Subject: [Asrg] 0. General - News Article - Replacing SMTP

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 01 Aug 2003 13:38:53 -0400

I just ran across the following news article from CNET's News.com which 
raises some interesting issues regarding proposals to replace the SMTP 
protocol. It also discusses the ASRG in some detail. Here is the link:

http://news.com.com/2102-1038_3-5058610.html

The articles raises some interesting issues regarding the basic debate over 
SMTP: to replace or not to replace. According to the current requirements 
draft and the technical considerations document, the ASRG is leaning 
towards solutions that do not impose a tremendous adoption burden on users, 
which would preclude replacing SMTP entirely now, but would definitely 
allow to such replacement long-term.

Some quotes:
-----snip-----
"The protocol that has defined e-mail for more than two decades may have a 
fatal flaw: It trusts you.  Developed when the Internet was used almost 
exclusively by academics, the Simple Mail Transfer Protocol, or SMTP, 
assumes that you are who you say you are. SMTP makes that assumption 
because it doesn't suspect that you're sending a Trojan horse virus, that 
you're making fraudulent pleas for money from the relations of deposed 
African dictators, or that you're hijacking somebody else's computer to 
send tens of millions of ads for herbal Viagra. In other words, SMTP trusts 
too much--and that has spam foes, security mavens and even an original 
architect of today's e-mail system agitating for an overhaul, if not an 
outright replacement, of the omnipresent protocol."

"While critics generally agree on what SMTP lacks, debate abounds on how to 
fix it. Some who worked on the protocol in its early days argue that it is 
flexible enough to have successfully evolved over the years--having 
absorbed numerous revisions and extensions--and that the authentication 
problem can be partially solved with existing technologies. "Authentication 
in SMTP is not that hard," Paul Hoffman, director of the Internet Mail 
Consortium and author of numerous computer-related books, wrote in an 
e-mail interview. "There is already a protocol for doing it, namely running 
SMTP over SSL/TLS. And, yes, I wrote it." (The SMTP over SSL/TLS protocol 
is available at the Internet Engineering Task Force's Web site.)  The hard 
part, according to Hoffman and others, is establishing the "trust 
relationships" required to back up any computer-based authentication 
scheme--in other words, verifying that a person is who he or she claims to 
be. The problem worsens, Hoffman said, when trying to design a system that 
authenticates mail servers, rather than individuals. In part, this is 
because a third party would have to determine whether an e-mail server is 
responsible for sending spam. That kind of responsibility--voluntarily 
assumed by operators of various spam blacklists--could be onerous and 
expensive if applied to the Internet as a whole."Who is paying this third 
party for both the time and the legal risk in doing this?" Hoffman asked."

"Some say rewriting SMTP from the ground up would be prohibitively 
difficult because of the protocol's global user base, which is estimated to 
be in the hundreds of millions. "The difficulty of changing the transfer 
technology as a way of managing unsolicited bulk e-mail is the installed 
base," said Rodney Tillotson, the chair of the Anti-Spam Working Group for 
the Reseaux IP Europeens (RIPE), a consortium of European Internet service 
providers.  "There are thousands or millions of SMTP servers transferring 
and delivering mail, and getting them all changed will take years, during 
which time the (unsolicited bulk e-mail) problem probably remains 
unsolved," Tillotson said. "Proposals requiring a change to desktop mail 
software are even harder to deploy." Sluizer counters this by suggesting 
two protocols--SMTP and a new one, with tighter authentication--could 
easily coexist, with e-mail applications supporting both side by side. In 
that way, people using one protocol would not be prevented from exchanging 
mail with those using another."

"The RIPE antispam group isn't alone in conducting an online debate about 
changing fundamental protocols to stem the tide of spam. The Internet 
Engineering Task Force (IETF) this spring established a research group to 
come up with ideas on how to attack the problem from the protocol level. 
But critics call the IETF's efforts belated and say that efforts to solve 
the spam crisis can't wait while a standards body deliberates. "Given that 
it's taken six-plus years for the IETF to get around to deciding spam is a 
big enough issue that they should charter a 'research group' to look at it, 
I just can't bring myself to be hopeful that we'll see the IETF ratifying 
any major overhauls to SMTP before the decade is out," Ray Everett-Church, 
chief privacy officer of the ePrivacy Group, said in an e-mail interview."
-----snip----- 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 1 Aug 2003 14:48:34 -0400

At 1:38 PM -0400 8/1/03, Yakov Shafranovich wrote:
>"The protocol that has defined e-mail for more than two decades may 
>have a fatal flaw: It trusts you.  Developed when the Internet was 
>used almost exclusively by academics, the Simple Mail Transfer 
>Protocol, or SMTP, assumes that you are who you say you are. SMTP 
>makes that assumption because it doesn't suspect that you're sending 
>a Trojan horse virus, that you're making

That's really not true.  The fundamental problem has nothing to do 
with SMTP and trust, it has to do with the lack of any way to 
identify a person on-line.  Given that we don't even have usable, 
reliable ways to identify people *off*-line, that's not terribly 
surprising.

