Analysis of Spam, and a Proposed Solution 370
2bot_or_not_2bot writes "Spam: The Phenomenon is a detailed analysis of spam: products, scams, viruses, obfuscation methods, etc. Failed, and doomed-to-fail, methods of blocking spam are described. A general solution is proposed that does not: invade privacy, perform wide censorship or blacklisting, or involve payment and cooperation with corporations (beyond the transport and storage of data)." Hmmm.
Here's a solution... (Score:4, Funny)
They steal our time, money, and bandwidth.
We take their hands.
Re:Here's a solution... (Score:3, Interesting)
Re:Here's a solution... (Score:2)
How 'bout blog comments? Usenet? Freeware with convoluted EULAs? Where do we stop and say "enough"?
Re:Here's a solution... (Score:3, Funny)
Bad choice. I mean, was there ever a time when they were considered "useful"?
Re:Here's a solution... (Score:2)
Re:Here's a solution... (Score:5, Funny)
( ) technical (*) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(*) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
(*) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(*) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(*) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(*) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Doing the Right Thing should not be preempted by making a buck.
Re:Here's a solution... (Score:4, Funny)
Cheers,
Craig
Re:Here's a solution... (Score:2)
Examples (Score:5, Funny)
John.
Re:Examples (Score:5, Funny)
Revenge on Spammers (Score:5, Funny)
I mean come on, if only
Re:Revenge on Spammers (Score:3, Funny)
Re:Revenge on Spammers (Score:4, Insightful)
Even better, have it read the spammers own spam back to them over the phone, until their answering machine fills up. ^^
Re:Revenge on Spammers (Score:2, Insightful)
The problem with that, of course, is that spammers will then try to make it look like the spam comes from someone else--like an anti-spam activist, say.
Re:Revenge on Spammers (Score:2)
"You may say that I'm a dreamer,
but I'm not the only one."
Oh, fuck "leaving them voicemail" (Score:2)
I ignore any proposed solution to spam that does not consist of the simple phrase:
Now, if even .5% of spammers had their walls decorated with their own brains, that would cut down on bandwidth wastage.
Re:Revenge on Spammers (Score:3, Funny)
Your post advocates a
( ) technical ( ) legislative ( ) market-based (x) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(
Have fun people (Score:2, Funny)
------
Your post advocates a
( ) technical ( ) legis
Boycott of Microsoft's Caller ID for E-mail (Score:5, Informative)
MOD PARENT UP (Score:2)
Re:Boycott of Microsoft's Caller ID for E-mail (Score:3, Informative)
Yes, you're most likely just trolling, but just in case some people don't realize why you're wrong, I figured I should point it out anyway. It's not a philisophical point. It's a very practical point. If Microsoft has a patent on it, then open source software and Microsoft competitors can't adhere to the standard without facing the posibility of lawsuits or large licensing fees. Maybe not right away, but whenever Microsoft feels it would benefit them most (read: after it becomes widely accepted and impl
Not a scholoarly article - here's the text (Score:3, Informative)
The web page contains lots of images of SPAM that the author has received.
Here is the text of his proposal:
Wrong (Score:5, Informative)
John.
Re:Wrong (Score:2, Informative)
Re:Wrong (Score:3, Informative)
The existence of low-scoring or unknown "regular" words would NOT mask the presence of high-scoring spammy words! The Bayesian filter would not be fooled.
Tell you what. (Score:5, Funny)
Check your filter training database (Score:3, Informative)
Seconded. (Score:5, Funny)
The one or two which have gotten through look like they could have been written by a Perl guru.
Have the users pay for it... (Score:5, Informative)
Re:Have the users pay for it... (Score:5, Insightful)
What email harvesters do is convince poorly informed people and businesses that by buying their $499.00 mailing list of two million valid email addresses, they will rake in thousands upon thousands of dollars in profits.
It is those poor sods who send the millions of email, using the email autosender conveniently provided on the cd-rom, who are then blacklisted to hell and lose their $49/mo super gold premium windows 2003 10MB (Front-Page enabled no less) account and wonder with growing bitterness how the jerks at "MakeMegaBuxWithEmail.Com" could have flat out lied, LIED, to them...
Then they realize they can make $499/CD by just finding another sucker...
Of course, like all good pyramid scheme, the thing will implode under its own weight, but it has not yet run its course.
