Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Spam Your Rights Online

AOL Tests Sender Permitted From / E-mail Caller ID 448

Posted by timothy from the spammers-need-some-heavy-suin' dept.
securitas writes "ZDNet reports that AOL is testing Sender Permitted From (SPF), 'an antispam filter intended to accurately trace the origin of e-mail messages.' AOL is performing the widescale SPF test with its 33 million subscribers worldwide. The system works by letting recipients use the SPF record to cross-check DNS data associated with AOL's IP addresses and confirm that the message originated from AOL's servers. The system is one of three competing e-mail authentication protocols. The other IP-identifying protocols are the Designated Mailers Protocol (DMP) and Reverse Mail Exchange (RME/RMX). All systems alter the DNS database to let e-mail servers publish the IP addresses that they use to send e-mail."
This discussion has been archived. No new comments can be posted.

AOL Tests Sender Permitted From / E-mail Caller ID More

AOL Tests Sender Permitted From / E-mail Caller ID

Comments Filter:

  • Big Deal (Score:5, Funny)

    by Ridgelift ( 228977 ) on Sunday January 25, 2004 @10:24PM (#8084754)
    So what? Microsoft is working on a new secret email technology [microsoft.com] and they need people to test it. They are paying people for it too! Send this email message to 10 people and receive a check for $50.00 from Microsoft. My friend Tom did it and it really works!

  • Hrm (Score:3, Funny)

    by The-Bus ( 138060 ) on Sunday January 25, 2004 @10:27PM (#8084770)
    I don't know anyone respectable who uses AOL so I won't ever be able to find out how this works...

    • Re:Hrm (Score:5, Informative)

      by GammaTau ( 636807 ) <jni@iki.fi> on Sunday January 25, 2004 @10:49PM (#8084917) Homepage Journal

      I don't know anyone respectable who uses AOL so I won't ever be able to find out how this works...

      Heh. Actually (if I have understood correctly) SPF should prevent anyone from spoofing aol.com as the sender address during the SMTP session. So if a spammer attempts to spoof aol.com and your mail server is SPF-aware, then it would be good for you and AOL because you won't get spam and AOL won't get bounces for the addresses that had problems with delivery (and with spam, problems with delivery are not rare).

      At least this is how I have understood it.

      • Yup, it's really anti-Joe-job [spamcop.net] more than it's anti-SPAM. I wish web mailbox sites would use it too.

      • Re:Hrm (Score:3, Interesting)

        by RollingThunder ( 88952 )
        Presumably, though, you can also start feeding SPF-based data (does it have SPF records? does it match? etc) into SpamAssassin or other clasifiers, and seeing how well they correspond to spam/ham checks.

    • Re:Hrm (Score:3, Funny)

      by Monkelectric ( 546685 )
      Dude aol is the best way to meet chicks (especially in a small town with no real "social" places to go).

      Not kidding. Aol has gotten me laid a number of times, and thats AOK with me.

  • AOL muscle (Score:2, Insightful)

    by DarkHelmet ( 120004 ) *

    Do we really want the kind of split-down-the-middle stance on formats that we have to deal with when it comes to DVD burning, VHS vs Betamax, anything like that? No, it only ends up being harmful for everyone in the long run.

    I'm reminded of what Microsoft did with IE. All these different DOM objects that aren't part of any standard, which no one can really use because it's not browser-compatible.

    Using muscle to force the Internet into a standard isn't going to work. We need something that *is* a stan

    • Re:AOL muscle (Score:5, Interesting)

      by PygmySurfer ( 442860 ) on Sunday January 25, 2004 @10:40PM (#8084839)
      Using muscle to force the Internet into a standard isn't going to work. We need something that *is* a standard, rather than *pushing* a standard upon people.

      Standards don't miraculously appear out of mid-air. Standards are created when one implementation of an idea is chosen over other implementations. Unfortunately, as at least one of your examples shows, we see that its not a

      Right now, AOL and several other groups are developing an implementation of a Spam-tracking system. Eventually, one of these systems may win out. If/when it does, a standard is born.

    • Re:AOL muscle (Score:5, Informative)

      by FattMattP ( 86246 ) on Sunday January 25, 2004 @10:47PM (#8084898) Homepage
      Using muscle to force the Internet into a standard isn't going to work. We need something that *is* a standard, rather than *pushing* a standard upon people.
      SPF isn't an AOL thing. It's something created independently and several people, most notably Meng Weng Wong, are working hard to make it a standard. There is an RFC in draft form [pobox.com]. Feel free to join the mailing list [pobox.com] if you want to participate in its development. AOL is just the largest user at the moment along with several others:
      • AOL.com
      • AltaVista.com
      • DynDNS.org
      • LiveJournal.com
      • OReilly.com
      • Oxford.ac.uk
      • PhilZimmermann.com
      • Perl.org
      • w3.org

    • in a utopia, yes. (Score:5, Insightful)

      by Kunta Kinte ( 323399 ) on Sunday January 25, 2004 @10:59PM (#8084985) Journal
      Using muscle to force the Internet into a standard isn't going to work. We need something that *is* a standard, rather than *pushing* a standard upon people.

      We've been waiting for an anti-spam standard for years now. What do we have? Nothing.

      It's about time someone with clout got up and started making decisions.

      I have 4 blocklist on my email server, and still we get a ton of spam everyday. My users hate it, I hate but we have to deal with it whilst the IETF works out their political agenda.

      PS. I've also been waiting for the Calendar Access Protocol for a while now. Years, where is it? We're on draft 11 now.

      Sometimes design by commitee plain sucks; and we just have to admit that.

    • Re:AOL muscle (Score:3, Insightful)

      by dev11 ( 635413 )
      AOL didn't create SPF. It is just one of the proposed anti-spoof techniques out there. I am not a big fan of AOL/Time Warner, but I am glad to see them trying this out. Many Internet "standards" are de facto standards, which are later adopted as official, because they work the best. If committee designed standards were always adopted, the "Internet" may have used the OSI (very bad) protocols instead of the cleanly designed TCP/IP, since that at one time was the official standard of the US government, I

    • Re:AOL muscle (Score:3, Insightful)

      by Nevo ( 690791 )
      How do you think standards come to be?

      One day there's no standard and then, POOF, there is?

      Standards come into existence by the cooperation of many people deciding to do something together. Which is what's happening with SPF. SPF has been a proposed standard for a while now... AOL is the large adopter that's going to propel SPF to an accepted standard.

  • So far, so good (Score:5, Interesting)

    by TheOtherChimeraTwin ( 697085 ) on Sunday January 25, 2004 @10:28PM (#8084774)
    I've had trouble with spammers doing small runs with my domain name on AOL. Since I've set up SPF, I haven't had a single bounce from AOL-bound spam. It might just be luck, but as far as I can tell, SPF is helping.
    • SPF 45, guaranteed spam protection for up to 12 hours!

      Now waterproof too!

  • Hashcash anyone? (Score:3, Interesting)

    by product byproduct ( 628318 ) on Sunday January 25, 2004 @10:28PM (#8084777)
    Here's a nice way. Before someone can send some mail, he has to get some exponent from mersenne.org which needs double-checking [mersenne.org], run the primality test and report the low order 64 bits of the final S_{P-2} value, called a residue [mersenne.org]. If that value matches the value that mersenne.org expects, then the mail goes through.

    Nice deterrent for spam, and as a side-effect one more Mersenne exponent has been double-checked.

    • Re:Hashcash anyone? (Score:3, Interesting)

      by Adam9 ( 93947 )
      I bet the mailing lists would love that..

    • Re:Hashcash anyone? (Score:5, Insightful)

      by LostCluster ( 625375 ) * on Sunday January 25, 2004 @11:06PM (#8085020)
      All variants of "Make it computationally expensive to send e-mail!" prevent all mass mailings of all kinds... not just spam. You're tossing out a few babies with the bath water, that's just not a working solution.

      Besides, there's not much stopping Spammers from just buying the processing resources they need. Whatever meaningless task is picked, development would immediately start on making that puzzle easier to solve. You'd start seeing processor chips dedicated to the task...

      Being cash-expensive is less popular on /. because most geeks have more processor cycles than dollars, but at least cash has a more stable value over time...

  • Simply Amazed (Score:3, Insightful)

    by inode_buddha ( 576844 ) on Sunday January 25, 2004 @10:30PM (#8084782) Journal
    For once I might actually approve of something AOL does. OK I didn't RTFA but it sure looks a lot like whitelist filtering. Here's hoping that others pick up on this idea if it works out! (my dialup had 530 spams in the last month... thank you, Bayes!)

    • Re:Simply Amazed (Score:4, Interesting)

      by ldspartan ( 14035 ) on Sunday January 25, 2004 @10:36PM (#8084814) Homepage
      SPF is broken. It breaks forwarding, unless you want to rewrite the From header at every hop.

      Mail signing (what yahoo proposed recently) is a lot closer to working sender verification. It would allow a message to take any number of hops, and still be verified.

      --
      lds
      • SPF is broken. It breaks forwarding, unless you want to rewrite the From header at every hop.

        That seems to be by design. [pobox.com] (Not offering an opinion, merely commenting. Seems to me all these schemes will cause much more pain for the small guys than for the big ones.)

      • Yahoo's DomainKeys breaks things too (Score:5, Insightful)

        by wayne ( 1579 ) <wayne@schlitt.net> on Sunday January 25, 2004 @11:05PM (#8085016) Homepage Journal
        Yahoo's DomainKeys proposal involves taking a cryptographic hash of the message body *and* headers. It then encrypts the hash with a private key, puts the result in a header with a tag saying where to get the public key to check the resulting message.

        The problems with Yahoo's Domainkeys, are as follows:

        • You complain about bounces, but this system does not verify the envelope from, and therefor will not prevent all those bounces.
        • A spammer who can get an account on your system (think Yahoo here), can send email to another account they control. They then have an email with your signed hash on it, which they can resend all they want.
        • Mailing lists, some email forwarding services, and other systems will add information to both the body and headers of a message. MicroSoft Exchange servers store emails in an internal format and recreate the heasers when they forward it on. *poof*, you now have an invalid hash.
        • Hashing and then using public key encryption to sign the emails is fairly expensive. The keys that you would look up in DNS are going to be fairly large. All-in-all, this is a fairly expensive proposal, and it doesn't really solve any problems.

        I think SPF is a far better better proposal for this kind of thing.

