Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Spam Privacy

Building A Better Inbox (Updated) 372

Posted by timothy from the and-a-smaller-outbox dept.
vudujava writes "c|net is reporting that a new free (Update: not free, actually, read more for details.), web based email service is opening it's doors today. They promise to deliver "100% spam free" email to their users by using a challenge-response system to all incoming, first-time mail. Catch the entire story here. Although the idea isn't new, it shows that we are notching up the "war on spam"." Alert reader George Hotelling points out this post on Politech which may give you pause when it comes to the new mail service's Terms of Service. And kraksmoka writes "As reported on this article on MSNBC : 'Hotmail subscribers are now limited to sending only 100 messages a day "in an effort to prevent spammers from using Hotmail to spread spam," said Lisa Gurry, MSN lead product manager.'"
dlanod writes "In your snippet on the main page you report mailblocks.com as "a new free, web based email service". Looking at Mailblocks' site, it actually costs $9.95/year for the standard service, or $24.95/year for the expanded service with no free option listed (https://app1.mailblocks.com/register.htm)."
This discussion has been archived. No new comments can be posted.

Building A Better Inbox (Updated) More

Building A Better Inbox (Updated)

Comments Filter:

  • Definitely not new (Score:5, Informative)

    by jbellis ( 142590 ) <jonathan@carDEBI ... com minus distro> on Monday March 24, 2003 @03:44PM (#5585115) Homepage
    I've contributed code to TMDA [tmda.net], a python implementation of this idea that's been around for over two years. The earliest I know of though is a C implentation called mapson. It was abandonware for a while, but it's apparently been resurrected on sourceforge. I _think_ the original version dates from the '90s.

    BTW, mailblocks.com isn't free; it's $10/yr. However, that's still only half what fastmail.fm charges annually for their spam filtering service (with SpamAssasin).

    • Question. (Score:2, Interesting)

      by Anonymous Coward
      TMDA looks interesting, I'll have to check it out. But what happens when a person using a TMDA-protected email account attempts to contact someone else using a TMDA-protected email account?

      What's to stop there being a cascading ping-pong of confirmation messages? (Or are you supposed to automatically whitelist everyone you send email to?)

      • Re:Question. (Score:5, Insightful)

        by pohl ( 872 ) on Monday March 24, 2003 @04:00PM (#5585263) Homepage
        I've wondered about that too. You could always manually add the person to your whitelist before you send the initial message.

        What I'm wondering about is how you would buy something online where you can't really predict the address that shipping-confirmations will come from. In that case one wouldn't know what to add to the whitelist, and the odds of a human being on the other end are small...so your TMDA message would probably go ignored.

        Is there a good FAQ somewhere that addresses questions like these?

        • SpamGourmet (Score:5, Informative)

          by Penguinoflight ( 517245 ) on Monday March 24, 2003 @04:35PM (#5585511) Journal
          This is exactly what spamgourmet is useful for. Spamgourmet is free, and forwards messages to your "real" address, but only as many as are specified by the address. To use Spamgourmet, you first become a member with a single user address, however you can add "sub-addresses" in a similar way to subdomains, starting with just a lame label, then a number of MAX emails to be accepted at this alias, then the username.
          ,br> for example, if you wanted to get a confirmation from newegg.com, but didn't trust their mailing list... you could simple fill in newegg.3.joecool@spamgourmet.com. this would give them a max of 3 emails, 1 for billing, 1 for shipping, and 1 for whatever is bound to go wrong.

          Try it out today at spamourmet.com [spamgourmet.com]

        • Re:Question. (Score:3, Informative)

          by netsecd00d ( 655384 )
          With TMDA you can make a 'dated' address which would allow anyone who uses that address to send you an email for a certain amount of time.
          Example from http://tmda.net/config-client.html [tmda.net]

          jason-dated-989108708.a17f80@mastaler.com

          This particular address expires on Sun, May 6 00:25:08 2001 UTC, which is exactly 5 days after it was generated. TMDA time intervals can be set in years, months, weeks, days, hours, minutes, and seconds. Once a dated address expires, messages sent there must go through the confi
    • But Fastmail.fm allows me to use subdomain addressing. All email sent to *@username.fastmail.fm gets delivered to username@fastmail.fm.

      So I give out the address "amazon@username.fastmail.fm" to amazon (just to randomly pick on someone). If I get spam at that address, I add a rule to automatically delete all email coming into that email address. Plus, I can go to amazon and tell them that I KNOW they sold me out, as I only gave out that address once. That is very worthwhile to me.

      If $20/year for a quailty
    • I think what needs to happen to kill spam is this:
      • Some group of ISPs implement a TDMA-like system.
      • An ISP or other mail server can have mail from its users automatically approved (not go through the hassle of responding to a challenge) if it signs a contract that binds it to certain anti-spam rules.
      • Outgoing mail from these ISPs (or even individual users) is cryptographically signed so that it can be recognized as non-spam and any violations traced.
      • It is still SMTP, so these messages can go to non-partici

  • UN resolution #4882372 (Score:4, Funny)

    by Anonymous Coward on Monday March 24, 2003 @03:45PM (#5585118)
    This undeclared "war on spam" is unauthorized imperialist aggression!

  • Not Free! (Score:5, Informative)

    by MiTEG ( 234467 ) on Monday March 24, 2003 @03:45PM (#5585120) Homepage Journal
    Mailblocks is not free! They charge [mailblocks.com] either $9.95 or $24.95 a year depending on the file size limitation you choose.
    • erm.... well, hopefully they 'garentee' that '100%' spam free claim...

      i figure, if i spend 10 minutes on the phone yelling trying to get them to deliver on their garentee and give me a refund, it'll even out to the time i spend deleting messages each year.

  • Call It A Night, Cowboy! (Score:5, Funny)

    by sulli ( 195030 ) on Monday March 24, 2003 @03:45PM (#5585123) Journal
    Because limits on posts work so well for the slashdot trolls.

    Seriously, who spams from Hotmail anyway? Don't all the real spammers use custom software with a built-in smtp server? I've gotten enough spams advertising it, after all.

    • You can spam from hotmail without using the web-client, since it has an interface for using /w outlook etc (http mail still though I think).
      However, I myself don't get many *hotmail* spams, and many which I do are forged headers and not real hotmail addresses.

      Limiting regular customers to emails-per-day actually sounds like a really good idea to me, so long customers sending mass mail (usergroups, proper mailing lists, etc) were able to sign up for a "special account" allowing them to continue. I don't k
    • Don't all the real spammers use custom software with a built-in smtp server? I've gotten enough spams advertising it, after all.

      That just proves that spam does not work! Not even the spammers are using the software sold using spam.
    • Domains in today's batch of spam:

      yahoo.com (3)
      hotmail.com (2)
      earthlink.net (1)
      popstar.com (1)
      hot-shot.com (1)
      ayna.com (1)
      voile.net (1)
      bigfoot.com (1)
      mindless.com (1)
      amexmail.com (1)
      forum.dk (1)
      servadmin.com (1)

      Some of those are faked, of course, but it would seem that a lot of it comes from free providers.

      (And thanks to SpamAssassin, none of that made it to my inbox)
      • You can't make any claim about coming from free providers with what you posted.

        Post the owners of the IP that these were received from and how many of *those* were from (intentionally) free providers?

  • Yahoo (Score:5, Informative)

    by SpamJunkie ( 557825 ) on Monday March 24, 2003 @03:46PM (#5585132)
    I've been using yahoo mail for a while now and it is virtually spam free. The built in filter is great. Occasionally one makes it into my inbox, we're talking one every two or three days, otherwise they pile up in my bulk mail folder.

    It's so good I paid for a year of mail plus. I didn't even do that for .Mac and I'm a os x geek.

    • Re:Yahoo (Score:4, Informative)

      by Jens_UK ( 615572 ) on Monday March 24, 2003 @04:00PM (#5585261) Journal
      The built-in filter is far from perfect. Currently, I am getting loads of messages with just a single image routed to my inbox, rather than the bulk mail folder. Thankfully, Yahoo! does let you block images, so it doesn't load them and confirm your address. Newer accounts (eg., family members) seem less prone to this, perhaps because their addresses haven't been out in the wild as much yet.

      For conventional text spam, the filters are decent and route most to the bulk mail folder.

    • Re:Yahoo (Score:2, Interesting)

      by Malc ( 1751 )
      It's not perfect, but it is fairly good. I would say it blocks greater than 90% of spam. I was impressed enough that last year I paid them money for the service. I use their automatic SMTP forwarding, and filter on the header X-YahooFilteredBulk. I personally wish they would just block everything they tag rather than forward it to me, but oh well. At some point I'll stop using my Yahoo address and just stick to unique aliases on the domain I own. After so many years of using my Yahoo address, I'm just

    • Re:Yahoo (Score:3, Informative)

      by Ratbert42 ( 452340 )
      I have 4 addresses forwarding to Yahoo. One (a bigfoot account) is at least 6 years old. For me, Yahoo's spam filter blocks about 40-60% of incoming spam and about 5% of legitimate incoming messages. So it's essentially useless for me.

    • Re:Yahoo (Score:3, Interesting)

      by civilizedINTENSITY ( 45686 )
      I average closer to 10 spams/day @yahoo.com. Whats more of an issue is that their spamblock sends IBM DevloperWorks and movingon.org emails into the bulk mail folder. I've sent these to yahoo for "review", where they should realize that 1)I've signed up for these notifications, and 2) Its easy to opt-out. Repeated "reviews" still result in spam in my inbox and real email in my bulk folder. Which means I can't just delete everything in the bulk folder. Since I have to look at all the headers first, whats

      • Re:Yahoo (Score:3, Interesting)

        by maxume ( 22995 )
        Not a huge fan of yahoo myself, but I do believe that they still let you have a few filters, even without paying. Yep, just checked it, click on Mail --> Options. Select filters, figure out a way to send the stuff you want to your inbox, no more digging through Bulk Mail.

        Also, I don't really think that sending a mail for 'review' gets a pair of human eyes, but more is more likely combined with other submissions and used to adjust filtering techniques and training...

  • Stupid (Score:5, Interesting)

    by transient ( 232842 ) on Monday March 24, 2003 @03:47PM (#5585135)

    Um, so let me get this straight. They challenge all incoming mail except for the spam they've been paid to let through? And this is an "inseparable" part of the service?

    Next, please...

  • Yeah, this system was invented by SolidBlue (Score:5, Informative)

    by Ace905 ( 163071 ) on Monday March 24, 2003 @03:47PM (#5585136) Homepage
    It really pains me to see the amount of competition *and* press coverage our competitors are getting.

    We invented this system for authenticating email, and we've had a product on the market for 2 years now making use of it.

    We have the most affordable service available still. It's one thing for competitors to realize our idea is the solution - it's another thing for the media to ignore the origins of the system completely.

    • you invented this? not. (Score:5, Insightful)

      by jbellis ( 142590 ) <jonathan@carDEBI ... com minus distro> on Monday March 24, 2003 @04:02PM (#5585278) Homepage
      you invented this idea the way al gore invented the internet. :(

      as I posted earlier, mapson predates any commercial implementation I have seen. I downloaded version 1.0 to doublecheck -- unless yours was written before 1997, or you employ Peter Simons, I'm afraid your claim to being the first doesn't hold water.

      mailblock at least doesn't claim originality, just that they do it better. which may be true; they have a pretty slick "mail siphon" feature going.

      • Re:you invented this? not. (Score:4, Interesting)

        by Ace905 ( 163071 ) on Monday March 24, 2003 @04:07PM (#5585317) Homepage
        Our white paper on the system was published in November of 2001. A challenge-response based system has existed for longer on web sites to prevent automated submissions.

        To offer the system for email requires a more advanced server-client architecture, overcoming challenges such as "what if both systems require authentication" to ensure that Spam still can not get through a 'hole' for this scenario, and finally: The actual challenge-response is being done wrong by almost all of our competitors. A simple dictionary attack could authenticate a spammer for their entire user list.

        We're the longest running email-authentication project (obviously, since we did invent it) and we have a very large list of improvements planned for the system. I suspect these other companies, which publicly lie about trade mark, patent and copyrights to the system (that have never been registered) will take our new ideas and claim to own them as well.

        Only time will tell.

        • I cite a specific example of a challenge-response system for authenticating email dating from 1997, and you reply that since you started in 2001 you are the longest-running.

          way to refute me, champ.
          • From the Mapson web site.

            "Every time you receive an e-mail, mapSoN will look-up the sender's e-mail address in a small database file and check whether that address is in there. If it is, the mail is delivered to your mailbox, but if it is not, the e-mail will be stored in a spool directory in your home, using a cryptographic cookie as the filename. Then mapSoN will send a so called request for confirmation to the sender's address, asking him to please confirm his addresses validity by replying and sending

  • Internet Explorer Centric (Score:4, Informative)

    by pheph ( 234655 ) on Monday March 24, 2003 @03:47PM (#5585137) Homepage
    When I go to sign up using Mozilla on Linux, I get a JavaScript pop-up that reads:

    "Mailblocks may work with other browsers, but it is only tested using Internet Explorer"

    Anyone tested using other browsers? This sort of thing was never anticipated when people were excited about the Internet...

  • These services won't work for many of us. (Score:5, Informative)

    by matt[0] ( 12351 ) on Monday March 24, 2003 @03:48PM (#5585154) Homepage Journal
    I own a small business and much of my client correspondance is via email. That means, I have to run my own IMAP server and I have 200 mb of mail on the server.

    Someone would do well to offer this service with your own domain (if you change your MX record), IMAP and reasonable charge for each 50mb increment of disk space. This is yet another web mail service, only this one is hosted off of a MSFT server and it implements intrusive spam blocking. SPAM Assasin works very nicely, I've found.

    *yawn*
    • Try looking looking into postini [postini.com]. You slip your primary MX records through them, leaving backups for direct access. And thir spam filter will quarantine for up to 14 days. Lock your mailserver against direct access (only accept mail via MX routing) and boom, you are set, per mailbox pricing isn't bad but I can't quote our rate, it is under $1/month/mailbox though.

  • Now this is what I prefer to see... (Score:5, Insightful)

    by questamor ( 653018 ) on Monday March 24, 2003 @03:50PM (#5585161)
    ...rather than government legislation. It doesn't matter how much one country's government may ban spam, if it still comes from outside it's still going to come in time and time again.

    This setup may not be perfect, but to me it's a step in the right direction. Working towards a system that doesn't allow spammers to exist is wholly more admirable.

    --

    Curiously, why were open relays ever in existence? And once spam started, why were open relays kept around? Is there a use for them? Why not have all mail servers require authentication for outgoing mail, much like POP retrieval. That would have to stop a great deal of spam
    • I don't know the history of open relays, but I do know that I worked for a hosting company that tried unsucessfuly for almost a year to secure the mail server(s). When we finaly did get it set up, it was a support nightmare. People didn't read the emails that we sent explaining the new system and were freaked out when it was trying to authenticate them when they were sending. An important side note is that these were all nt4 boxes.....I suppose that was most of the hassle, but still, all it takes to buy
    • This setup may not be perfect, but to me it's a step in the right direction. Working towards a system that doesn't allow spammers to exist is wholly more admirable.

      The spammers will just build an automated response system. Plus, this thing could no be used as a source for a DOS attack, since its happily generating emails. And god help us if they ever decide they need to sell their "contact list to be profitable, since to work it must have a list of every person who might email you. And hopefully they've

      • The spammers will just build an automated response system.

        Good. I'd love it if they did. That way, we'd have a "good" return address with which we could track them down. Right now, I'll bet a very large percentage (approaching 100%) of U[B|C]E has a fake return/from address.

  • This seems... (Score:5, Insightful)

    by Shant3030 ( 414048 ) on Monday March 24, 2003 @03:50PM (#5585163)
    Like a very annoying email service. Doesnt this kill speed advantages of email? I would hate to send an email out, and have to go through more red tape so the recipeint can receive their email. The sender would be doing all the work to help solve the recipients spam problem.

    What about the mass emails I like to receive, such as newsletters?
    • you only have to authenticate _once_ to each recipient. less if you're important enough that they pre-auth you. :) Unless you're working in tech support or something where you mail dozens of new people a day, it's hardly a bother.

  • Only 100, eh? (Score:4, Insightful)

    by EvilStein ( 414640 ) <spamNO@SPAMpbp.net> on Monday March 24, 2003 @03:50PM (#5585167)
    So, they simply create more Hotmail accounts and send out more spam.

    Besides, I've never actually had spam *from* Hotmail - it's usually going *to* my Hotmail account or spam coming with forget Hotmail headers.

    I seriously doubt this is going to do very much to curb spam.
    • Of course you've had! I get them about once a month. It's from "Hotmail Staff" or some such, and it includes a paragraph about the standard "fighting spam" and "send your photos to granny."

      Then, it goes on to shout out the virtues of MSN 8, MSN Messenger, MSN Wallet, MSN XBill, MSN We Hate Torvolds, et al.

      For grits and shiggles, I reported it as spam. Forwarded it to abuse@hotmail.com and whatnot. I got a message back informing me that the email -- containing advertisments I didn't want -- was not spa

  • Um...no (Score:3, Informative)

    by Ant2 ( 252143 ) on Monday March 24, 2003 @03:51PM (#5585175)
    1. Services. Mailblocks provides a fast, low-cost email service to its users. The Services also include online calendar and address book features, and other features may be added in the future; unless expressly stated otherwise, any new or enhanced features will be subject to the then-current version of this Agreement. In exchange for your use of the Services, you expressly permit and authorize Company, and such third parties as may be authorized by Company, to furnish to you from time to time, through the Services or any other means, with information prepared by Company or by (or on behalf of) other entities, including advertisements and solicitations (such information, "Third Party Content"). You acknowledge that such Third Party Content is an inseparable part of the Services, and that furnishing such Third Party Content to you cannot be terminated unless the Services are terminated. All such Third Party Content will be understood to be requested by you through your use of the Services. Some third parties furnishing you with Third Party Content may permit you to "opt out" of receiving such communications from them. However, Company is not responsible for any such party's failure to comply with its own "opt out" policies.

    Company neither endorses nor is responsible for Third Party Content, and you may be exposed to Third Party Content that is offensive, inaccurate, misleading, deceptive, out-of-date, or incomplete. You must evaluate, and bear all risks associated with, the Third Party Content, and your use of and reliance on any such content. We are not responsible for any errors or omissions in Third Party Content, for hyperlinks embedded in Third Party Content or for any results obtained from the use of such content. Under no circumstances will we be liable for any loss or damage caused by your reliance on any such Third Party Content. Your correspondence or business dealings with, or participation in promotions sponsored by, any such third party advertisers, or any other third party providers of goods or services accessed through the Services, and any terms, conditions, warranties or representations associated with such dealings, are solely between you and such third party advertiser or provider.

    We may establish limits and restrictions on the Services, including without limitation, the maximum disk space that will be allotted on your behalf, the maximum number of days that messages will be retained, the maximum number of messages that may be sent or received, the maximum size of a message that may be sent or received, and the maximum duration for which you may access the Services in a given period of time. You acknowledge that Company reserves the right to terminate accounts that are inactive for an extended period of time. You further acknowledge that Company reserves the right to change these limits and restrictions at any time, in its sole discretion, with or without notice.

    COMPANY MAKES NO WARRANTIES CONCERNING, AND ASSUMES NO RESPONSIBILITY FOR, THE TIMELINESS OF DELIVERY, MISDELIVERY, DELETION, CORRUPTION, OR FAILURE TO DELIVER OR STORE ANY EMAIL MESSAGE(S) THAT YOU MAY SEND OR RECEIVE USING THE SERVICES, OR FOR ANY LOSSES THAT YOU MAY INCUR THEREBY.

  • I know their plan! (Score:5, Funny)

    by EvilStein ( 414640 ) <spamNO@SPAMpbp.net> on Monday March 24, 2003 @03:52PM (#5585185)
    Just like their website is doing right now, they'll just refuse those pesky TCP connections.

    Yeah, that's a great way to prevent spam!

  • Exclusive Spam Provider ? (Score:5, Informative)

    by Dave21212 ( 256924 ) <dav@spamcop.net> on Monday March 24, 2003 @03:53PM (#5585192) Homepage Journal

    Wow, definitely read the TOS info [mailblocks.com]...

    It reads more like they wish to charge you $10 to become your primary spam provider, oh and they will also be sharing your personal info with 'their' spammers (3rd parties), which you can't opt-out of.

    Pay to go from bad to worse ? I think not !

  • Not free according to NYTimes... (Score:4, Informative)

    by jmiles ( 590378 ) <jmilesNO@SPAMmit.edu> on Monday March 24, 2003 @03:53PM (#5585194)
    The article here [nytimes.com] indicates that this company plans to charge $10/year for the service. Cheap, if the system proves to work, but definitely a different business model.

    Further, it says that the 7 digit passwd will be sent in a "digital image"; kind of a hassle for those of us with text-only email. (long live pine)
    • No hassle at all. My filters will classify their HTML-only "challenge" as spam, I will ignore it, and the message won't be delivered. Not my problem. I have no strong need to correspond with people who think that everyone reads their email with a Web browser anyway.

      And the use of a "digital image" discriminates against the blind.
    • Further, it says that the 7 digit passwd will be sent in a "digital image"; kind of a hassle for those of us with text-only email. (long live pine)


      Not being of the programming type, but to me, it would seem trivial to send an "ascii" graphic depicting a 7 digit passcode. So long as the mail client doesnt mangle it too bad...

  • SpamCop used to work that way (Score:5, Interesting)

    by Animats ( 122034 ) on Monday March 24, 2003 @03:53PM (#5585205) Homepage
    SpamCop used to be challenge/response, but they switched to a "heuristic" system that doesn't work as well.

    Challenge/response systems have the problem that if two parties both use a challenge/response system, they may not be able to communicate with each other at all. The challenge message may not get through. Worst case, they create a mail loop.

    • avoiding the loop (Score:3, Interesting)

      by sacrilicious ( 316896 )
      Challenge/response systems have the problem that if two parties both use a challenge/response system, they may not be able to communicate with each other at all. The challenge message may not get through. Worst case, they create a mail loop.

      The solution would be to adhere to the following protocol:

      • challenges always include the original message's subject line in the challenge email's subject line, and
      • non-challenge emails sent from a system result end up creating a temporary whitelist for emails return

  • Not exactly free... (Score:3, Informative)

    by zaren ( 204877 ) <fishrocket@gmail.com> on Monday March 24, 2003 @03:54PM (#5585208) Journal

    Service Pricing
    I want the following Mailblocks service:
    Standard Service -- $9.95/year

    * Standard Service includes 12 megabytes of storage.
    * Promotional launch offer: Buy one year of service for $9.95, receive an extra two years of service for free. That's just .23 cents per month to rid your life of spam.

    Expanded Service -- $24.95/year

    * Expanded Service includes 50 megabytes of storage.
    * Promotion not offered for the expanded service.
    * Can I upgrade later? Sure.*
    • Promotional launch offer: Buy one year of service for $9.95, receive an extra two years of service for free. That's just .23 cents per month to rid your life of spam.*

      * Customer will be rid of their spam, not ours.

  • Myrealbox is the best (Score:2, Interesting)

    by wonea ( 597234 )
    Myrealbox filters the spam, and it is free. Why would you want to pay for something that is already free. www.myrealbox.com
    • I paid for my fastmail.fm account. I wanted something that did POP3 over SSL, IMAP over SSL, and SMTP via SSL. Plus a nice web internface. Plus subdomain addressing, and a decent amount of email storage space. That is worth US$20 per year to me. It may not be for everyone, but it is worth it to me.

      I have used many of the free email accounts, and you get what you pay for. Yahoo pulled the plug on a few important features, and it was actually cheaper to go with Fastmail and the extra features than the get an

  • "Patented" challenge-response? (Score:4, Insightful)

    by rsidd ( 6328 ) on Monday March 24, 2003 @03:55PM (#5585220)
    There have been procmail-based autoresponders that essentially do this for ages. You maintain a whitelist, people who are not on it need to reply to an email and then get added to your whitelist.

  • WAR (Score:2, Interesting)

    by Ty ( 15982 )
    WAR on terror
    WAR on drugs
    WAR on Iraq
    WAR on ....

    WAR on SPAM

    How American.

  • MS has ruined the guy (Score:3, Interesting)

    by westfirst ( 222247 ) on Monday March 24, 2003 @03:55PM (#5585223)
    Gosh, I loved the first WebTV even after MS bought them. It was a great, lightweight client with a beautiful user interface, at least for the time. Now the jerk wants to save us from SPAM just so he can spam us himself. Plus, you pay him $10/year and can't avoid it. That's right, the TOS says you CAN'T opt out.