A solution? Of course. A study needs to be made showing the average Joe that paying for a list of email addresses is a snake-oil scheme to lift money from their wallet.
Then people can charge money for the "Don't Be Fooled By Email Scam Artists. Send $29 And I'Ll Show You How To Protect Yourself Today!!!" and spam will be a thing of the past.
(yeah, that's it...)
Spam isnt the problem anymore - Spyware (Score:2, Interesting)
Re:Spam isnt the problem anymore - Spyware (Score:5, Interesting)
Two months after we moved out, we went for dinner there, I had to look up something quick in google and *OMFG* the computer is barely crawling, it has half the system tray filled with icons, and it has so much malware that adaware crashes :o
Self-installing and opt-out add-ons suck. Hard.
Re:Spam isnt the problem anymore - Spyware (Score:2)
If you haven't figured out policies (either social or Windows administration related) then it's nobody's fault but your own.
Either as the head of IT you instruct people not to install anything on their computer without consequences, or you keep Windows from installing it through policies.
The last thing we need is more government involvement in every little aspect of our lives./p
I dont get it (Score:4, Insightful)
I've done it myself a couple of times, and have explained the relevant legal code from spamlaws [spamlaws.com]. I have yet to hear back from either the spammers or the authorities I have explained this to.
I would think if law enforcement would do what it is SUPPOSED to do, spamming would be vastly reduced.
Re:I dont get it (Score:2)
With HTML turned off, all I get is gibberish spam, with gibberish sender, gibberish subject and gibberish content. Ad Nauseam.
I'm about to throw the towel and get a new email address.
Or a bag of rocks and spammers' addresses.
Negative Feedback (Score:3, Interesting)
Imagine if all or some very large contingent of email clients allowed you to
"retaliate" against spam messages. Highlight message, select "negative feedback"
option, a daemon is spun that traces back as far as possible the route of the
message and barrages it some fashion. By pings maybe? By directed replies? Imagine
it does this in some scheduled fashion so as to minimize the impact on your local
network. As 1 million disparate sources converge upon the last traceable source of
the route of the offending spammer, some network somewhere will start to feel the
load. Like the spokes of a wheel converging on the hub, the retaliation traffic will
thicken as it closes in on the source. The pain increases. ISPs inundated by
individuals expressing their right to freedom of speech, will feel suddenly inclined
to exercise their right to refuse service to someone.
The "negative feedback" could be dosed in a coordinated fashion if there were some
P2P means of establishing how many individuals had received a particular spam. If a
spammer hits only a hundred people, the dose of retaliatory traffic would have to be
increased to be felt. If the spam hit a million, it would require only a modest
retaliation to utterly swamp the source.
Just thinking out loud. Could this be made to work? No one's free speech is
curtailed, spam is dealt a serious blow.
fight fire with fire.
Re:Negative Feedback (Score:2)
No, just slashdot some poor asshole's computer that was zombied by some windows worm or whatever.
Retaliatory measures will just bag some incompetent computer operator. Sorry. (and don't forget that the guy might be incompetent, but maybe his lawyer isn't and you are trying to DOS him)
Re:Negative Feedback (Score:2)
Your post advocates a
(*) technical ( ) legislative ( ) market-based (*) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and othe
Joe Jobs, Forgery, Legitimate URLs (Score:4, Insightful)
Re:Negative Feedback (Score:2)
Wgets validate email addresses (Score:3, Insightful)
good and good (Score:2, Insightful)
This dude has a decent idea, I guess. I've found a method that has been foolproof for the past three years. I only give out my email address to people I directly know. I've had a Hotmail address that's been spam free since 2001, not even a drop in the bulk bucket. Once or twice a year I'll get a Hotmail Services thing, but that doesn't matter to me. I keep a junk address at Yahoo when filling out online forms, posting, etc. It works for me and it works for my friends. My ISP email address has _never_ receiv
Re:good and good (Score:2, Interesting)
My business partner's wife emailed me a 'get free movie tickets, just get five friends to sign up' email. I immediately dumped it into the trash, but apparently the fact that she had submitted my email to this place was all I needed to start the spam floodgates.
It still isn't too bad, but I am now getting 3 - 5 unsolicited SPAMs to that address daily from various companies. No p3n1s enl@rgements yet, but I'm sure that is just a matter of time.
Re:good and good (Score:2)
I've explained to everyone I gave my email address to that I don't want my email address submitted to ANY website. If they want to forward me something, they should copy the link and paste it into an email.
