Subject: RE: [SPAM] Re: Disposing of spam

From: "bill" <[email-masked]>
Date: Sun, 8 Feb 2004 16:33:59 -0800

Strange all three of those can be covered by simply joining the mailing
list...

The addition of sending along 1024/4096 random ones and zeros doesn't
seem to add any security to the process

Bill

I am training for my first endurance event... and SAVING lives click
here to find out more!
http://www.teamintraining.org/participant/strahm-163543

-----Original Message-----
From: Tony Li [mailto:[email-masked]] 
Sent: Sunday, February 08, 2004 2:10 PM
To: bill; Eastlake III Donald-LDE008; [email-masked]
Subject: RE: [SPAM] Re: Disposing of spam

Bill,

The benefits are straightforward:

1) All spam that is not signed by a known key can be immediately
rejected.
2) All messages that are signed can be forwarded without any
probabalistic
   check, thereby avoiding any complaints of censorship.
3) The rate of mailing list joins is, in my experience, quite low, and 
   there are techniques that folks have been developing that make it 
   difficult for automated processes to complete a message exchange.
This
   can be used to help automate the mailing list join processing.

Tony

|  -----Original Message-----
|  From: bill [mailto:[email-masked]]
|  Sent: Monday, February 09, 2004 5:18 AM
|  To: Tony Li; 'Eastlake III Donald-LDE008'; [email-masked]
|  Subject: RE: [SPAM] Re: Disposing of spam
|  
|  
|  I don't think this does what you think it does.
|  
|  Who is the signature tied too - some anonymous person that
|  can generate
|  a RSA public key right.  Well what have we gained with this over "The
|  user must subscribe to the list to post messages".  I claim 
|  not a whole
|  bunch - maybe 5 seconds of spammer CPU time (and don't 
|  forget they are
|  all ready posting those silly jpg images elsewhere to get 
|  access to the
|  contents)
|  
|  Signing e-mail doesn't solve the problem without a way of converting

| those ones and zeros into someone that you can make a legally binding

| contract with (i.e. If YOU send a signed spam message - I  can get 
| some  money from you) and spammers are notoriously good at being 
| anonymous
|  
|  Bill
|  
|  I am training for my first endurance event... and SAVING lives click

| here to find out more!  
| http://www.teamintraining.org/participant/strahm-163543
|   
|  
|  -----Original Message-----
|  From: [email-masked]
|  [mailto:[email-masked]] On Behalf
|  Of Tony Li
|  Sent: 
|  Saturday, February 07, 2004 12:04 AM
|  To: Eastlake III Donald-LDE008; [email-masked]
|  Subject: RE: [SPAM] Re: Disposing of spam
|  
|  
|  
|  
|  Might I make a suggestion: require each mailing list member
|  to submit a
|  public key to the list maintainer.  Only signed 
|  messages would be forwarded.
|  
|  This differs from other proposals because there is no need
|  for a central
|  key registry, it is a constant overhead per mailing list member, and
|  should stop the spammers quite cold.  The maintenance of such public
|  keys could be automated along with mailing list membership.
|  
|  Tony
|  
|  
|  
|  
|

---

From: "bill" <[email-masked]>
Date: Sun, 08 Feb 2004 22:14:09 -0500

Bill,

Unfortunately, as this email shows, simply joining the mailing list is
not sufficient to stop spammers.  Any spammer could perform the same
thing that was done to this email and bypass the "subscription check"
by simple from-address forwarding.  Such attacks are done every day,
and they work all too well.

Those 1024-4096 random ones and zeros would definitely prevent that,
because the spammer could not know the key you used when you
registered for the list.  It raises the bar to spamming a list.

I'll be happy to explain this to you in Seoul.

Have a nice day,

not-bill.  :)

---

From: "Tony Li" <[email-masked]>
Date: Sun, 8 Feb 2004 14:10:02 -0800

Bill,

Tony

|  contract with (i.e. If YOU send a signed spam message - I 
|  can get some
|  money from you) and spammers are notoriously good at being anonymous

---

From: "bill" <[email-masked]>
Date: Sun, 8 Feb 2004 22:53:20 -0800

Yes, but if they are willing to go through this hoop to find a
subscriber, what is stopping them from sending along their 4096 bits -
becoming a valid subscriber long enough to send their spam along (all
nicely signed mind you) and proceeding along.

The nice part is they can probably put up a website that lets people see
porn if they give matching public/private keys so they can generate them
as needed in as large of a quantity as needed.

So as I said - throwing along an additional 4096 bits of keying material
won't help the spamming problem at all... It might help the
impersonation problem - but that is easy enough to track without the
keys - especially with message headers that don't point back to where
you would expect them too.

I will explain this all nicely to you when we meet next (This isn't a
technical problem - it is a business problem, all of the fancy ones and
zeros won't help - especially when they are expensive ones and zeros)

Bill

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Sunday, February 08, 2004 7:14 PM
To: bill
Cc: 'Tony Li'; 'Eastlake III Donald-LDE008'; [email-masked]
Subject: Re: [SPAM] Re: Disposing of spam

Bill,

Unfortunately, as this email shows, simply joining the mailing list is
not sufficient to stop spammers.  Any spammer could perform the same
thing that was done to this email and bypass the "subscription check" by
simple from-address forwarding.  Such attacks are done every day, and
they work all too well.

Those 1024-4096 random ones and zeros would definitely prevent that,
because the spammer could not know the key you used when you registered
for the list.  It raises the bar to spamming a list.

Have a nice day,

not-bill.  :)

"bill" <[email-masked]> writes:

> Strange all three of those can be covered by simply joining the 
> mailing list...
>

> |  Who is the signature tied too - some anonymous person that  can 
> | generate  a RSA public key right.  Well what have we gained with 
> | this over "The  user must subscribe to the list to post messages".  
> | I claim  not a whole
> |  Signing e-mail doesn't solve the problem without a way of 
> | converting
>
> | those ones and zeros into someone that you can make a legally 
> | binding
>
> |  I am training for my first endurance event... and SAVING lives 
> | click
>
> | here to find out more!
> |  From: [email-masked]  [mailto:[email-masked]] On 
> | Behalf  Of Tony Li
> |  Sent: 
> |  Might I make a suggestion: require each mailing list member  to 
> | submit a  public key to the list maintainer.  Only signed
> |  This differs from other proposals because there is no need  for a 
> | central  key registry, it is a constant overhead per mailing list 
> | member, and  should stop the spammers quite cold.  The maintenance 
> | of such public  keys could be automated along with mailing list 
> | membership.
> |  
> |  Tony