You can envision two ways around it.  One is a standard cryptographic 
identification system backed by some central authorizing 
organization.  The other is a closed centralized mail system in which 
it is impossible to send email unless the sender is provably the 
person who would receive any replies.

Neither of those are going to happen, any more than we'll fix the 
corresponding identification problems in the realspace.

The whole thing SMTP thing is a red herring.  Because not only do you 
have to solve the identity problem, you *also* would have to link 
each identities to a physical personal or company, and be able to 
recognize the commonality of all identities owned by that person. 
Otherwise throw-away identities keep the problem alive.

And finally you'd need an enforcement mechanism to prevent abuse.  It 
does me no good to know the name of the person who is mail-bombing my 
server if I can't stop him.

Given those issues, putting the blame on SMTP is pretty laughable. 
The problem has nothing to do with technology, and everything to do 
with society.  That's not to say that technology can't alleviate the 
problem.  But "fixing" SMTP is not going to solve anything. 
Technically the SMTP fix already exists, and has for years.  The fact 
that it isn't widely deployed makes it clear that the problem is 
elsewhere.

As is alluded to here, but apparently not in a way that was strong 
enough to nix the finger pointing at SMTP:

>partially solved with existing technologies. "Authentication in SMTP 
>is not that hard," Paul Hoffman, director of the Internet Mail 
>Consortium and author of numerous computer-related books, wrote in 
>an e-mail interview. "There is already a protocol for doing it, 
>namely running SMTP over SSL/TLS. And, yes, I wrote it." (The SMTP 
>over SSL/TLS protocol is available at the Internet Engineering Task 
>Force's Web site.)  The hard part, according to Hoffman and others, 
>is establishing the "trust relationships" required to back up any 
>computer-based authentication scheme--in other words, verifying that 
>a person is who he or she claims to be. The problem worsens, Hoffman 
>said, when trying

-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 01 Aug 2003 17:04:34 -0400

> recognize the commonality of all identities owned by that person. 

  I don't see why it would be necessary to establish physical
identity, if the mutual conversation is consensual.  See "sex with
strangers in bars" for a well-known identity-less consent protocol.

  The issue is that SMTP (or the common use of it) does not have a
complete enough consent model to meet the ASRG charter goals.  If it
did, then there would be no need for ASRG.

> server if I can't stop him.

  You just stop listening.  It worked for me for years, under spam
loads that few people believed were possible.  So your local
implementation of consent should be adequate to block non-consensual
traffic.  If that's insufficient, you can broadcast your lack of
consent to groups of people with common interests, like DCC.

> with society.

  I wouldn't propose "arresting society" to fix the spam problem.

>  That's not to say that technology can't alleviate the problem.  But
> "fixing" SMTP is not going to solve anything.  Technically the SMTP
> fix already exists, and has for years.

  Are you saying that SMTP implements enough of a consent model that
we would have little spam if the full features were used?  If so, why
not propose a BCP, or point out which existing BCP's are adequate, and
request that ASRG be disbanded.

> > The hard part, according to Hoffman and others, is establishing
> > the "trust relationships" required to back up any computer-based
> > authentication scheme--in other words, verifying that a person is
> > who he or she claims to be.

  Which is explicitely outside of SMTP, which means that SMTP alone is
currently unable to address the issue.  So we either need to "fix"
SMTP, or "fix" current practices with it, or add better consent model
on top of it.

  Alan DeKok.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 1 Aug 2003 14:38:44 -0700

Yakov,

YS> I just ran across the following news article from CNET's News.com which
YS> raises some interesting issues regarding proposals to replace the SMTP
YS> protocol. It also discusses the ASRG in some detail. Here is the link:

1. when was the last time you tried to post a regular letter, through
the paper mail delivery service, and were required to show
identification? I guess this means that there is a fundamental flaw in
the delivery of physical mail. I guess we had better start plans for
replacing the entire physical mail service.

2. when there is consensus about specific functions that are needed, we
can look at the best ways of implementing them.  if we discover that we
need to make a change to smtp, but are not able to, only then will it
make sense to explore replacing smtp.  until then, the call for
replacing smtp is a nice way to sound radical, but it has nothing to do
with seriously discussing problems and their solutions.

3. note that anything anyone submits to the ASRG is reported as being
"considered" by it.  this lends credibility to proposals that have no
support other than the authors.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>