Subject: Re: [Asrg] Projecting

From: Douglas Otis <[email-masked]>
Date: Mon, 1 Dec 2008 11:04:18 -0800

On Nov 29, 2008, at 1:08 PM, Barry Shein wrote:
> On November 29, 2008 at 11:07 [email-masked] (Michael Thomas) wrote:
>> Bart Schaefer wrote:
>>> On Nov 29,  7:49am, Michael Thomas wrote:
>>>>
>>>> That's pretty much why this email postage stuff is a waste of  
>>>> time. Even if it were wildly successful, what other part of the  
>>>> net would you want the spammers to focus their huge resources on  
>>>> instead?
>>>
>>> Don't bother treating your termite problem, they'll just move next  
>>> door?
>>
>> Not really. It's more like we have a pretty well known front line  
>> for this war. We're "winning" at an abstract level because email is  
>> still usable, even at the cost of its war of escalation. If we  
>> really "won" a final victory in email, they'd just pick a new  
>> battlefield to play on. So we get the choice of containment where  
>> we're doing ok, or fighting on a completely new battlefield where  
>> who knows what the dynamics will be. Wishing for what you might  
>> get, and all of that.
>
> This projects an image of one, unified "enemy".
>
> Closer to the truth is many miscreants, most unrelated, each also  
> competing with each other so each fully motivated to do whatever  
> they possibly can right now.

If DKIM's  i= values were assured by the d= value to opaquely  
represent the entity authenticated when accepting the message sent,  
then it would be possible for a (~30,000x scaled) reputation systems  
to identify sources of abuse.  Often, these sources represent several  
hundred million compromised systems, and _not_ individuals.   DKIM was  
not intended to track the message's "author", rather it tracks the  
domain and "on-behalf-of" identifiers.  These identifiers could  
represent a shared account, a client's IP address, or even a trusted  
relay.   Even if there was a scheme that ensured "author" identities  
(a dangerous notion),  it would be much less effective at locating the  
real culprits, compromised systems.

It is not hard to imagine why large providers wish to ignore accounts  
using compromised systems, as these represent extremely expensive  
support issues.  Once IPv6 opens the door to 340,000 decillion (10^33)  
IP addresses, the granularity of evidence collection and blocking can  
not be retained at the IP address.  Any attempt at using IPv6 will  
require granularity that approximates network routes.  Such  
granularity would be analogous to using large IPv4 CIDR blocks.   
Granularity at this level often results in collateral blocking, the  
bane of network providers.  While the infection rate of computers  
remains high, an escalation in the battlefield should at least  
represent a means that tracks the true culprit.  Blaming an often  
hapless email-address that a provider pretends to authenticate does  
not represent a fair solution, and is one likely to benefit confidence  
artist that will exploit a pretense of "author" authentication.

To scale a system that attempts to comprise such enormous scale of  
either the entire domain/on-behalf-of or IPv6 address space, this will  
likely require two transactions.  One transaction to squelch abuse at  
higher granularities, and a second transaction reserved for those that  
exhibit reasonable levels of abuse.  The complexity of the IPv6  
addressing, which includes carrier grade NATs or third-party  
translation services, means IPv6 addresses will not be stable enough  
to track compromised systems.  Currently, compromised system activity  
already transitions to different systems daily where repeated use may  
span months.  The use of IPv6 will make any reputation service a  
futile whack-a-mole game using a hammer that can not reach across the  
vast number of holes.  A solution for the reach of the hammer should  
not advocate a bigger hammer covering more holes.  This game may  
require the use of two hammers.  The cost of playing the game may  
require the use of DKIM.

-Doug

_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Mon, 1 Dec 2008 20:42:19 -0500

On December 1, 2008 at 11:04 [email-masked] (Douglas Otis) wrote:
 > support issues.

At the risk of being flip, it is not my responsibility to design
optimized business models for them.

It costs me a lot to deal with the spam from their business model
optimizations, and earns me nothing.

Further, I am quite sure THEY couldn't care less, not any more than
when Microsoft thought it too expensive to fix even the most basic
holes in their OS 10 years ago which was the key enabler of the spam
problem but only proceeded at a pace they felt commensurate with the
interests of their shareholders. Period. I'm not a shareholder.