    Memo to VCs: don't fund ex-M$ people. They seem to believe that they can jam any TOS down people's throats.
  • Looks like you can also use IMAP [mailblocks.com] to tap into your mailbox as well:

  • Disposable Email Addresses -- Effective? (Score:4, Interesting)

    by angle_slam ( 623817 ) on Monday March 24, 2003 @03:57PM (#5585233)
    The last time I posted this question [slashdot.org], it was late in the discussion and didn't get many responses. So I'll ask again. Does anyone here have any experiences with Disposable Email Address services? Click the above link to get a more detailed explanation of what it is.
    Briefly, I'll explain how they work in theory. After signing up with a disposable email service, they give you a disposable email address that you can, for example, enter into forms. Mail sent to that disposable email address gets automatically forwarded to your email account of choice. But here's where they supposedly come in handy. You can sign up for a different disposable email address everytime you fill in a web form. If you start getting spam, you can look at the disposable email address the spam was sent to and you can do 2 things: (1) cancel the disposable email address so you no longer get spam sent to that address; and (2) you know who gave out your disposable address and you can take whatever action you deem appropriate.
    Any thoughts?

  • secure? (Score:5, Informative)

    by hey ( 83763 ) on Monday March 24, 2003 @03:59PM (#5585243) Journal
    mailblocks says "All login information is sent securely to the Mailblocks server."... but I don't see any "https:". I tried signing in with a bogus userid/password just to see if I got a SSL response but no. Am I missing something?

    • Re:secure? (Score:3, Informative)

      by panaceaa ( 205396 )
      It uses HTTPS. Search for "https" in the source code, and you'll see they dynamically create a URL for the submit action. It takes a parameter called "secure", so technically non-secure URLs could be created, but the function (FixFormAction()) always receives secure=true.

      Also, I sniffed the login traffic doing the same sign-in process you did, and the form was submitted with HTTPS. I don't know why you couldn't detect this.

  • ToS translation (Score:3, Funny)

    by Limburgher ( 523006 ) on Monday March 24, 2003 @04:00PM (#5585258) Homepage Journal
    We are committed to preventing delivery of any spam (except ours) to your inbox, in an effort to prevent you from being harrassed by anyone (except us) trying to send you unwanted advertising (i.e. not ours).

    Hmmm. No thanks.

  • try out oddpost

    http://www.oddpost.com

    it truly is the best web based email
    i've every used. if you like outlook,
    evolution, eduora, >... you'll feel
    right at home in oddpost.

    pretty cheap too... only $30 a year
    and the 1st month is free. and the
    spam filtering is coming along nicely
    to boot.

  • It'll block too much (Score:5, Interesting)

    by lazyl ( 619939 ) on Monday March 24, 2003 @04:02PM (#5585277)
    Before allowing e-mails through to your in-box, Mailblocks automatically transmits a numerical password to first-time correspondents. The senders must then retype the code into an onscreen dialog box before the system acknowledges them as legitimate.

    This will block a lot of legitimate mail. You won't be able to subscribe to mailing lists. You can't recieve those "account authorization/activation emails" that lots of sites use. E-cards won't work. You won't be able to to get daily comics. Bascailly, any system where the mail is sent by an automated system won't work. There are probably others I can't think of.

  • Challenge-Response Has Issues (Score:5, Interesting)

    by istartedi ( 132515 ) on Monday March 24, 2003 @04:16PM (#5585372) Journal

    1. It imposes hurles on first-time contacts. Posted your resume and got a response? HR person doesn't have time to answer questions like "what color is the sky" or whatever they use to verify you're human.

    2. Spammers can use it! If they get a challenge they know the e-mail is valid. Then, they can forge senders. If they forge the right sender the spam gets through. If they forge the wrong sender a challenge goes out to the 3rd party. The challenge has to carry a subject doesn't it? Voila! The spammer has hijacked your box and used it to send quickie text messages to 3rd parties. OK, well, maybe you change the subject so that it simply gives the time of the message or something... but then the sender is less likely to recall if he actually sent the message.

    Even if it works, C-R floods the network with with little micro-spams. I for one do not look forward to having my inbox flooded with messages with subjects like "SpamMaster response requested for message you sent 3/24/03" because I never sent the message and some lousy spammer just forged my address in the Sender.

    Maybe they've come up with some ingenious way to fix these problems, but I doubt it.

    • Yes, if you're waiting for an important email with Spam Interceptor you can check your mail cache and manually add the person either before or after you receive the email. Since HR firms always send from the same email address, future correspondence isn't a problem.

      Server-Client based systems ensure spammers don't know which email address is valid. The subject line is included in the email, but with minor changes so an automated strstr isn't going to find it.