      • Re:Simply Amazed (Score:5, Informative)

        by Tony Hoyle ( 11698 ) <tmh@nodomain.org> on Monday January 26, 2004 @09:32AM (#8087101) Homepage
        SPF is based on the envelope sender not the From address - I suggest you read the FAQ first.

        Yes, you have to change the envelope on each hop, but that's a good thing, as it means that each hop is validated which makes it harder to spam.

  • Should faking be illegal? (Score:3, Interesting)

    by Thinkit4 ( 745166 ) on Sunday January 25, 2004 @10:31PM (#8084789)
    Sure I'm libertarian like many other nerds, but I can't think of a good reason to fake email. I want my whitelists to work. A technical solution is always better, though.

    • Faking email is great for practical jokes. Like the time I sent this one girl a message from "god@heaven", with a message "I see your purple toenails, if you don't shape up"... and so on in that line. Silly, and useless, but we both got a good laugh.

      Now if you fake an email is should be obviously fake. Faking something from paypal to get someone's account info should be illegal. But do you really want to throw out harmless practical jokes like the above too?

      • Re:Should faking be illegal? (Score:4, Insightful)

        by jrockway ( 229604 ) <jon-nospam@jrock.us> on Sunday January 25, 2004 @11:38PM (#8085201) Homepage Journal
        NO no no no no no. Faking email is fine. People need to learn to NOT TRUST the From field. Legislation gets us nowhere. I mean, viruses are illegal and there are plenty of those. It's illegal to hijack a plane and fly it into a building, but that happened too.

        Solution? SIGN YOUR EMAIL. Then the recipient knows that you wrote (or at least signed) the email. Key exchange a problem? Maybe you shouldn't be using email, then.

        If all my email were signed, I wouldn't even need a spam filter. I could just trash all non-signed email.

        Unfortunately, my friends (except for one) find it too hard to download/buy GPG/PGP and click the "sign" button when they mail me. Oh well, what can be expected of people that are too lazy to hit the shift key after sentences. *sigh*

  • I'm All For It (Score:3, Interesting)

    by vga_init ( 589198 ) on Sunday January 25, 2004 @10:32PM (#8084794) Journal
    Personally, I think that's it's an excellent idea; I remember reading about SPF a while back when it was still just brand-new, and though it sounded like a fantastic idea I was wondering who exactly was going to pull it off--after all, the system requires a lot of outside cooperation to work effectively.

    Now that this is being backed by AOL, a massively-used service, SPF will be pushed into the forefront, hopefully becoming a more universal standard and dealing a major blow against spam.

    This may just be what we've been waiting for.

  • this is not whitelist. (Score:5, Informative)

    by man_ls ( 248470 ) on Sunday January 25, 2004 @10:33PM (#8084797)
    This is not a whitelist filter.

    It's not any kind of a filter.

    It just means that AOL has published SPF records for its mail servers in their DNS entries. Any mail server speaking SPF, receiving mail from AOL.COM, will check the SPF record.

    If the SPF record (which will contain the IP addresses of AOL's mail servers) doesn't match the originating IP address of the mail message (as in, a spoofed header) the message is invalid. Then it can be either dropped or bounced or whatever.

    If the SPF record matches the initiating IP address (as in the case of a message legitimately sent by the mail server) it's clear and goes through.

    • Re:this is not whitelist. (Score:4, Insightful)

      by schon ( 31600 ) on Sunday January 25, 2004 @10:42PM (#8084851)
      If the SPF record (which will contain the IP addresses of AOL's mail servers) doesn't match the originating IP address of the mail message (as in, a spoofed header) the message is invalid.

      So, in essence, AOL has decided that it's customers can no longer send mail from their AOL email address, unless they're logged into AOL.

      This does not bode well.

      I don't use AOL, but if MY ISP decided that I could no longer use my personal email address while I was at work (or at an internet cafe, or whatever), I'd be pretty pissed.
      • eh, yes, it is a bit of a problem I suppose.

        My IP block for my personal email server (jkoebel.net) is blocked from relay to just about everywhere by the dynamic IP blocklist. So, I just smarthost it and relay through my ISP's mail server. It's allowed because I'm on their network, and then the message is originating from a more legitimate mail server == no more blocks.

        If SPF is implimented client-side it might be better, that would allow messages to be flagged "source does not match the known provider add

      • Re:this is not whitelist. (Score:5, Interesting)

        by weave ( 48069 ) on Sunday January 25, 2004 @10:49PM (#8084912) Journal
        I believe along with this, your ISP or employer would also have to set up authenticated SMTP so you could send email through their servers legitimately when you're outside their network. Shame that many places now routinely block outgoing port 25 though...

        • Re:this is not whitelist. (Score:4, Informative)

          by kiolbasa ( 122675 ) on Monday January 26, 2004 @12:21AM (#8085397) Homepage
          ISPs that provide SMTP-auth relaying accessible from outside their network usually make it available on an alternate port, say 2025. Most moderm mail apps now make it easy to use a different port. And I don't think it is too much to ask, or too dirty of a hack, since the only purpose of this port is authenticated mail relaying, not actual delivery. The distinction between the two is becoming more important for a useful system. E-mail is changing. Thank the spammers.