I had one of my users submit seven other of my users' email addresses to one of these free movie tickets sites. They ended up being blocked because the site forged the initial sender's email address in the From: line. This was by one of the same people who complain about the amount of spam she gets. I ex
Re:good and good (Score:2)
That works if you only communicate with a small number of computer literate friends who don't get infected with viruses or ever send out cc:'ed e-mail.
I have the same policy and practices as you. Unfortunately, I use my email address to communicate with a larger number of people, some of which have done "stupid things" with my email address. Keeping seperate email addresses
Re:good and good (Score:2)
-
that worked for me until... (Score:2)
A few months later, that *expletive* customer representative forwards one of those stupid urban myth chain-letters (about some missing kid/fake amber alert), using that company's email address book, which included my email address!
Then the spam deluge started.
Not a full proof solution (Score:2, Informative)
The problem is, that my email is somewhat generic with my first initial, last name, plus a numeric conditioner. This email was assigned by the provider. Unfortunately, many spammers, once they realize how emails are formatted for an ISP, can easily r
Re:good and good (Score:2)
Spam of Mass Destruction (Score:3, Insightful)
You know, if government really focused on penalizing the bottom end product creator for spam, I'm sure it'd be minimized drastically. For example Viagra, made by Pfizer, if they penalized Pfizer for spam and not controlling the methods of their advertising, I'm sure many companies would think twice about their methods to deliver content.
Sure it would need some tweaking, but to go after Joe Blow unsuspecting user who's machine is probably loaded with trojans is moronic. Even a good enough trial lawyer for the most blatant spammer could probably convince a jury that the culprits machine was infected if they tried. It's obvious CAN-SPAM and other moronic laws aren't working so why not take it to the next level?
Pentagon Plane Crash of 2000 [politrix.org]
Re:Spam of Mass Destruction (Score:3, Insightful)
Actually, it should be Pfizer going after them, since any Viagra advertised by spammers (if it even contains the drug at all) will be an unlicenced rip-off.
Which just goes to show - even spammers who leave themselves open to prosecution under what most of us agree are overly-restrictive IP laws, still do
"Solution" is ridiculous (Score:3, Insightful)
Any proposed solution cannot cause this type of massive interruption of normal e-mail usage.
The article is total dreck (Score:5, Insightful)
Next!
Is it still April 1st? (Score:2)
Hey, buddy, let's get
Actually reinvented tagged email addrs, badly (Score:4, Interesting)
That way you can use different addresses for mailing lists, orkut, random recipients, each Slashdot posting, etc., and blacklist addresses that get abused and/or only whitelist addresses you've sent people. There are some risks - the subdomain version occasionally gets hit by dictionary attacks, so you might receive 10 million messages on an occasional really bad day (this mainly happens if your subdomain doesn't run its own SMTP server that can milter it.)
IM2000 (Score:5, Interesting)
The other cool concept to that is mailing lists vs bandwidth. In old mailing list styles, a message would go out to the list, bouncing back from all people whos boxes are gone or full- witha lot of traffic. In DJs new way, there is only notification of the message sent, and then only those who really want the message download it.
The more you think about it, the better of an idea it becomes. In the wold of terrifying ideas like "postage for emails" or "really super-mega-expensive domain names for mail only" Bernsteins has an elegance and practicality I haven't seen elsewhere.
Re:IM2000 (Score:5, Insightful)
Options:
a) Notification contains no sender-modifiable content. No way to know if you want it or not. You say yes and wind up with spam from unknown server.
b) Notification winds up containing the entire spam as subject line, and the supposed server it's coming from doesn't exist.
c) Spammers break into millions of unsecured Windows boxes and run 'mail servers' on them.
Nice try, but no cigar.
Re:IM2000 (Score:2)
Re:IM2000 (Score:5, Insightful)
Another possibility is that the notification could be just that (no content whatsoever), with you downloading the headers separately (i.e. 3 steps: notification; headers; body and full headers). That would force the server to exist, but you don't have to download the rest of the message if you do not want to do so.
Also consider how this would work with RMX proposals (like SPF: http://spf.pobox.com ). If the email is not from a validated IP, then you can reject the initial notification.
It is also worth noting that a spam method that requires illegal acts (like virus infection) is dangerous for the spammer. It is not really practical when selling everyday items, only scam emails (already illegal) or really high margin items that allow the spammer to change locations often.
Criticizing anti-spam proposals for not completely solving the problem is missing the point. No one anti-spam method is going to eliminate spam. Each one is designed to make it harder to spam, ideally without impacting normal email. IM2000 does this, since it merely shifts from POPping from the recipient's server to the sender's server. This is harder for senders but easier for receivers in most cases. The exceptions are those where the sender does not maintain a persistent (i.e. always on) mail server (e.g. spammers). This is very rare with legitimate emails (if the sender does not have a persistent mail server, then they can't *receive* email; legitimate senders generally want to be able to receive emails in response).
Re:IM2000 (Score:2, Insightful)
And how does this notification get to the user, eh? What's the difference between 1,000 spam messages and 1,000 spam subject lines? The user still has to sort out the difference. Especially when the subject is 'Hello' or other similar innoculous valu
Re:IM2000 (Score:3, Insightful)
Good lateral thinking, but I don't think it would ultimately stop spam. I'd love to see more details.
It would prevent a spammer from dumping a 100Kb email message into your inbox, but it wouldn't prevent him from dumping 100K of 1b "notification" messages in there, and it would be all the same to him. It would make it much harder to sort between the two.
And under the current system, the spammer doesn't know anything about the recipient (or
Re:IM2000 (Score:3, Informative)
Not entirely true. If a user is running a mail client that allows HTML mail, then the spammer can make the client request something unique from the spammer's server - an image, for example. I've seen spam
Re:IM2000 (Score:2)
Re:IM2000 (Score:2)
The problem is people click on them and it makes them profitable so they continue to do it. 99% of all spam preys on people who want to better themselves in dumb ass ways.
Re:IM2000 (Score:3, Insightful)
Re:IM2000 (Score:3, Insightful)
Re:IM2000 (Score:2)
IM2000 [cr.yp.to]
Bandwidth and storage for the ISP (Score:5, Informative)
I administer a mail server for a small ISP. The problem with filtering on the user's end is that my costs are consumed by the time the user deals with the spam. I don't think, as the article suggests, that spammers will slow down if their message is not being read, in fact they will just spew out ever more spam. If a 1/10 of 1% hit rate does not deter them, a smaller hit rate won't either.
I have to put some upper limit to the amount of storage I can give each person (right now I allow 100M, which I think is quite reasonable). But if a user goes on vacation and does not check their e-mail for a month, they could have their inbox filled with spam and viruses (not much difference these days, from a server admin point of view). This will preven legitamate messages from coming through. Therefore, I use the following technical measures to help reduce spam:
Re:Bandwidth and storage for the ISP (Score:2)
It works by initially by "greylisting" e-mail from unlisted mail servers by sending a "451 4.7.1 Please try again later". If the server resends the e-mail within 4 hours, but minimum 30 min, the server is whitelisted. These timings can be configured, of course.
For now, this works very well for me, since few virii bothers to resend an e-mail, a
Re:Bandwidth and storage for the ISP (Score:2, Interesting)
I know something like this exists already but why not make known spammer servers get 3rd rate service from our owns servers?
Their servers would could take weeks to send out the number of messages they can now in 10 minutes. They need to get the massages out quickly or else the ratio of misses starts to cost them. This is the real solution.
SpamNAZI (Score:2)
I was just thinking (Score:2)
First, some talk about scope ani justification of the idea. This method does not, in any way, eliminate spam. My take is that yo
Re:I was just thinking (Score:2)
One thing is that it has a major impact on the way email works. Imagine sending HTTP links to the message. This requires either that the user browses to the link (inconvenient), or that mail clients be changed so that they automatically follom the link (requiring changes to mail clients, making them more complex).
Changes propagate slowly. See PGP, which could also be used as a solution to spam, or IPv6, which has been accepted but is still sparsely adopted. Durin
No code numbers, no pay mail (Score:2)
Signed email (Score:2, Funny)
Shooting Spammers (Score:2)
Insoluble (Score:2)
1. You want to accept mail from strangers.
2. Some strangers insist on anonymity.
Simply put, if you insist on accepting email from anonymous strangers, there is no way to guarantee that all of it is wanted.
Even if you don't want mail from anonymous entities, but still want mail from strangers, the problem of identity management is non-trivial. The only solution I see is a "web of trust," based on a very large relationship database like Orkut or PeopleAggregator.