      Spammers do not forge legitimate email addres
  • There are a lot of sites gearing up to do exactly this. Sites like Mailrazor [mailrazor.com] are doing spam-blocking with tools like spamassassin and such, as well as adding things like whitelisting/opt-in. (IE, you might be able to allow in things which pass draconian spamasassin/RBL filters, then force suspected spam to opt in). Meanwhile, if the user sends out an email to an address, it whitelists automatically and even if it sends a 'suspicious' email it will be autowhitelisted. With confiruable behavior, of course.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Monday March 24, 2003 @04:20PM (#5585393)
    Comment removed based on user account deletion

  • and I have some nice swamp land.... (Score:5, Informative)

    by frovingslosh ( 582462 ) on Monday March 24, 2003 @04:22PM (#5585405)
    Lets make sure we have the facts: Here's a free service that costs either $9.95 or $24.95 a year depending on the file size limitation you select (You want a file size limitation imposed on your e-mail, don't you?) and then they take your name and sell it to people to send you the exact thing you're paying to avoid. Sure, that makes sense, but how well will it work? I've considered the challange and response system, but how many valid e-mails will be missed from valid businesses you are doing business with? Do you think Tech Support people you are trying to get a response from will fool with this system, or just delete a validation request that comes back to them? How about rebate confirmation notices? Or adding yourself to a newsletter distribution list? I received an order confirmation for a new notebook just last Friday that came from a "do not reply to this address" e-mail address; I certainly wanted the information in the confirmation message, and I don't expect major on-line retailers will change the way they send confirmations just to suit Mailblocker. How many other important e-mails would you miss if you trusted this system?

    Sure, something has to be done about the problem, but paying for a bad system that will just sell your name to other spammers and will block legitimate e-mail isn't much of a solution and should not be accepted in a desperate I'll try anything approach. I would propose that a simple open season on spammers, with perhaps a six spammer limit so every hunter gets a chance, and even a small license fee to help pay down the national debt, would be a much better approach.

  • Mailing lists (Score:4, Interesting)

    by rf0 ( 159958 ) <rghf@fsck.me.uk> on Monday March 24, 2003 @04:24PM (#5585418) Homepage
    One thing I hate about this sort of thing is that its quite dumb when it comes to mailing lists. More than once I have written an email to a mailing list I'm on and got back a messages along the lines of

    "foo@bar.com is subscribed to our service. Please click on very long URL to let them recieve your messages"

    Now this means that everyone who posts to that list has to do this for one particular user. Why should they? I'm sure that user has something to say at some point but I don't want/need to do it everytime I post to a list and someone new has joined who uses a similar service.

    Why don't they whitelist the address of the mailing list? That would seem obvious to me. Even mailing lists that allow anyone to post normally have very high signal to noise ratios with the occasional spam.

    Just my pet peev

    Rus

  • SA still works (Score:5, Informative)

    by ajs ( 35943 ) <{ajs} {at} {ajs.com}> on Monday March 24, 2003 @04:26PM (#5585432) Homepage Journal
    I've been using SpamAssassin for about a year now. It started out good, and got better. Now it's actually a little frightening how good it is.

    If you want to try it out, you will (most likely) need your own machine handling mail (if you're a broadband or DSL user, this is easy enough, I'll assume you've made that step...)

    Now, make sure Perl is installed.

    Now, as root, type "perl -MCPAN -e shell" and follow the instructions to set up Perl's configuration system.

    In that shell, type "install Mail::SpamAssassin".

    Exit that shell and type "/etc/init.d/spamassassin start"

    You will want to do what your OS prefers for making sure this starts at boot time, under Red Hat Linux, that's "/sbin/chkconfig --levels 35 spamassassin on"

    Exit your root shell, and do the rest as your user account.

    Assuming you use sendmail with procmail (see the SpamAssassin site for other MTA configuration steps), put:
    :0fw
    | spamc -f
    into your .procmailrc.

    SpamAssassin is now doing its job. It just marks messages that it thinks are spam. See the example procmailrc [spamassassin.org] on spamassassin.org for more information on how you can move the mail to another folder, delete it, or even more complex things. Also, there's a procmail bug that the example config can help you work around.

    If you're doing this on a busy site, I recommend adding "-m 20" or so to your spamd command-line to throttle periods of intense mail delivery.

    You can also configure SpamAssassin to do lots of useful stuff just the way you like it. There's a FAQ on your site that will walk you through it, but after the first time spamd handles mail for you, it will create a ".spamassassin/user_prefs" file that has good comments in it that guide you through common configuration needs (like whitelisting users).

    • Re:SA still works (Score:5, Funny)

      by stratjakt ( 596332 ) on Monday March 24, 2003 @04:36PM (#5585522) Journal
      If you want to try it out, you will (most likely) need your own machine handling mail (if you're a broadband or DSL user, this is easy enough, I'll assume you've made that step...)


      Now, make sure Perl is installed.

      Now, as root, type "perl -MCPAN -e shell" and follow the instructions to set up Perl's configuration system.

      In that shell, type "install Mail::SpamAssassin".

      Exit that shell and type "/etc/init.d/spamassassin start"

      You will want to do what your OS prefers for making sure this starts at boot time, under Red Hat Linux, that's "/sbin/chkconfig --levels 35 spamassassin on"

      Exit your root shell, and do the rest as your user account.