      • Re:this is not whitelist. (Score:5, Informative)

        by Frater 219 ( 1455 ) on Sunday January 25, 2004 @10:55PM (#8084962) Journal
        So, in essence, AOL has decided that it's customers can no longer send mail from their AOL email address, unless they're logged into AOL.

        No, they haven't. Here's the current TXT record for aol.com.:

        v=spf1 ip4:152.163.225.0/24 ip4:205.188.139.0/24 ip4:205.188.144.0/24 ip4:205.188.156.0/24 ip4:205.188.157.0/24 ip4:205.188.159.0/24 ip4:64.12.136.0/24 ip4:64.12.137.0/24 ip4:64.12.138.0/24 ptr:mx.aol.com ?all

        Now, if you knew SPF [pobox.com], you would recognize that the last bit -- ?all -- means that AOL is not stating that AOL-user mail is only legitimate if sent from AOL mail servers. The ?all tag means that hosts that don't match the rest of the SPF record are taken as unknown -- not as failures. That would be -all.

        • Re:this is not whitelist. (Score:4, Interesting)

          by ajs ( 35943 ) <ajs.ajs@com> on Monday January 26, 2004 @01:33AM (#8085753) Homepage Journal
          "Now, if you knew SPF, you would recognize that the last bit -- ?all"

          Hate to sound snide, but if you knew SPF you would recognize that as a transitional setting, which the SPF specs suggest you set a hard cuttoff date around.

          SPF's failing, as far as I can tell is that there is no dynamic authentication capability for a client out in space that wants to send mail "from" all of the 20 or so domains that that user had addresses with (e.g. my spamcop, personal, aol, work, oss project and other addresses). I don't want to go hunt down a server that will talk to me for mail origination for EVERY ONE of these domains... I just want a way to tell their servers, "hey, I just sent a message from your domain to joe@example.com, heads up" and have the right thing happen. There should then be a way for a server to say, "heya, I just got mail from your domain to my joe@example.com address... that yoy?" It needs to be message-by-message like this, and if that sounds like a lot of overhead... I GUARANTEE you that it is less than handling bounces for every virus message ever crafted in your name....
      • f MY ISP decided that I could no longer use my personal email address while I was at work (or at an internet cafe, or whatever), I'd be pretty pissed.

        What you're supposed to do is use a From: address indicating where you actually are, and a Reply-To: address that indicates where you would like replies to go. What AOL is setting up is the ability to say "That didn't really go through aol.com!" which basically makes aol.com a bad domain name to pick if you're going to spoof and spam.

        Besides, any AOL subscr
      • It's been 6+ beautiful months since I was last an AOL customer (side-effect of no wired lan in university halls, only a landline which was actually through some 2-bit student telephone service), but I think AOL have a webmail service. There are also many established approaches to authenticating users back in to their "home" SMTP server (pop3-before-send and more) which would make this a non-issue.

        Those facilities aside, this isn't your ISP making any such decision of "you can't use your personal email addr
      • So, in essence, AOL has decided that it's customers can no longer send mail from their AOL email address, unless they're logged into AOL.

        Their domain name, their rules.

        If AOL was nice, they would provide SMTP AUTH, SMTP after POP, or the SMTP SUBMISSION protocol so that you could use their official mail servers from anywhere.

      • So, in essence, AOL has decided that it's customers can no longer send mail from their AOL email address, unless they're logged into AOL.

        I remember this used to be the most baffling thing to newcomers to e-mail. Why would a protocol allow you to pretend to be someone else? Why didn't the SMTP server stamp all outgoing mail with the proper domain?

        I understand that images are important in e-mail, but if you are capable of receiving yourname@yourjob.com, then theoretically you should be able to connect to

      • Re:this is not whitelist. (Score:4, Insightful)

        by M. Silver ( 141590 ) <silver@noSpAM.phoenyx.net> on Sunday January 25, 2004 @11:52PM (#8085259) Homepage Journal
        Mod me redundant because I say this *every* time somebody whines about this, but:

        I don't use AOL, but if MY ISP decided that I could no longer use my personal email address while I was at work (or at an internet cafe, or whatever), I'd be pretty pissed.

        So you do what you're already supposed to do in this situation, and set the From line to your personal email address, and the SENDER line to wherever you really are. Mailing lists do this all the time.

  • What about commercial or throwaway accounts? (Score:5, Interesting)

    by Anonymovs Coward ( 724746 ) on Sunday January 25, 2004 @10:35PM (#8084804)
    Lots of e-businesses generate unique email addresses for different consumer requests, which can then be thrown away, and individuals and mailing list managers (like ezmlm for subscription confirmations) do this too. It works because often the part of the email address after a + sign (or for qmail, a -) is ignored by the mail delivery agent, but can still be used for filtering/sorting mail by the user. Seems to me any DNS-based email address registry has to be smart enough to deal with it.

    I suspect that as the big commercial guys get more and more aggressive in breaking email standards in the name of combating spam, the internet will split into different incompatible email groups: the old-fashioned types (which include many university departments still) who use a text console and a program like pine or elm, and the AOL/Hotmail/Yahoo crowd. To some extent it's already happening: I can barely read some messages sent from MS Outlook, they're formatted so badly, and as a result I'm less likely to reply to them.

