Subject: Re: Latest spammer trick I've seen, and I absolutely hate it.
From: Ned Freed <[email-masked]>
To: Arnt Gulbrandsen <[email-masked]>
Cc: [email-masked]
Date: Sun, 06 Sep 1998 17:21:26 -0700 (PDT)

> I got a message from [email-masked] just now, saying that "my
> request" was syntactically invalid.  Here's the headers of "my
> request".

> > ...

> Do spammers do this all the time - using other people's real, valid
> addresses?

You've been lucky; spammers have been doing this sort of thing for years.

> Has there been any progress on SMTP authentication drafts? 

There has been tremendous progess, both in terms of developing secure
message formats as well as SMTP authentication services.

Both the S/MIME and PGP groups met at the Chicago IETF and both groups are
nearing completion of their work. See
http://www.ietf.org/html.charters/wg-dir.html for information on and the status
of these groups.

There was an informal meeting at the Chicago IETF to discuss the SMTP AUTH
draft. But this is not the right list for such discussions; the right list is
the ietf-sasl list hosted, I believe, by imc.org.

> Last I saw was a kind of nice server-/gateway-based thing by Donald Eastman.

I suspect you are referring to MUSE, which was written by Donald Eastlake.
AFAIK MUSE is dead. There is, however, a gateway security draft I've written
that is similar and which was discussed at the MailRev BOF at the last IETF. A
new version of the draft should be out soon and it will then be last called:
draft-freed-gatesec-03.txt.

> Is it (or anything else) moving towards production use?

Both S/MIME and PGP have been in production use for some time now. However,
unless and until use of such services is nearly universal they won't
offer much hope of solving the spam problem.

SMTP AUTH is certainly useful as a part of some relay blocking setups. We're
now seeing rapid deployment of this in both clients and servers, although there
is still some standards work to be done here. And while this service
can in some local setups prevent certain kinds of forgeries, it is again
no solution to the general spam or forgery problem.

				Ned

To: [email-masked]
Subject: Latest spammer trick I've seen, and I absolutely hate it.
From: Arnt Gulbrandsen <[email-masked]>
Date: 07 Sep 1998 01:45:14 +0200
Lines: 23
Sender: [email-masked]

I got a message from [email-masked] just now, saying that "my
request" was syntactically invalid.  Here's the headers of "my
request".

>From [email-masked]  Sun Sep  6 19:26:11 1998
>Received: from www16.web2010.com (www16.web2010.com [209.25.53.1])
>	by thegate.gamers.org (8.8.5/8.8.7) with ESMTP id TAA09059
>	for <[email-masked]>; Sun, 6 Sep 1998 19:26:10 -0400
>From: [email-masked]
>Received: from pavilion.pavilion.net (dialup-04.intecnet.net [207.0.31.195]) by www16.web2010.com (8.8.5/8.6.9) with SMTP id TAA19283; Sun, 6 Sep 1998 19:25:18 -0400 (EDT)
>Date: Sun, 6 Sep 1998 19:25:18 -0400 (EDT)
>Message-Id: <[email-masked]>
>To: [email-masked]
>Subject: YOUR  CLASSIFIED - AD / 333  NEWSPAPERS  !!!!

Do spammers do this all the time - using other people's real, valid
addresses?

Has there been any progress on SMTP authentication drafts?  Last I saw
was a kind of nice server-/gateway-based thing by Donald Eastman.  Is
it (or anything else) moving towards production use?

--Arnt