You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Perkel <ma...@perkel.com> on 2007/03/30 15:39:45 UTC
Things I would change to stop spam
Loren Wilton wrote:
>
> Thought experiment:
>
> Suppose some Internet uber-government mandated that all hosts publish
> to a central server a list of all valid recipient addresses at that
> host, and only valid recipient addresses. Suppose further that it was
> mandated that the list be kept up to no more than 12 hours out of date
> as changes occurred.
>
> Suppose that this was a gigantic server, and to prevent spam all
> sending hosts were mandated to check the list before sending an email
> to a target system, and reject the mail locally if the target address
> was not on the list. Obviously there would be no reason for the
> sending host to check the sender address since it would have to be
> valid - but mail forwarders would have to check both the sending and
> receiving addresses to be sure that neither was forged. Receiving
> hosts would likewise be mandated to check the list and discard the
> message if the sender did not appear on the list, or be subject to
> massive fines.
>
> Suppose that to reduce resource usage senders and receivers were
> permitted to daily download the entire address list from this central
> server, so that they could do only a single uber-zone transfer rather
> than possibly hundreds of millions of individual requests. Obviously
> any sending or receiving machine would have to be able to do this.
>
> Clearly this would completely eliminate spam, right? After all, it
> could not be sent to or from an invalid address, as the host doing
> that would be subject to massive govenrnment fines, and the mail would
> be rejected at the target anyway.
>
> Can anyone suggest to me why such an obviously correct government
> implementation might actually HELP spammers?
>
> For extra credit: can anyone describe how this scheme would differ
> from a "perfect and universal" SAV implementation used to prevent
> spamming?
>
>
There is a huge amount of traffic on the internet from bots that are
sending email to and from email addresses that don't exist and if that
could be eliminated then everyone would be ahead. I have a few ideas
myself on some evolutionary changes in the way mail is delivered that
would basically lock out spam bots from the system.
One of the problems with SMTP is that the user to server protocol is the
same as the server to server protocol. In the old dats everyone was
running on a unix shell account running Pine. But then there came to be
remote workstations so POP and IMAP were added to read email, but
nothing changed on the outgoing email.
So - what I propose is a addition to the IMAP/POP protocols that allow
email to be sent out over IMAP/POP and eliminate SMTP for the end user.
The outgoing email message would be sent over the same authenticated
connection that you establish to get email and the IMAP/POP server would
then hand the message off to the SMTP server which would then send it to
the receiving server.
With a system like this you would eliminate half of the email setup in
that once you configure to read email then you are already configured to
send email. ISPs can close port 25 to end users by default and spam bots
would be isolated. No application would be able to send email unless it
knew the user name and password. And the virus wouldn't know that. With
that kind of isolation viruses wouldn't be able to spread and spam bots
go away.
Re: Things I would change to stop spam
Posted by JamesDR <ja...@trusswood.net>.
Magnus Holmgren wrote:
> On Friday 30 March 2007 15:39, Marc Perkel wrote:
>> So - what I propose is a addition to the IMAP/POP protocols that allow
>> email to be sent out over IMAP/POP and eliminate SMTP for the end user.
>
> NO, NO, NO! What is it, the tenth time you bring up this theme? Every time
> it's explained to you that it won't accomplish anything that can't already be
> accomplished.
>
There is nothing really stopping him from implementing this himself.
Money drives change. I welcome Marc to implement this for his business
and see what happens... I'm curious as to the outcome on both spam and
his customers :-D
--
Thanks,
James
Re: Things I would change to stop spam
Posted by Magnus Holmgren <ho...@lysator.liu.se>.
On Friday 30 March 2007 15:39, Marc Perkel wrote:
> So - what I propose is a addition to the IMAP/POP protocols that allow
> email to be sent out over IMAP/POP and eliminate SMTP for the end user.
NO, NO, NO! What is it, the tenth time you bring up this theme? Every time
it's explained to you that it won't accomplish anything that can't already be
accomplished.
--
Magnus Holmgren holmgren@lysator.liu.se
(No Cc of list mail needed, thanks)
Re: Things I would change to stop spam
Posted by Duane Hill <d....@yournetplus.com>.
On Fri, 30 Mar 2007, Marc Perkel wrote:
> So - what I propose is a addition to the IMAP/POP protocols that allow email
> to be sent out over IMAP/POP and eliminate SMTP for the end user. The
> outgoing email message would be sent over the same authenticated connection
> that you establish to get email and the IMAP/POP server would then hand the
> message off to the SMTP server which would then send it to the receiving
> server.
Sorry for keeping this thread alive. However, FWIW:
>From http://en.wikipedia.org/wiki/Post_Office_Protocol it says:
There are extensions to POP3 that allow some clients to transmit
outbound mail via POP3 - these are known as "XTND XMIT" extensions.
The Qualcomm qpopper and CommuniGate Pro servers and Eudora clients
are examples of systems that optionally utilize the XTND XMIT methods
of authenticated client-to-server e-mail transmission.