    • you missunderstand SPF (Score:4, Informative)

      by Kunta Kinte ( 323399 ) on Sunday January 25, 2004 @11:06PM (#8085022) Journal
      Lots of e-businesses generate unique email addresses for different consumer requests, which can then be thrown away, and individuals and mailing list managers (like ezmlm for subscription confirmations) do this too. It works because often the part of the email address after a + sign (or for qmail, a -) is ignored by the mail delivery agent, but can still be used for filtering/sorting mail by the user. Seems to me any DNS-based email address registry has to be smart enough to deal with it.

      The recipient's MTA will check the sender's SPF record. You can auto-generate all the email accounts you'd like, only the domain name portion of the email address is authenticated in SPF.

      In fact that was one of the arguments against SPF, people said that it did not go far enough and actually authenticate users.

      Personally, as someone who has to administer an email server and whose domains are sometimes used in forgeries for spam ( last one was a few days ago ), I'm all for SPF.

    • Re:What about commercial or throwaway accounts? (Score:4, Informative)

      by Alawishes ( 745260 ) on Sunday January 25, 2004 @11:30PM (#8085156)
      This is a great feature! I never understood how it would really work until I started using Shadango [shadango.com] (based on a recommendation posted on /.)

      See, I generate a disposable ("Spamtrap") account, and post that all over the internet. When the crap gets too unbearable, I just regenerate it. I can't even imagine how I survived without a disposable account in the past.

      Also, and more related to the story, what will happen to sites that let you consolidate all your other accounts? I use Shadango [shadango.com] to check my POP/IMAP/Y!/Hotmail/AOL/mail.com accounts (because it filters them, plus I have a bigger quota), but I guess it's just a matter of time until I won't be able to 'send' from those addresses anymore.

      Hmmm... it sucks that spammers have slowly taken away all the freedom that the email

      It's hard to win a fight when you don't know who to swing at.

      Susie Johnson

  • Doesn't protect against cracked computers (Score:5, Insightful)

    by h2oliu ( 38090 ) on Sunday January 25, 2004 @10:36PM (#8084815)
    The biggest weakness of this system is that it doesn't protect against some user's system sitting on a broadband DSL/Modem line that has a Trojan Horse used to e-mail the spam. AOL's system probably would only encourage more viruses/worm designed to make computers email relays.

    Of course if all non-business accounts were prevented from hosting an SMTP server that would help solve that problem, but I don't think that would go over very well with the Slashdot crowd. I'm not even sure where I stand on that issue.

    • Of course if all non-business accounts were prevented from hosting an SMTP server that would help solve that problem, but I don't think that would go over very well with the Slashdot crowd.

      As long as ISPs:

      1. promise to run a smarthost service using authorized SMTP for their residential customers,
      2. promise 99.odd% availability for the smarthost service,
      3. explain in the TOS that listing of the smarthost in n or more major spam blackhole lists counts as unavailability,
      4. make good on their promises by meeting

    • Re:Doesn't protect against cracked computers (Score:5, Informative)

      by FattMattP ( 86246 ) on Sunday January 25, 2004 @10:53PM (#8084939) Homepage
      The biggest weakness of this system is that it doesn't protect against some user's system sitting on a broadband DSL/Modem line that has a Trojan Horse used to e-mail the spam. AOL's system probably would only encourage more viruses/worm designed to make computers email relays.
      Correct. SPF isn't an anti-spam tool. It's an anti-forgery tool. AOL's SPF record in effect says "These are the IP addresses that are authorized to send mail whose FROM: address ends in aol.com. Please take that fact into consideration if you receive mail that says it's from aol.com but doesn't come from one of the authorized IP addresses."

    • Re:Doesn't protect against cracked computers (Score:4, Informative)

      by wayne ( 1579 ) <wayne@schlitt.net> on Sunday January 25, 2004 @11:15PM (#8085065) Homepage Journal
      Yes, but those cracked PCs will not be able to send email claiming to be from my domain to anyone who listens to my very restrictive SPF records. This will help reduce the number of bounces I back from forged sender addresses.

      SPF is just one tool to help tighten up the security of the SMTP system. It lets domain owners say who is authorized to send email using their domain name. This is a useful thing to do, and it allows for other things to build on it. For example, RHSBLs that blacklist domain names instead of IP addresses are much more useful after SPF checking has been done. SPF checking can also help detect phishing schemes.

  • this ain't gonna work. (Score:5, Interesting)

    by cdn-programmer ( 468978 ) <<ten.cigolarret> <ta> <rret>> on Sunday January 25, 2004 @10:36PM (#8084816)
    What will work is a certification that is revolkable. The concept is embodied in public key encryption and certification.

    Basically - all we need to do is this. We have a trusted institution like a bank or your local government office issue a digital ID to everyone who wishes to participate... purely voluntary.

    Next - those who wish to participate use an email client that refuses to accept anything from anyone who does not have a valid certificate.

    Next - we set up a black hole list and the email clients refuse emails from anyone in the blackhole list.

    Next - we make this list available to the issuing authorities and if they re-issue we blackhole that authority.

    By doing this we create a beuracratic nightmare for our wanna be spammers and everyone else is pretty much free to go on as they have.

    I for one will NOT join an opt in list because there are far to many people who have legitimate reasons to contact me. Yet the spammers? well - there are not that many of them... they are really a fringe group actually.

