[Glyph-discuss] meta spam

Allen Short glyph-discuss@twistedmatrix.com
Fri, 15 Nov 2002 16:27:48 -0600 (CST)


----Security_Multipart(Fri_Nov_15_16:27:48_2002_704)--
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

>>>>> "Glyph" == Glyph Lefkowitz <glyph@twistedmatrix.com> writes:

Overall I think this is a great idea; my email's characteristics are
very amenable to whitelisting, but i haven't done it due to lack of
#1. :)

    >    1. Your "main" email address always bounces messages.  The
    > bounce goes something like this: "Hi!  This is the first time
    > you've sent mail to glyph@no-spam.com.  Please visit
    > http://no-spam.com/email/glyph and enter your authentication
    > info here."  On that URL is a fairly simple non-machine-readable
    > image with some pseudo-random noise on it that makes it dirty
    > enough that OCR doesn't work, and a text-entry field.  The user
    > is prompted to copy the sequence of letters and numbers into
    > that field, proving that they are in fact a person.

Note that making OCR not work may be harder than it sounds, as the
e-gold folks found out: they used a similar scheme to discourage
attacks on e-gold accounts. 
http://www.mail-archive.com/e-gold-tech@talk.e-gold.com/msg00415.html
However, it wasn't long before someone wrote a little tool to de-fuzz
their images: 
http://www.interestingsoftware.com/alanbot/

Which is not to say it's a useless idea, just that it will require
thought. :)

    >    2. Every user that goes through this approval procedure gets
    > a different semi-secret email address for you.  So, you don't
    > send email to glyph@no-spam.com, you send email to
    > x884nfygj2@no-spam.com.  Assuming you have a semi-sane
    > addressbook client-side you can't tell the difference: you just
    > type "glyph" and it works.  This means that there is sanity
    > checking, and spammers can't simply discover either an address
    > that sends mail to you or an email address you have listed: they
    > have to match them up.

I've already done a version of this (by adding entries to
/etc/aliases) for times i wanted to receive mail from a site exactly
once; i suppose this is a version of revocable capabilities.

    >    3. There is one exception to the main-email-address bounce:
    > any message that is correctly signed by a PGP key that a
    > trust-path can be calculated to automatically gets through.

The other thing to do for migration would be "add everyone who has
sent me mail to my whitelist" -- though i suppose that's less useful
for people who actually delete their mail after a while.

    <snip>
    > This is similar to the problem with virus-protection software.
    > Most people with a clue about computer security know that the
    > fact that viruses exist is largely due to problems with the
    > operating system.  The operating system manufacturers don't have
    > an economic incentive to fix the OS: that's not what people pay
    > them for.  They get paid on the basis of features and network
    > effects, not security.  The reason that Linux is generally more
    > proof against viruses than Windows owes more to the weakening of
    > these economic effects than any real benefit to the system's
    > design.

Well, i'm not sure that's entirely true, the Mac and various unixen
have been realtively unaffected by viruses, compared to Windows, part
of which i'd attribute to better design, part of which i'd attribute
to unpopularity. :) However, it has long been believed in some circles
that some virus authors are funded by antivirus software purveyors.


    > In both cases, a group of experts is profiting by creating large
    > databases about a problem and selling the database, rather than
    > fixing the problem.  On the face of it, that might sound
    > fraudulent, but can you really blame them?  Creating a real
    > solution would instantly devalue all of their expertise, and
    > they would have to find other jobs.  In fact, the people with
    > the expertise to really fix the problem are probably employed by
    > an industry that works under this economic model, so there's no
    > way for them to develop a real solution and get their company to
    > accept it.

go pacifism, er, i mean, decentralization!


    > And now back to the code-mines for me.  I really didn't have the
    > time today to write this email :-)

*whipcrack* go!


----Security_Multipart(Fri_Nov_15_16:27:48_2002_704)--
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA91XToEd6n5DRBYM4RAtwdAJ9wpVaWJLPuvs9YhOG0rpVZWhsMJACfamIW
NqXQF4g7fLmRvp5jZiPLhMY=
=LCtN
-----END PGP SIGNATURE-----

----Security_Multipart(Fri_Nov_15_16:27:48_2002_704)----