Slashdot Log In
Bye Bye Spam and Phishing with DKIM?
Posted by
Zonk
on Thu May 24, 2007 05:35 PM
from the teflon-for-your-mailbox dept.
from the teflon-for-your-mailbox dept.
ppadala writes "While research from PEW Internet (PDF) shows that few users really are bothered by spam, IETF is supporting a public key cryptographic based e-mail authentication mechanism called DomainKeys Identified Mail (DKIM) Signatures . The new spec is supposed to help in fighting both spam and fraud. From Ars Technica: 'DKIM's precursor, DomainKeys, was originally developed by Yahoo. The specifications for DKIM were then extended by an informal group of IT organizations that included companies like Yahoo, Cisco, EarthLink, Microsoft, and VeriSign, among others. It was first submitted by the group to the IETF in mid-2005, but only recently published by the IETF. The spec is still to be incorporated into a more formal draft and submitted for approval, however.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Ah, yes the solution of the week (Score:2, Funny)
Re:Ah, yes the solution of the week (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(x) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Not a bad try, though. Usually way more crosses on the form.
Parent
Re: (Score:3, Insightful)
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers nope, requires no coop from spammers, however you're right in that it requires everybody else to sign up to it. Usually these systems are a pie-in-the-sky 'nice idea', but the difference here is the backing of a standards body which will help takeup. Hopefully, enough implem
Users are not bothered by spam? (Score:5, Interesting)
Parent
Better blocking, less bothered (Score:2)
Most users are on big consumer ISPs like AOL and MSN, and they do a good if nowhere near perfect job of blocking most of the spam, and they can usually recognize it from the titles and delete it without having to actually open it. And they're sufficiently used to getting *some* spam all the time that they actually see and delete, but to them it's just noise like TV commercials, not an offense like having their precious bodily fluids corru
Not a solution to spam. (Score:2)
Here we go again... (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(x) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
(x) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(x) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Re: (Score:3, Funny)
it can be informative
it is not that lame
It's only a server validiation solution (Score:5, Insightful)
Re:It's only a server validiation solution (Score:5, Insightful)
Parent
Re: (Score:3, Funny)
DKIM Lets ISP verify spamming-user complaints (Score:2)
An outgoing-email service provider that uses DKIM on all of their outbound mail can validate that a spam or abuse complaint about mail purporting to be from exampleuser@their-domain.com really was from that user and not a forgery, so they can kill off that user's account without worrying about false positives or faked complaints or joe-jobs. They can read the message text to see that it's spam, and they c
Re: (Score:2, Insightful)
OK, the message comes from Hotmail, Mail.com, Yahoo, etc. It's deemed by DKIM to be authentic, yet it is still spam (albeit authenticated spam). All DKIM, and similar solutions, does is to to prevent message and header manipulation in transit. If Yahoo, Mail.com, and Hotmail still allow spammers to sign-up for accounts how does DKIM solve the problem? At best, with full adoption, DKIM can show the world, authentically, who is sending spam. But, you still have
Re: (Score:2)
Re: (Score:2)
DK tells me that the mail message actually belongs to the domain and its mail server. Its not user to user but rather server to server (a server validating a server's output). It also doesn't use a CA or other notary, it uses a dns record.
few users (Score:5, Insightful)
Dunno about anyone else, but as the admin for our company, I get more complaints about spam than anything other single item I can think of...
Re:few users (Score:5, Informative)
The ISP of one of my clients just turned on 'greylisting' and their mail volume dropped 71%, knocking their spam % down to 11% of their new volume.
They would rather spend the budget on stopping spam rather than upgrading their servers. It's that big of a problem.
DKIM will help (until fake 'certificates' show up) but it won't solve the problem. Only flame-throwers, and lots of them, will fix this once and for all.
Parent
Re: (Score:2)
Will my ISP Quit Blocking Port 25, Finally? (Score:2)
Because keeping me from running a mail server has not done a damn thing to the spammers.