    • Basically - all we need to do is this. We have a trusted institution like a bank or your local government office issue a digital ID to everyone who wishes to participate... purely voluntary.

      1) Banks and government as "trusted"? This sounds like a wonderful way for both of them track every e-mail you send with no problem.

      2) "Voluntary" will rapidly become mandatory.

      No, for e-mail to remain useful and to ensure that those who need it can have privacy it is important that we develop technology that block
  • My brother coded this SPF implementation [wayforward.net] in a day, but then he was using Python.

    Everybody should start using SPF. No, it's not the perfect solution. Think Saving Private Ryan. SPF is like the guys in the front of the boat who get gunned down when the doors open. But without them, the other guys (other to-be-developed protocols-or-whatever) wouldn't stand a chance..

  • SPF is good fro the PHBs... (Score:5, Interesting)

    by bc90021 ( 43730 ) * <bc90021 AT bc90021 DOT net> on Sunday January 25, 2004 @10:37PM (#8084819) Homepage
    It works well with them for two primary reasons:

    1) It is easy to do. You can go to the SPF site [pobox.com] and they have a wizard to fill out so you know exactly how to change your DNS, and

    2) You can change things over gradually. After you've changed the DNS, you start by aloowing everyone, and then as more people join the system, you implement the protocol slowly.

    That last point is particularly good, since the PHB types freak if their email isn't exactly the way that they're used to... and they also freak when implementing new technologies. You can assure them that nothing is changing at first, and that all changes will be made gradually and in steps.

    The SPF guys understand that that's necessary, and even have a PHB Executive Summary [pobox.com] page.

  • Publish SPF records (Score:5, Informative)

    by FattMattP ( 86246 ) on Sunday January 25, 2004 @10:39PM (#8084827) Homepage
    Don't forget to publish SPF records [pobox.com] for your domain if you have the ability to do so. If you have already done so, please register your domain via the validator [infinitepenguins.net].

  • AOL is the Wal*Mart of the Internet. (Score:5, Interesting)

    by vegetablespork ( 575101 ) <vegetablespork@gmail.com> on Sunday January 25, 2004 @10:43PM (#8084856) Homepage
    If anyone could force a change to the current email system (unfortunately), it's AOL. If AOL said that beginning 00:00 next Sunday, mail from hosts without valid SPF records would be rejected, major ISPs and corporations would fall immediately into line. Those running their own SMTP servers would either make SPF records or be forced to use their ISP's smarthost.

  • Um, I thought... (Score:3, Insightful)

    by krray ( 605395 ) * on Sunday January 25, 2004 @10:47PM (#8084902)
    Um, I thought Bill was going to take care of spam for us?

    The _only_ thing I see working that the spam scum will simply never get around is going with whitelisting email address' (much like what Apple's Mail does -- it's not junk if they're in your Address book) -- and authenticating said From: lines with RMX type DNS lookups.

    Email!certainly!is!not!what!it!used!to!be

    I'd love to bang! a spammer some time -- right up side the head.

  • As usual, D. J. Bernstein has the ACTUAL solution (Score:5, Interesting)

    by Anonymous Coward on Sunday January 25, 2004 @10:48PM (#8084908)
    The idea behind Internet Mail 2000 [cr.yp.to] is obviously correct. Why waste time on DNS-based approaches when we COULD be developing the Solution?

    • Re:As usual, D. J. Bernstein has the ACTUAL soluti (Score:4, Insightful)

      by HiKarma ( 531392 ) * on Sunday January 25, 2004 @11:49PM (#8085246)
      This is no solution. It stops the load of sending the bodies of spams, but the annoyance of spams still remains.

      It also introduces a lot of problems. Unless you just immediately fetch, it tells the sender where you were (IP address) and when at the time you fetch the mail. If the sender's server is down you may not be able to fetch it at all. Response times get slower, again unless we just use this to implement the old pre-send system, in which case we don't get its benefits.

      A mixed system (pre-send small mail, post-fetch large or questionable mail) can have some of the benefits but still faces problems. And spam still comes.

    • Re:As usual, D. J. Bernstein has the ACTUAL soluti (Score:4, Informative)

      by gfilion ( 80497 ) on Monday January 26, 2004 @12:02AM (#8085310) Homepage

      The idea behind Internet Mail 2000 [cr.yp.to] is obviously correct. Why waste time on DNS-based approaches when we COULD be developing the Solution?

      Because it's not backward compatible.

      SPF is a simple and backward compatible solution to email forgeries. People who don't use it are still able to use email, while people who use it are protected against forgeries.

      Everyone and their brother are reinvented email theses days without realising that you need to improve the existing email system. It's not possible to throw away the existing system.

    • People assume IM2000 would stop spam because:

      1] You don't get a message unless you want to retrieve it
      2] The sender has to store the mail not the receiver, so the sender has to pay to store a bajillion messages

      This doesn't work because:

      1] By seeing the notification, you're already annoyed and have wasted your time.
      2] The sender need only store ONE copy of the mail on a customised MTA, not millions - so as long as he has a custom server, he can still spam and use only a few hundre kb of disk space per mes

  • problem (Score:5, Funny)

    by TedCheshireAcad ( 311748 ) <ted@fUMLAUTc.rit.edu minus punct> on Sunday January 25, 2004 @10:49PM (#8084913) Homepage
    This presents a problem to those of us who have unreasonably short penises.