      Assuming you use sendmail with procmail (see the SpamAssassin site for other MTA configuration steps), put: :0fw
      | spamc -f
      into your .procmailrc.

      SpamAssassin is now doing its job. It just marks messages that it thinks are spam. See the example procmailrc [spamassassin.org] on spamassassin.org for more information on how you can move the mail to another folder, delete it, or even more complex things. Also, there's a procmail bug that the example config can help you work around.

      If you're doing this on a busy site, I recommend adding "-m 20" or so to your spamd command-line to throttle periods of intense mail delivery.

      You can also configure SpamAssassin to do lots of useful stuff just the way you like it. There's a FAQ on your site that will walk you through it, but after the first time spamd handles mail for you, it will create a ".spamassassin/user_prefs" file that has good comments in it that guide you through common configuration needs (like whitelisting users).


      Is that all!?

      I'll forward this to my grandma toute-suite.
  • As much as I would like to applaud hotmail on doing something about spam I can't help but feel that its not going to work. I say this as in all my time fighting spam I've only actually seen a couple of spams actually come from hotmail.

    More often than not I actually see Hotmail accounts as drop boxes. i.e. places bounces go or you reply to. Prehaps it might be better for Hotmail to restrict the incoming number of emails to an account to 100 a day.

    Now that would hurt spammers more.

    rus
  • Hotmail subscribers are now limited to sending only 100 messages a day "in an effort to prevent spammers from using Hotmail to spread spam,"

    They don't need to use hotmail itself (in fact, I've never seen a spammer that has). They just need to spoof Hotmail addresses, which is quite easy. Chalk that up as yet another episode of M$ letting itself sound stupid...
  • in this week's pulpit [pbs.org].

    Basically, it's challenge/response, with the response being via telephone

    I replied to him with the following:

    I like your idea, I think it'll work. It's a variation of the challenge/response scheme, with the response being via a sender-paid phone call.

    Here's a story: 2 years ago, we moved, so I had to change ISPs. I took the opportunity to do an experiment - my new email address I only divulge to people I know; everything else I use a Hotmail account for. In 2 years I have N

  • They reserve the right to release any and all infomation... from the TOS:
    "Mailblocks furnishes our members, and permits third parties to furnish our
    members, through the Services and otherwise, with information, promotional
    materials and solicitations, from time to time. You may not "opt out" of
    the receipt of such promotional materials from Mailblocks and/or its
    affiliates, advertisers or other business partners if you wish to use the
    Services. The receipt of such promotional materials is an inseparable part
    of

  • I have the solution to spam! (Score:5, Funny)

    by fredrikj ( 629833 ) on Monday March 24, 2003 @04:58PM (#5585759) Homepage
    Add the following to your mail processing software:
    if (inmsg == spam)
    {
    delete(inmsg);
    }
    You may have to change the names of the variables/functions to suit those in your application's source code.

    I haven't tested it extensively, but the algorithm seems solid.

  • Old news (Score:3, Informative)

    by friday2k ( 205692 ) on Monday March 24, 2003 @05:08PM (#5585859)
    Hushmail [hushmail.com] has a challenge/response mechanism for quite a while now. And it works remarkably well ...
  • 'Hotmail subscribers are now limited to sending only 100 messages a day "in an effort to prevent spammers from using Hotmail to spread spam," said Lisa Gurry, MSN lead product manager.'
    This really isn't going to do anything worthwhile. Unless the spammers are actually logging into Hotmail, typing in the names, and pressing send, this sort of measure is pointless. It seems that the spammers are just throwing together random usernames + "@hotmail.com" and using their own smtp servers (or somebody else's, just not Hotmail's).

    If they want to do something to cut down on spam, why not just limit the number of messages that a server can send to hotmail addresses? Meaning, if I want to send out spam and my list includes 100,000 hotmail adresses, hotmail's servers will reject every message I send to a them after the 100th. That just wiped out 99.9% of spam that hotmail users would receive.

    Yes, it would take some work and the processing cost per message would be higher, but if it works, and cuts down on traffic by a higher percentage than the increased cost associated with the system, it would still be an amazing improvement.

    I've always wondered why MS couldn't look at all incoming messages and spot spam based on vast numbers of similar messages.

  • New tactics in the War on Spam (Score:3, Funny)

    by smack_attack ( 171144 ) on Monday March 24, 2003 @07:42PM (#5587228) Homepage
    Spammers of the world,

    You have 48 hours to cease sending spam and give up. If you fail to stop sending spam after this timeframe, we will remove you from the Internet forcibly and swiftly. We will track you down and destroy your lists. Insecure servers will no longer be regarded as innocent relays, they will be dealt with swiftly and justly as well.

    You have 48 hours to comply with this ultimatum. Act responsibly with email and you will reap the benefits. Use spambot and harvesters and our forces will react with force.

    -Coalition of Canned Meat

Slashdot Top Deals

If you want to put yourself on the map, publish your own map.

Close