I'll believe in an anti-spam tech when it comes in the Debian repository and I can once again run a mail server. Until then, I'm afraid the spammers will be the first to sign up for any counter measure.
Re: (Score:3, Insightful)
If they "protect" your port 25, they are morons, and you should complain or switch the ISP. If they are blocking your attempts to reach other people's port 25, they should be commended.
Your system may be immune, but hordes of "zombies" would be sending spam from your ISP's network. As things stand, the zombies are still infected, but can not send e-mails directly to victims, which throttles the rate a lot.
You can still run a server — just configure your
Re: (Score:2)
Re: (Score:2)
Shit, what is your ISP? I want some!
I've got Verizon DSL right now, and 1) they block port 80 inbound (they turned it off for that big worm, and never turned it back on), and 2) they're very lame.
Re: (Score:2)
Unfortunately it's still a problem with the ISPs who don't let you send out email through their servers unless the Reply-To address is within their domain. I haven't run into this recently, so maybe it's only a feature of the very low-end dialup ghetto, but I definitely ran into it once or twice.
This is a serious issue, if it occurs together with the blocking of outgoing connections on Port 25, beca
This is bullshit and I'm tired of hearing it. (Score:2)
If they are blocking your attempts to reach other people's port 25, they should be commended. Your system may be immune, but hordes of "zombies" would be sending spam from your ISP's network.
This has already failed and failed miserably. There are hordes of zombies sending spam from my ISP's network. They all do as you recommend and use the ISP's SMTP server and this is why more than 80% of all spam comes from zombies. My upload is also capped by my cable modem at a pathetic 60 kB/s.
A better method
Re:Will my ISP Quit Blocking Port 25, Finally? (Score:4, Interesting)
If an IP address makes more then X connections to my SMTP port at the same time it gets routed to a teergrube.
If an IP address attempts to send email to Y number of invalid users it gets routed to a teergrube.
If an IP address sends me Z number of spam as marked by spamassassin it gets routed to a teergrube.
If an IP address is on the RBL of my choice it gets routed to a teergrube.
And of course a teergrube which can handle a few hundred simultaneous connections and keep them busy for hours.
If we all had all this then at least we could make a dent in the amount of spam going out.
Parent
I take a slightly easier solution. (Score:2)
If rDNS resolves to Comcast's home addresses (and other ISP's), drop it.
If rDNS resolves to Comcast's (HotMail's, GMail's, AOL's, etc) mail servers, run it through SpamAssassin and drop it if it scores above 8. (HotMail has a problem with this because they add mortgage spam to their outbound messages).
Okay, that should have taken care of 90% of the problem.
Re: (Score:2)
Upon random checks of spam lately, most of it is coming from IPs with valid A/PTR records that are also mail servers. Botnets still exist, but I think spammers are
Re: (Score:2)
Re: (Score:2)
yahoo press release (Score:4, Informative)
It also has some nice background information on DKIM.
--Robert
Re: (Score:2)
On the other hand, if spammers are authenticating with a real domain, then filtering based on RBLs just got easier...
Also, exim guys - we could really use MT
Prefer SPF (Score:2, Interesting)
No Microsoft, SPF is protecting 8 million domains. Nobody publishes SenderID records, you are misrepresenting the intent of millions of domain holders to claim otherwise! What's worse is that the whores in the IETF working group were complicit in this misrepresentation and have the audacity to blame the SPF guys.
I was looking into DKIM earlier
Re:Prefer SPF (Score:4, Interesting)
I believed in SPF about three years ago, but it became very clear that it (and Sender ID too) wouldn't do a damn thing, and Domain Keys seems no different.
Parent
Re: (Score:2)
Now admittedly, I don't have users that want to be outside our network and send mail as if they are inside our network. This is a problem I expect a huge corporation (or like you say in another post: an ISP) might have. But for every small business (or even medium sized business or agency), I'd think it would be SOP.