This is just a less-good PKI solution (Score:3, Informative)
It's essentially just a PKI system, but requires effort on the part of the individuals to manually set up a trusted transmission channel for authentication data for each person, breaks security if an email is exposed, does not provide strong authentication benefits, and seems to be open to forgery containing data from an original email. It still requires the installation of software.
Instead of transmitting each "set of formulas" via a trusted channel, one could hand over an RSA pubkey, and instead of some weird proprietary embedding of secrets, one could simply sign the email. This provides all the benefits of the proposed system, operates in a regular manner, is strong against compromise of a client machine or of sent email, and there are, to some degree, systems in place to handle signing.
I would advise against this solution. It provides no benefits that a conventional email signing system lacks, and has some serious weaknesses.
Why so much opposition to changing the protocol? (Score:5, Interesting)
The sending SMTP box says to the receiver "I've got a message for you" Receiver caches the message, hands the source box a 32 digit random number and says I'll call back in 30 seconds by your FQDN. It does so. Receiver says "did you send me a message with the serial 'x'"? If yes, then the source in the header wasn't spoofed, and the message goes through, if not, the message gets dropped.
Almost all spam these days comes from spoofed sources. But if in this case it's still spam, it's a lot easier to track the source immediately and deal with it. Take away the ability to hide, and like mold in the sunlight, most of it will vanish without further effort.
Re:Why so much opposition to changing the protocol (Score:3, Interesting)
True, but if Sendmail and all of the other big mail packages got together and agreed on a date to have the upgrades available and working and then released the update packages on/by that date, you could have this auth as a switch to turn on at each SMTP server. Then when the implementation date passes, a lot of the big sites like AOL, Hotmail, etc. get it going
One missing trick on his page (Score:2)
I don't think it's too effective (the spam far outweighs the ham in my Bayesian corpus), but I think it's an interesting trick that could pollute the creation of a corpus over time.
Not a solution... (Score:2)
Step (1) Create spam solution site with dozens of spam samples (i.e. meta-spam site)
Step (2) Publish a "solution" that requires scrolling through said dozens of spam examples.
Step (3) Get Slashdot to post your site
Step (4) Reap profits from all the extra traffic, as well as the newly-minted cynics who will be convinced there is no spam solution.
Sigh. old solution. (Score:3, Interesting)
This 'article' dismisses laws outright. Sure, bad laws, like in the USA, haven't worked. But look at europe! Successful laws, minimal spam.
It never ceases to amaze me what crap articles get accepted while quality ones get rejected.
Anybody know how to code to Outlook? (Score:2)
If i wrote one simple function that looked at content, I'd eliminate 90% of my 1000+ daily spams trivially (all commercial solutions that i have tried have prevented too many of my customer emails from going through).
You Might Be An Anti-Spam Kook If... (Score:5, Funny)
Each item in the following list was suggested by the words or actions of people who presented themselves to the IETF or elsewhere as having discovered the FUSSP. Some of the items may seem obscure to those who have not dealt with the IETF.
Spam: The Non-Issue (Score:2)
My obligitory response to all spam threads (Score:4, Interesting)
The idea: multiple, sender/use specific addresses on the client side. Basically instead of having one address with your ISP, you would have the ability to create up to 50 aliases to your account. Not that these are not 50 accounts, all of your mail still winds up in the main mail account at your ISP.
Lets say you have bob.smith@myisp.com as your email address. The goal here is that you would NEVER give out that address. Instead, you log in to your ISP's web site and create addresses that you then give out. These addresses can be set to expire after a set date, or only be removed manually.
So you like to pay your bills on-line, create an address bobsbilling@myisp.com and use that on all the registration forms for your utilites, credit cards, etc.
bobs-shopping: use it to register for any on-line shopping sites
bobs-long-ebay-address, sendmailtobob, tossaway32341, etc....
You create an address that you give only to your family/friends, you create an address for each mailing list, create an address that you put in the public LDAP systems and other person-search sites, create an address for sweepstakes/contests, etc.
If you start to get spam on an address (you can easily check the headers to see which address the spam was sent to), you simply change the address and tell the few people/sites that used that address about the new one. The more addresses you have, the fewer places you need to notify of any changes.
The only disadvantage is the initial changeover does take some time/effort. Once created, the addresses mostly just sit there and don't require any maintenance or routine changing.
The advantages: little to no spam; abliity to easily identify WHERE the spammer acquired your address when you do get any; spam does not take up any bandwidth or storage space on the recieving mail server once an address is deleted after getting spammed; no resource intensive and complicated filter software required on the server.
How well does it work? With about 35 addresses out there (may are web site specific), I receive only about 6 spam messages a month. Each and every one of those is sent to a public administrator address like webmaster, hostmaster or the like, not too bad considering I recieve such email for about 10 domains.
In the last year or so since I've started doing this I have only had to disable a single address due to spam, and since it was for a single web site, it took less that five minutes to effect the changeover to a new address.
To those who say that this is too much of a hassle or takes too much effort, I ask this: would you rather have to spend 30 minutes a year maintaining and changing email addresses and informing senders of the new address, or spend 5 minutes a day updating your spam filters and double-cheking the positive results for false hits?
As I stated, this does not require and changes to the mail clients, but if there were one change it would be nice: when you reply to a message the client should automatically use the address that the initial message was sent to instead of attempting to use the actual account address.
Unknown email with datagram over 128 byte ... KILL (Score:3, Interesting)
I think; maybe, valid personal email should be the focus.
We want our email, but we do NOT want sPaM.
Currently we use USRID/AccID, DNS, DHCP, ARP-RARP,
I agree, with others, the W3C (someone) will need to add some RFCs on check/verify local "Lookup" user approved filter for email.
As Relates to SpaM/Email:
1. Subscribers, customers, users of an email service must be required to define an "Approved Email List (AEL)". Email client applications should require a user-action (right-click-select option, maybe) to generate a UDP/TCP update-message to add an addressor's email to the user-AEL resident on the email/profile server. To delete any addressors from a user-AEL should require a few extra steps of accessing the user-account web-page and specifically selecting one address (we change friends, someone moves,
2. Email service providers must provide to users a web-app/text-upload process for managing a user-AEL. (1) Either upload formatted text (with total content overwrite option) user-AEL as part of the user account/profile definition, or (2) on the email service domain's open/manage email account website a web-app that allows easy addition/deletion to the user-AEL.
3. New/Unknown email addressors, those not identified in an addressee user-AEL, with a datagram over 128-bytes (standardized size more/less for one name and an email address) are terminated, not delivered, bit-bucket, not replied/forwarded,
4. New/Unknown email addressors, those not identified in an addressee user-AEL, with a datagram under 128-bytes are delivered to the email addressee. This will allow the email addressee their option to decide; if the email addressor should be added to their user-AEL. This will allow an addressor to provide enough information to be potentially (as family, friend, business, hobby,
5. Incoming email are checked for valid local email accounts (NOT, then terminate). Incoming email having a valid local address are then checked by comparing the addresses with the user-AEL with the specific email address (userid@domain.___) of origin (MATCH NOT, then terminate). Repeat email terminations/rejects from same "@domain.___" could be blacklisted as a sPam@domain.___ unless recognized by a local user-AEL.
I'll stop counting here, because I think the rest can be surmised and counting gets boring. This process could be close to transparent for email users, except for the managing of an email account user-AEL. It would reduce spAM and potentially malicious/viral email in obvious ways by limiting allowed payloads/datagrams from unknown (un-validated/vouched for) sources in any email. Vouched for addressors (causing problems) on a user-AEL could be more traceable. The processing/handling overhead of such a systems would (I expect) be about the same as the present process and would significantly reduce email-server storage space requirements. Email is un-trustable, but required tool in the business world, and increasingly burdensome of our personal time.
The spAm-cans could only dump to email users that included them in their user-AEL. Over time it would reduce the spam-flood and/or spam-DDOS on the internet, because few (maybe none) would ever see spam-stuff and SPAM would prove a financi
Greylisting + Honeypot = high degree of success (Score:3, Interesting)
Step 1: Salt the spammer's email databases with guaranteed bogus email addresses that no legitimate email sender has ever seen. This is currently trivially implemented as follows. In your website's robots.txt file, list several files that robots must not examine -- these are your honeypot. Then, fill those files with HTML that contains your bogus email addresses. Spammers will, quite reliably, disobey the robots.txt file, use it to discover HTML files that are not linked to from anywhere else in the world, and add your bogus mail addresses to their database.