And XTND/XMIT are outlined here:
http://www.ietf.org/rfc/rfc1082.txt?number=1082
Re: Things I would change to stop spam
Posted by JamesDR <ja...@trusswood.net>.
Marc Perkel wrote:
> There is a huge amount of traffic on the internet from bots that are
> sending email to and from email addresses that don't exist and if that
> could be eliminated then everyone would be ahead. I have a few ideas
> myself on some evolutionary changes in the way mail is delivered that
> would basically lock out spam bots from the system.
>
> One of the problems with SMTP is that the user to server protocol is the
> same as the server to server protocol. In the old dats everyone was
> running on a unix shell account running Pine. But then there came to be
> remote workstations so POP and IMAP were added to read email, but
> nothing changed on the outgoing email.
>
> So - what I propose is a addition to the IMAP/POP protocols that allow
> email to be sent out over IMAP/POP and eliminate SMTP for the end user.
> The outgoing email message would be sent over the same authenticated
> connection that you establish to get email and the IMAP/POP server would
> then hand the message off to the SMTP server which would then send it to
> the receiving server.
>
> With a system like this you would eliminate half of the email setup in
> that once you configure to read email then you are already configured to
> send email. ISPs can close port 25 to end users by default and spam bots
> would be isolated. No application would be able to send email unless it
> knew the user name and password. And the virus wouldn't know that. With
> that kind of isolation viruses wouldn't be able to spread and spam bots
> go away.
Currently, Yes. Future, no.
Currently yes because there are few bots/viruses actively checking
username/password pairs. If it were implemented that this was mandated
all a botmaster/virus writer would need to do is create a transparent
proxy that slurps this info from the TCP/IP stream, then send this data
back to the mother ship and have all the other bots on the same subnet
use a series of user names/passwords to send the emails. With the
gigantic listing of valid E-Mail addresses this makes it all to easy to
grab a list of the local domain e-mail addresses for this subnet and
start firing away with legit looking mail (at least the e-mail wouldn't
be forged and it would be authenticated.) If we make the auth tokens
time based, no problem for the spammer/virus writer. Wait until a user
sends or receives a mail and send out X number of mails (or just start
sending till the remove server says "Hey! No more you!".) If the
gigantic list were query based (didn't hand out e-mail addresses, but
said yay nay to a presented e-mail address) then it still benefits the
spamer as to verify their spam lists against their sending lists. You
have to think like a spammer... They will always be with us, so if you
put up a wall, they will build a ladder just tall enough to reach over
the top and pour spam on you ;-)
I do see SAV hurting spammers more than helping in this instance and
right now. SAV, if used properly, can be light weight. Server Y contacts
server X and says "hey, does this user exist" (with current standard
smtp calls) Server X says "no" server Y either bounces a message back,
or discards.
GrayListing works well now.. but for how long? Short term, yea SAV and
other schemes will work, but then spammers just use legit email
addresses slurped from the TCP/IP stream.
My 2cents on the matter.
--
Thanks,
James
Re: Things I would change to stop spam
Posted by Benny Pedersen <me...@junc.org>.
On Fri, March 30, 2007 16:39, Matt wrote:
>> Re: Things I would change to stop spam
> Charge 0.1 penny a message. ;<)
hashcash :-)
--
This message was sent using 100% recycled spam mails.
Re: Things I would change to stop spam
Posted by Matt <lm...@gmail.com>.
>>Re: Things I would change to stop spam
Charge 0.1 penny a message. ;<)
Matt
Re: Things I would change to stop spam
Posted by "Chr. v. Stuckrad" <st...@mi.fu-berlin.de>.
On Fri, 30 Mar 2007, Marc Perkel wrote:
> send email. ISPs can close port 25 to end users by default and spam bots
> would be isolated. No application would be able to send email unless it
> knew the user name and password. And the virus wouldn't know that. With
> that kind of isolation viruses wouldn't be able to spread and spam bots
> go away.
1) some spam bots would hide as/near/in real MTAs (no difference to now)
- so every MTA would have to know the real ones in advance
or verify them cryptographically somehow (but as long as
everybody can buy Certificates, that wouldn't help also).
2) other (trojan) spam-bots would simply use userid and password
of (mail)connections of the host they live on. So the user
would be personally held responsible for the spam they send,
in case of paying the mail, the user would even have to pay
pay for the spam his (trojan)pc had 'generated'.
Both would be no change to 'spamming as martketing', only putting
a bit more pressure on the evolution of spambots, and killing
thousands of legitimate email accounts by injecting spam into
their mailstream.
May be, every account gone is a bit less spam, but at the end
of THAT way 'Email' will be gone too :-)
So I think, it's not that simple.
Stucki
--
Christoph von Stuckrad * * |nickname |<st...@mi.fu-berlin.de> \
Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-5 57 78|
Mathematik & Informatik EDV |\ *|if online|Tel(else):+49 30 77 39 66 00|
Arnimallee 6 / 14195 Berlin * * |on IRCnet|Fax(alle):+49 30 838-75 454/