I guess I don't see the downside to p
Re:Prefer SPF (Score:4, Interesting)
I adopted SPF on the domains I ran early on too, not because I thought it would do a damn thing, but because I didn't want to get screwed by some anal-retentive at RoadRunner who decided to start blocking everything that didn't come from an SPF-record holding domain.
SPF, SenderID and DomainKeys probably could have a good deal more success if they were more widely adopted, but they still wouldn't stop some of the big sources of spam. Even with that in place, the mail system is still vulnerable. We were getting such a high volume of distributed dictionary attacks at the place I worked at that we literally had to hide our mail server behind some Postfix proxies which did nothing more than reject hundrds of thousands (and some days millions) of individual attacks per day.
Parent
and the winners are (Score:2, Funny)
is it time to buy shares ?
Sooooo close... but not going to work. (Score:5, Insightful)
My initial thought was "Terrific. This really has the potential to eliminate spam." Then I got to looking into the RFC... standard private/public key exchange. But, it allows for individual MUAs to posess the private key, such that they can perform the signature.
This puts the entire burden of security in the scheme upon the MUA. So any time a machine is infected with the spam-virus of the day, that private key will be sent off to the spammers, who will send out floods of seemingly legitimately-signed email. Instead of just selling valid email addresses to other spammers, they'll sell addresses and domain keys.
Furthermore, from an administrative perspective, that means that each time one of your user's machines is hacked and the private key compromised, you have to change your public/private keypair, including updating the MUA on *all* of your sender's machines.
Forcing signing upon the MTAs eliminates much of that work (and hopefully the security exposure), but forces inconvenience on a good number of users. It's a tradeoff I'd be willing to make, but the RFC doesn't seem willing to do so.
Re:Sooooo close... but not going to work. (Score:4, Informative)
The problem with spam is that it isn't just an email problem. If it was, then we'd all have had this beat a long time ago.
Parent
Re: (Score:2)
DKIM allows a domain admin to create a hierarchy of authorized keys. So each MUA can have it's own key-pair .
I am trying DKIM (Score:2, Interesting)
1) There's still no way of saying "my domain always signs email with DKIM, so no signature means forged mail". At least I couldn't figure it out.
2) Mailing lists add a footer which messes with the signature.
As a consequence DKIM at the moment is completely useless since even though all my emails are signed, spammers/phishers can simply not put the DKIM signature and DKIM wouldn't know if the email was forged or not.
Furthermore, DKIM is reporting that a lot of valid emails posted
Only two ways this can go (Score:2)
Either the domain owner controls and administers the key, in which case spammers (who already use automated bots to registers hundreds, if not thousands, of domains per day) will simply add a new subroutine to the domain registration bot to add in the key, thus ensuring the delivery of their spam.
Or someone else controls your email, which mean nobody with any sense will buy in to it.
Either way, it's useless for combatting spam, as was DomainKeys and SPF.
Metric on number of responses to spam (Score:2)
These figures are interesting because there is often speculation about these numbers during conversations about the financial viability of being a spammer. The article suggests that these figures are "low" but they are much higher t
The reason why I don't use DKIM or recommend it (Score:2)
explode button (Score:3, Funny)
Re: (Score:2)
You're absolutely right. Until near-certain death is the consequence of spam, there will be spam. No technology will prevent that.
barking up the wrong tree (Score:3, Interesting)
Re: (Score:2)
Oh, and remember: address@example.com is a better choice for email addresses used in examples, as it uses one of the reserved domains from RFC2606 [faqs.org].
I still like HashCash better (Score:2)
How come these guys never realize that if a scheme can't stop bots, it's worthless. Also, all these fancy schemes are bound to fail because they try to make fighting spam the lever to get
Have the client do the calculation (Score:2)
Re: (Score:2)
click [mailto]
Hmm, good, except that at some point you will have to enter your pass code (the "Do_not_edit_this_subject_line_or_I_won't_receive_ your_email!" part) into a website so that the website can e-mail you, and then all the spammers have to do is build a database of addresses paired with codes.
So, your solution will work fine until a significant number of people are doing it and the spammers learn about it.