a legitimate stamp and
a non-legitimate stamp, and like an SSL cert, can know with some
reasonable certainty who must own that "postage meter", then I know
who the offender is.

That all makes sense, but I still don't see a reasonable process for
monitoring the mail.  Bad guy gets a meter, prints himself 100 stamps,

Stop.

How does he get a "meter"?

Again, let's go back to the SSL cert example.

Bad guy gets an SSL cert...Stop! Not so easy.

For example, you certainly can't just stick an SSL cert (which others
would accept) onto a zombied system. The DNS won't match.

You can't forge one, too difficult.

And if you stick an SSL cert on your authorized system and generate
crap, why, we just won't accept anything from that IP! Just like
today, which is exactly why spammers have to use zombie'd machines, IP
mobility so they don't get blocked. But IP mobility doesn't work very
well if you also need something like an SSL cert to work.

puts each of them on 100,000 pieces of mail and blasts out 10 million
spams to random recipients.  Are you assuming that each stamp would be
keyed to a particular message and envelope?  That's sort of what
Goodmail does, although it's rather hard to make it tamper-resistant.

It wouldn't be valid, it wouldn't pass superficial checks by the
receiving MTA, any more than a bad SSL cert would pass superficial
checks by a browser.

Anyhow, you're drifting back into the "closed solution" requirement
which I thought we were slowly agreeing may not be necessary.

I don't have to catch every single cheat, I only have to catch enough
to justify shutting the offender down. That is, to put him on a
blacklist so he doesn't get any more "certs", or whatever ajudication
is acceptable.

Just like the CAs might refuse to sell you an SSL cert because you use
them to defraud people. They don't need every single example, only
enough to prove the case that you're a crook and cut you off.

And, since the "cert" uniquely identifies the offender it's not too
hard to pass that blacklist info out so interested parties put that
cert-id into their own blacklists. That's their choice of course, but
it should be fairly easy to BL. And if they expire regularly they
don't get another -- they're out of business!

  ... because none of them are attempting to work in an environment
where 98% of the attempted transactions are bogus.

You need to speak with ASCAP, RIAA, et al.

You don't think illegal muslc downloading etc faced similar stats?

The issues are utterly different.  If ASCAP managed to collect 90% of
the royalties people owe them and miss the other 10%, they're doing
great.  If 10% of the spam with reused stamps leaks through, we're
still drowning.

Well, I'd love to hear the reaction from an RIAA or ASCAP spokesperson
regarding "90% of the royalties". I suspect in the world they live in
they're pretty happy with small single digit percentages. Ya know,
your neighborhood bar slips a CD into the player, or even turns up the
radio or TV so customers can enjoy the show, they owe a royalty! They
never pay it, but the internet is similar, probably better because
ASCAP et al can actually sit in an office searching for offenders on
the internet. Checking every bar is a more difficult task.

THAT SAID...

I think I dealt with the issue of reused stamps above.

Now if they buy a legitimate "cert" and proceed to double-spend we'll
know who they are.

Unless both of the recipients present it back to the issuer, how?  And
if they do, we're back at the horrible micropayment database problem.

We don't care about someone who reuses a stamp once in a blue moon any
more than in the US postal system.

We're worried about the guy who reuses a million times.

Put out some rewards.

Provide an easy way for an end-user to check. E.g., forward a msg
(maybe something SPAMMY!) to this address and if we get a dupe we
didn't know about we'll send you a free itunes coupon. Whatever, but
having created an economy around this you can consider solutions like
this.

Do some sampling!

If someone is a flagrant violator and sending a million dupes out then
how many are likely to pass thru some single, cooperative ISP? And if
that ISP is getting a cut of the action they have a monied interest in
stopping fraud. So stick snoopers on their MTAs.

Remember, you only have to catch the crook once (more or less) in this
scheme, and he's out of business. You'll then invalidate his postage
meter (e.g., put it onto a blacklist) and not sell him another.

But even that's stretching a point.

Spammers won't buy postage unless it costs like one dollar a year for
a 100 billion messages.

And they can't forge it.

So where does that leave them?

But ok I'll play along because in my vision of the scheme I want all
bulk emailers to pay, not just hardened criminal spammers, and no
doubt occasionally even the initially honest will think to go rogue.

So, if they get caught, they're outta that business, done, just like
screwing up your credit, you can't have any more credit cards, etc.

-- 
        -Barry Shein

The World              | bzs(_at_)TheWorld(_dot_)com           | 
http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
https://www.irtf.org/mailman/listinfo/asrg