Step 2: Implement greylisting + honeypot-based RBL. When email arrives that is not whitelisted, see if it comes from an IP address that is "temporarily" blacklisted in your RBL. If it is, you can reject it right now. Otherwise, see if the target address is in your honeypot database. If it is, add the sender's IP address to your RBL and fail immediately. Otherwise, engage the now-classic greylisting algorithm (see http://www.greylisting.org/) to "tempfail" the email. The point of the temporary failure is to give the spammer time to use the same IP address to send the same spam to an address that *is* in your honeypot database, so you can then proceed to reject the retry of the spam to a legitimate email address).
Why this won't work... (Score:3, Insightful)
You have to authorize each sender? The sender computes a code to send you mail?
Right. Most people can't get the clock on their VCR to stop blinking. This ain't gonna happen.
-Charles
Bayesian filters thwarted? (Score:4, Interesting)
It did? Apple's Mail.app uses a Bayesian filter, right? Salting messages with random words haven't thwarted its filter at all. I might see a couple or three spam every week, but considering that's out of hundreds filtered per week with no false positives, I can live with that.
He also makes the following curious claim:
Is this really a problem? I'd say this is one of Bayesian filtering's advantages.
So far, Bayesian filtering has worked wonderfully for me. I don't see that it's been defeated -- or will ever likely be truly defeated -- at all.
Another one bites the dust (Score:3, Interesting)
Okay folks... move along... nothing to see here...
Does the author really think that I'm going to exchange formulae with everyone I want to exchange e-mail with? Even if the client software made it as easy as "pairing" bluetooth devices... ugh!
Every time I see one of these doomed-to-fail spam stopping schemes, I become more and more convinced that the only way that this problem is ever going to get solved, permanently, is with certificate-signed e-mail. Basically, e-mail client software would cryptographically sign each sender's outgoing mail and the receiver's software could check that their cert was signed by a trusted certificate authority. Most software can already do this; all you need to do is go get a certificate.
Ultimately, it would probably be left up to the individual receiver as to which certificate authorities they wanted to trust (ie, PGP's "web of trust"). But, for the most part, I think most people would default to trusting a handful of "big" cert authorities. On the face of it, there is some loss of privacy, but the loss of privacy would be in proportion to the clout of the CA that signed your certificate.... which, in turn, would be in proportion to how reliably you wanted your e-mail to be delivered. So, the sender would still get to pick how much privacy they sacrificed.
But I just see no other way to stop spam than this. Certificates would add a high degree of confidence that the sender could be reached (either by the receiver or by law enforcement)... and "reachability" is the first step towards accountability. Now, for the cases where someone managed to get an certificate with bogus contact info... well, that's what certificate-revocation lists are for. Basically, it's not really different from the IP blacklists that we're using now, except it would (hopefully) be a lot harder to obtain a new certificate than it is to obtain a new IP.
Re:hmmm.. (Score:4, Insightful)
Even better, somehow, there's a database that matches names to email addresses. People other than me map to my email address, so I get "legitimate" spam.
Furthermore, not loading the images and not clicking on the links doesn't fix the problem entirely. I've checked, depending on which address they've spidered. Contact addresses for my web-design business that I shut down 3 years ago are still getting spam.
That I have to change an email address that I've had for nearly a decade... well.. it makes my blood boil.
Re:hmmm.. (Score:2)
Re:hmmm.. (Score:3, Interesting)
I have a similar situation, an address I've had a good 15 years and it's so swamped with spam I'm regretfully coming to the conclusion it's not worth having anymore. But, if I only had control of the mail server...
I've got a much simpler method of stopping spam, and my analysis of the spam I receive tells me it would kill the vast majority of it. The author of the article almost mentions it, but discards it, wrongfully I think. He says
Probably not too useful (Score:2)
As far as companies go, no company is going to want to prevent people e-mailing them easily.
Re:Use a word in the subject to verify legit email (Score:2)
So the spammer sends the message, the mail server recieves the entire thing, then decides that the message should be dropped.
Re:Use a word in the subject to verify legit email (Score:2)
This subject line filtering is something that sendmail milter's do all the time
Re:Use a word in the subject to verify legit email (Score:2)
This will likely cause the sender to re-initiate the failed connection again and again for the next N hours. In the end you've created a situation where instead of simply receiving the message once and deli
Don't forget about multiple recipients (Score:2)
Or spammers just start sending you more stuff until one "breaks through",
Sean, great dealz now
Susan, great dealz now
Steve, great dealz now
Selma, great dealz now
Sam, great dealz now...gotcha
Note the special keyword trick can still be useful for certain personal communications...for instance if I tell all my friends to put the w