So arguments like "it would cost them too much to do the decent
thing!", particularly where the costs are largely just foisted
unwillingly onto others, doesn't tend to move me.

  Once IPv6 opens the door to 340,000 decillion (10^33)  
 > not be retained at the IP address.

Oh please. There won't be 10^33 ip addresses involved. There are only
about O(nx10^9), n<10, people on the planet etc etc.

Put another way:

     IF THEY CAN BILL THEM FOR A SERVICE THEY CAN MONITOR THEM.

Ok?

The rest follows from the above so no point in my responding.

But gack if I could just get back the many sleepless nights I spent
because AOL, and others, chose to not verify credit cards or other
info before automatically enabling accounts (something we did) and the
attack after attack from those accounts being created at script speed
and the sanctimonious "you don't understand what marketeers call
friction, checking credit cards before enabling would constitute
unreasonable marketing friction, go read a marketing book".

Until, I guess, those accts started attacking their own systems, then
it was "damn the market friction and full steam ahead!"

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Douglas Otis <[email-masked]>
Date: Fri, 5 Dec 2008 15:35:30 -0800

On Dec 1, 2008, at 5:42 PM, Barry Shein wrote:

>> It is not hard to imagine why large providers wish to ignore  
>> accounts using compromised systems, as these represent extremely  
>> expensive support issues.
>

There is no Internet related revenue stream being made available to  
compensate providers who deal with bot-nets.  Nor is there an  
International Internet police force, men in black helicopters, that  
might impose fines to generate the needed revenues.  If there was some  
way to establish a revenue stream that could be directed toward  
providing corrective incentives, it might help create a much needed  
market force.

As a native view, perhaps to offset support costs, individuals could  
be offered Internet access discounts when they acquire a support and  
insurance package that protects them from being 0wned.  Support and  
insurance premiums might be offset with reduced fees required by  
provider who are able to assign support and monitoring duties to this  
support and insurance agency.  By allowing this agency to also monitor  
their networks, they might be able to increase profits by judiciously  
black-hole routing potential threats as needed.

> optimizations, and earns me nothing.

Which is also why the current Authentication-Results header is wrong  
headed.  It excludes the SMTP client IP address when assessing path  
registration authorization.  This header portrays the domain as an  
"authenticated" message source, and makes it appear as if the provider  
plays no role.

>> Once IPv6 opens the door to 340,000 decillion (10^33)  IP  
>> addresses, the granularity of evidence collection and blocking can  
> Oh please. There won't be 10^33 ip addresses involved. There are  
> only about O(nx10^9), n<10, people on the planet etc etc.

The concern is being misunderstood.  The number of IP addresses  
involved has little to do with the number bad actors.  For every  
address range listed, collected evidence will be needed.  Not only  
does the size of the zone file supported by various DNS servers become  
a concern, so are storage requirements for the evidence.   The process  
of establishing negative reputation assertions is not by the access  
provider permitting abusive traffic.  It is likely funded by list  
subscribers.  These list subscribers will not want to pay a fee  
increased by the resources needed to support the additional monitored  
space.

This might scale when done based upon registration and positive  
reputation.  One then needs some way to identify those registered, and  
hope registration fees are not required, or there may be conflicts of  
interest.   Even checking receipt of a postcard becomes expensive when  
abused.  What transaction system would be efficient at collecting the  
minor cost of mailing a postcard?

>     IF THEY CAN BILL THEM FOR A SERVICE THEY CAN MONITOR THEM.

Not okay.  Traditional list providers will be unable to bill those who  
are obtaining large numbers of IPv6 addresses. : ^(

> info before automatically enabling accounts (something we did) and  
> the attack after attack from those accounts being created at script  
> speed and the sanctimonious "you don't understand what marketeers  
> call friction, checking credit cards before enabling would  
> constitute unreasonable marketing friction, go read a marketing book".

Larger providers are not surrounding themselves in virtue, and neither  
are some of the various standards proponents.  :^(

> Until, I guess, those acts started attacking their own systems, then  

It was not an attack by their own network responsible for the  
change.   Black-hole listing abusive services helped provide the  
needed market incentive.

-Doug