  • Built on existing standard (Score:5, Informative)

    by richard_za ( 236823 ) on Sunday January 25, 2004 @10:53PM (#8084938) Homepage Journal
    A little research [pobox.com] showed that it is built on existing standards, namely DNS and SASL SMTP. This should ease it's implementation. But heres some obvious ways to prevent spam.
    • If you have a common first name, don't have an email address of the form firstname@domain, you are guaranteed to be hit by a dictionary attack
    • Don't publish your email address on the web, make sure any websites you subscribe to hide your email address or use email address hiding technique
    • If your on a mailing list make sure that if the archive is available on web that it hides your address
    • Use a bayesian mail filter

  • I forsee a problem (Score:3, Interesting)

    by mark-t ( 151149 ) <markt.nerdflat@com> on Sunday January 25, 2004 @10:54PM (#8084945) Journal
    If a person's email address and mail server do not correspond to the same network.

    This actually is the case for my wife and I, who still pay for and use our older dialup ISP's email accounts for both professional and personal reasons, but have been connected to the internet 24/7 via cable for the past few years. We cannot send email out through out email provider's mail server unless we dial in and connect to them directly using one of their dialup lines. Thus, we use the mail server provided by our cable provider to send the mail for us. Of course, if ADSL was available in my building, I would simply subscribe to that via my ISP and it wouldn't be an issue, but it's not... so a system like this would seem to render my wife's and my email accounts unusable.

    • Re:I forsee a problem (Score:4, Insightful)

      by LostCluster ( 625375 ) * on Sunday January 25, 2004 @11:09PM (#8085035)
      No it wouldn't. Just follow the proper protocol. The "From:" address should be your cable-domain address because that's what you're actually sending from. The "Reply-To:" address can be your dial-up address, because that's where you would like any replies to go.

      You're spoofing your "From:" address at the moment, and that's exactly what nobody should be allowed to do for any reason...

  • Why this is a big deal (Score:5, Informative)

    by jhunsake ( 81920 ) on Sunday January 25, 2004 @10:54PM (#8084949) Journal
    It means that any system administrator can configure their mail transfer agent to bin any spam pretending to come from aol.com with a 100% success rate. And this goes for anyone else publishing an SPF record for your domain.

    SPF is a proposed standard for a domain owner to tell mailers where mail From: that domain may originate. The domain owner publishes a DNS TXT record for their domain with (at the simplest) list of IP addresses. Participating mail transfer agents can then look this record up and make a policy decision on whether the mail is likely to be legitimate. The presence of an SPF record on a domain at present means that while you still can't be sure when you're handling spam, you can be sure when you have a piece of non-spam because the SPF record tells you so.

    SPF is not a wholly original idea (e.g. up "designated mailer protocol"), and certainly not the simplest implementation but the important factor is that its proponent, Meng Wong, is an excellent lobbyer and spokesperson, as well as someone who as the nous to put forward a useful protocol (he founded pobox.com). It's currently at the point where lots of implementation are being written, with the canonical version being Meng's Perl modules. Currently I'm helping to finish the C implementation which will shortly be integrated into qmail and exim.

    The tipping point (I hope) will be when a domain not publishing an SPF record or publishing a globaly permissive one will be considered "obviously" untrustworthy. Combining SPF authorisation with a more traditional "From: domain blacklist" will give spammers a very very hard time indeed forging mail. But AOL publishing a record (we hope) shows the way the wind is blowing: the rest of the world does seem to have to change their mail server configuration to keep mail flowing to AOL.

    So go on, it's dead easy, publish a record for your domain now. Tell people where your mail comes from. Look, there's even a wizard to help you.
  • Question on this whole SPF thing.
    I'm interested in it but have a slight issue with it at the moment that
    I'd like to get resolved.

    My domain is: mydomain.com
    Customer A is traveling and is using his e-mail of joe@mydomain.com
    However, I do IP filtering on my mail server (not SASL AUTH), for my
    dial-up pools.
    When Customer A is at hotel he must use their mail server to send mail
    out, so his mail will be rejected because the hotel mail server isn't
    listed in mydomain.com's SPF txt list.

    You suggest running SASL AUT

  • Some educated opinions on the subject. (Score:3, Interesting)

    by mcroot ( 634911 ) on Sunday January 25, 2004 @11:04PM (#8085011)
    Before looking at SPF you may want to read what Claus Assmann [theaimsgroup.com], and Wietse Venema [theaimsgroup.com] have to say on the subject.

    If you don't know who these two people are, I seriously hope you're not someone who's making decisions affecting SMTP on the Internet.

  • Spam solution... (Score:3, Funny)

    by tomstdenis ( 446163 ) <tomstdenis@gma[ ]com ['il.' in gap]> on Sunday January 25, 2004 @11:08PM (#8085033) Homepage
    Just stop sending them?

    Ok, how about all you potential spammers send $6 to my home address:

    123 Fake St.
    Springfield, Il
    12345
    United States of America

    and U will $ee many monies! No need to spam again!

    Sincerely,
    Prince Mobutu of the Nigerian Empire.

  • Silver-bullet solutions (Score:3, Insightful)

    by mercuryresearch ( 680293 ) * on Sunday January 25, 2004 @11:29PM (#8085150) Journal
    I notice that a number of people knocking SPF are looking at it breaking some sort of standard, or that it's an exclusive, it's-the-only-answer technology, ie it's being proposed as a silver bullet.

    It's not. SPF just provides one more bit of helpful information -- which IPs email from the sender's domain should really be coming from.

    While someone could use SPF in a pure binary decision system that breaks SMTP, it's going to be an incomplete solution. Just like blacklists, whitelists, and bayesian filtering are also incomplete solutions.

    However, you start using these things in combination and magic happens.

    Example: I use ASSP for server-side spam filtering. ASSP uses bayesian filtering, but also whitelists people you email and uses blacklists.

    The blacklist implementation is interesting, however, as when it determines an IP is blacklisted it simply starts off with a higher spam probability in the bayesian stage -- it's not truly blacklisted, just more suspicious.

    You could do the same thing with SPF, initially giving a lower spam probability to mailservers with SPF, and when there's more infrastructure using SPF, switching to penalizing non-SPF servers.

    Nice thing about this approach: it doesn't require everyone to convert their infrastructure, but it does incentivise legitimate servers to do so without penalty. It doesn't break any standards. Legitimate mail still gets through, but spam suffers.

    Stop thinking that all spam solutions have to be single silver bullets. Anti-spam tools can be additive.

    One more tool against spam == a good thing.

  • Testing incoming, or testing outgoing? (Score:3, Interesting)

    by jfengel ( 409917 ) on Sunday January 25, 2004 @11:47PM (#8085240) Homepage Journal
    I've read the article and I can't figure out what the test is. Does this mean that AOL is publishing SPF records (in which case it's old news) or does it mean that AOL is going to start rejecting incoming mail which fails the SPF tests?

    • I've read the article and I can't figure out what the test is. Does this mean that AOL is publishing SPF records (in which case it's old news) or does it mean that AOL is going to start rejecting incoming mail which fails the SPF tests?

      It's the old news.

  • I don't think SPF accomplishes much (Score:3, Insightful)

    by cdn-programmer ( 468978 ) <<ten.cigolarret> <ta> <rret>> on Monday January 26, 2004 @05:55AM (#8086514)
    I really don't think this is going to go very far - primarily because it seems to me that a spammer from say bigisp.com can say he is ANY OTHER CUSTOMER from bigisp.com.

    Suppose we have joesixpack as an example - and he has a laptop. At home he connects via his ISP and sends an email to his mom. The letter is received because the from address is valid in his ISP's SPF list. Then he goes to work and tries to send her another email. This time the email will get rejected. So he tries to send it through his ISP's mail server. Since he is not connected to his ISP's system, the email is rejected.

    This means that joesixpack has to somehow LOG IN to a server and go through an authentication.

    -------

    This sort of comes to the nub of the problem. Authentication. If Joesixpack is a good guy - he should be able to send email to anyone - and if he is not a good guy we will find out fairly quicky and we can fine him or pull his priviliges.

    The issue is not much different than driving a car actually. It needs to be dealt with in the same way as traffic infractions... perhaps through the police.

    One way to implement something that will work is via issuing a certifiation. At the time joesixpack signs up with his ISP - the ISP could act as a CA and certify him as a good guy. They can record his identiy just as they recorded that he paid his bill. At this time they could install a cert for JoeSixpack into his email client - AND - bond it to his machine. There are many ways to bond it - including using a dongle or smartcard. But a practical way would simply bond it to the hard drive. I'm sure ways can be invented so that certs cannot be simply pulled from one machine and stuck into another.

    If Joe later abuses his cert - then his ISP can blacklist it and refuse to issue another. Also - the ISP's can trade blacklist information just as banks and businesses trade credit information.

    The mail clients can be modified to send the cert and the MTA's could check for and eventually reject any unsigned mail.

    As for the ISP's being a trusted CA? Well - we have to trust some people somewhere. The question would really boil down to which ISP's trust which other ISP's and they could cooperatively run their own blacklist.

    With a system like this - I would think that an ISP that is shady would find their email services would be in jeopardy of being refused and that should serve to keep the ISP's in line to.

    ------------

    I also think the spamd solution in OpenBSD has a lot of merit. Spamd does not block email. Instead - if the sender is blacklisted - spamd accepts it very very slowly. This creates an incentive for the owner of the mail server sending out the spam to deal with it. With spamd in wide spread usage the problem comes under control in a number of ways.

    (1) suzy spammer will find if she runs a spam server that it can't spew very fast - because her IP address and/or domain will end up in the RBL rather quickly and the moment this happens. Receiving MTA's slow to a crawl.

    (2) If Suzy spammer tries to send through her ISP's account - the same thing happens but now the ISP has to deal with the problem. No ISP's will want to have a significant number of their IP addresses in an RBL. Since this will pose a significant admin problem - the ISP has a huge incentive to give Suzy spammer the boot.

    (3) We have some bad ISP's and these people will find their errant ways are causing themselves grief.

    (4) It might encourage ISP's to actually issue static IP's which many of us want anyways. Note we would NOT have nearly the spam problem if static IP addresses were issued.

Slashdot Top Deals

BLISS is ignorance.

Close