Subject: Re: [Asrg] Re: [1] Why SPAM is worse in SMTP than in other protocols

From: Tony Toews <[email-masked]>
Date: Mon, 22 Dec 2003 19:22:12 -0700

At 08:18 PM 2003/12/22 -0500, you wrote:

>   The LMAP discussion document (based on Hadmut's comments in RMX),
>says that the single hop use of SMTP is a large part of the reason why
>spam is so wide-spread.  There are 100's of millions of senders, each
>sending to only 100's of thousands of recipient MTA's.
>
> > How is this behavior helpful to stopping spam?
>
>   If that imbalance in the network was addressed, spam would become
>significantly more manageable.  It wouldn't stop entirely, but having
>a blacklist of 100K MTA's is signficantly easier than having
>blacklists of millions of IP's.

I have no particular expertise in mail servers or the Internet RFCs.  My 
viewpoint is thus quite simplistic.

I agree completely that the RFCs have to be changed, or some other 
mechanism, so that MTAs only take in email from other MTAs or authenticated 
clients of the MTA.   Recipient MTAs only accept emails from MTAs in the 
name lookup portion of the DNS.    Then we need some mechanism of ensuring 
that the recipient MTA is really receiving the email from the originating 
MTA.

 From my very simplistic view of the email systems it seems to me that the 
msgid id could be part of the verification mechanism.   The originating MTA 
stamps the outgoing email with a unique message id.  Once the header 
portion of the email is received then the recipient MTA does a name lookup 
on the originating MTA and verifies that the originating MTA sent that 
msgid.  Once the receipient MTA finishes accepting the email the 
originating MTA then never uses that msgid again.

And if all of this means updating the worlds email servers over the next 
year or two, well tough.  I for one am getting real tired of getting a 
hundred bounces a day from spammers forging email address for my domains 
and 200 or 300 Swen virusses a day.  And my domains and I are an 
insignificant portion or the worlds email traffic.

Tony
-----
Tony Toews, Microsoft Access MVP
Microsoft Access Links, Hints, Tips & Accounting Systems at
    http://www.granite.ab.ca/accsmstr.htm

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 23 Dec 2003 15:32:59 -0500

[Subject changed, was "Re: [Asrg] Re: [1] Why SPAM is worse in SMTP than 
in other  protocols". Mod.]

>> blacklists of millions of IP's.
..

>  From my very simplistic view of the email systems it seems to me that 
> the msgid id could be part of the verification mechanism.   The 
> originating MTA stamps the outgoing email with a unique message id.  
> Once the header portion of the email is received then the recipient MTA 
> does a name lookup on the originating MTA and verifies that the 
> originating MTA sent that msgid.  Once the receipient MTA finishes 
> accepting the email the originating MTA then never uses that msgid again.
...

This approach is outlined by William Elan (he calls it "callback"):

http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf

This is also mentioned in the CRI proposal (level 2):

http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt

This basic argument against this is that it is very resource intensive, 
with a lot of extra costs such as more powerful servers that can handle 
callbacks, more bandwidth, and extra disk space to store IDs. There are 
also DOS issues: someone forging a domain can cause the forged domain to 
go under with too many callbacks. There are privacy issues as well, and 
possible replay attacks.

However, the bottom line here, is that why go through the trouble of 
checking every single message. Granted that it increases costs, 
nevertheless if we can significantly reduce the problem through 
verification of MTAs as opposed to senders and messages, why go through 
the extra costs of message verification. This proposal is on the table, 
but we will pursue it only if a significant advantage vs. costs can be 
proven for this way of doing things, over others requiring less costs.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg