Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Spam The Internet United States Your Rights Online

FTC Wants Comments on Email Authentication 208

Posted by michael from the getting-an-earful dept.
An anonymous reader writes "Groklaw has the scoop. The Federal Trade Commission and National Institute of Standards and Technology (NIST) will co-host a two-day 'summit' November 9-10 to explore the development and deployment of technology that could reduce spam. The E-mail Authentication Summit will focus on challenges in the development, testing, evaluation, and deployment of domain-level authentication systems. The FTC will be accepting public comments until Sept. 30, 2004 via snail-mail or email (authenticationsummit at ftc.gov). The FTC has a list of 30 questions they would like answers/comments to. The list available in this PDF of the Federal Register Notice." In a related subject, reader Fortunato_NC submits this writeup of the sequence of events that led to Sender-ID's abandonment.
This discussion has been archived. No new comments can be posted.

FTC Wants Comments on Email Authentication More

FTC Wants Comments on Email Authentication

Comments Filter:

  • spam about spam (Score:3, Funny)

    by metallikop ( 649953 ) on Tuesday September 28, 2004 @11:43AM (#10374879)
    Seems like slashdot is being spammed with stories about spam.

  • My comments? (Score:4, Funny)

    by cuzality ( 696718 ) on Tuesday September 28, 2004 @11:44AM (#10374888) Journal
    I will be sending my comments immediately by email. They'll know who I am.

    • Re:My comments? (Score:5, Funny)

      by orthogonal ( 588627 ) on Tuesday September 28, 2004 @12:55PM (#10375674) Journal
      I will be sending my comments immediately by email. They'll know who I am.

      THIS AUTHENTICATED EMAIL
      HAS BEEN APPROVED
      AS CHRISTIAN AND PATRIOTIC
      BY THE
      REICHSPROTECTOR OF INFORMATION
      FOR THE UNITED HOMELAND
      by direction of
      JOHN D. ASHCROFT,
      REICHSMINISTER OF JUSTICE


      We want all your papers, please!

      And yes, we do know who you are, Citizen!

      CC: PATRIOT DATABASE, REICHSMINISTRY OF INFORMATION

  • for all the bots... (Score:5, Funny)

    by Anonymous Coward on Tuesday September 28, 2004 @11:45AM (#10374896)

    authenticationsummit@ftc.gov

  • They won't be happy. (Score:3, Insightful)

    by Anonymous Coward on Tuesday September 28, 2004 @11:45AM (#10374903)
    These guys aren't going to be happy until we have to hand over our credit cards, photo ID and social security number just to send an email.

    • Re:They won't be happy. (Score:4, Insightful)

      by fleener ( 140714 ) on Tuesday September 28, 2004 @12:22PM (#10375260)
      Correct. My primary e-mail accounts have been spam-free for 3 years, since I started watching where and how I give people and web sites my address. Through a few simple measures you can protect a new address without the need for spam filters, with no need to hinder your regular personal and professional correspondence (assuming you don't correspond with spammers).

      The *only* spam I receive on my permanent accounts is an occassional worm-sent e-mail and a guessed-address spam every 3 or 4 months (and those have never led to more spam).

      People who piss and moan about spam (basically everyone) are refusing to accept that they live in a dangerous world. There was a time when people left their front door and windows unlocked. An ounce of prevention is worth a billion pounds of cure, in terms of spam.

      I'll never support an authentication system that costs me more money to send e-mail because I have zero need for an authentication system.

      People who don't use throw-away accounts for risky correspondence are having anonymous sex without a condom. Go ahead, mod me down because you don't believe me and think spam is just the cost of doing business on the Internet. It's not.

      • You are largely correct, but I strongly disagree with the conclusions you draw. Why should we have to use images for email addresses just so a bot doesn't pick it up, why should we bow down to the spammers and hide contact info:

        fleener
        (email not shown publicly)

        Wouldn't it be nice if we could actually use email as it was intended?

      • Re:They won't be happy. (Score:2, Insightful)

        by dubl-u ( 51156 ) *
        The *only* spam I receive on my permanent accounts is an occassional worm-sent e-mail and a guessed-address spam every 3 or 4 months (and those have never led to more spam).

        Then you're a lucky fellow. A few months back I enabled a bunch of aliases for common dictionary attack names, and those aliases are rising rapidly in volume. (That's fine with me, as they're just fed right to the Bayesian training program.) But eventually, it will spread, and your oh-so-pure address will be compromised.
      • I use throw-away accounts for risky stuff. But...

        My primary email address, which I have had since 1992, has been published on the web (in documentation I have written), posted to Usenet (back when I wrote and maintained a FAQ), used in communication with online vendors like Amazon and ebay, and more. It receives lots of spam. It is the account at the educational institution where I work. While I can get a new account elsewhere, and tell my friends to use that email address, I cannot change the address
    • Absolutely. What business does the government even have getting involved in this? You're free to use any authentication scheme you like now, why do we need the government to mandate something like this?

  • NOTHING but an open standard. (Score:5, Insightful)

    by garcia ( 6573 ) * on Tuesday September 28, 2004 @11:46AM (#10374913)
    From Groklaw:

    7. Whether any of the proposed authentication standards would have to be an open standard (i.e., a standard with specifications that are public).

    Of course the standard would have to be open. This shouldn't even be up for discussion. No argument can make security by obscurity work and no argument can get me to change my thinking that we should all be using closed SMTP servers.

    Spam is "horrific" and all (BTW I don't get more than 5 a year) but we certainly shouldn't even be considering ending it by choosing applications that will eliminate an open society.

    • Re:NOTHING but an open standard. (Score:5, Interesting)

      by JabberWokky ( 19442 ) <slashdot.com@timewarp.org> on Tuesday September 28, 2004 @12:23PM (#10375273) Homepage Journal
      Spam is "horrific" and all (BTW I don't get more than 5 a year)

      And I get 1800 a day. That's because I am the public contact for several companies with some of my email addresses dating back over 10 years. In conjunction with theater groups and businesses, my email appears in press releases, on fliers, ancient usenet posts, and otherwise all over the place.

      Individuals using their email account to talk to friends don't have as much a problem as people who use their email address publically for business and publicity.

      My phone number and address are also published. I don't, however, get 1,800 unsolicited calls every day and my junk physical mail is quite reasonable.

      --
      Evan "I'm not even saying Spam is bad, I'm just saying it costs me serious time"

      • Individuals using their email account to talk to friends don't have as much a problem as people who use their email address publically for business and publicity.

        And this, my friends, is the real cost of SPAM. It's not about the bandwidth, it's about the lost business.

        In my business, the cost of a losing a customer because of miscommunication far outweighs the cost of the bandwidth SPAM uses on my server. If customers/reviewers/resellers get lost in the flood of SPAM it costs me money.

        And then there'
        • "It's good to see that the FTC is getting involved -- this is a business/trade problem, not a communication problem."

          Hmm..yes BUT, the internet/web/email...were NOT developed for business, in fact business use of it came along quite late. It just seems by this statement, the business needs for email or other internet protocols should dictate their use/design over all other concerns. I would have to disagree in that case. It should continue to develop and grow for all concerns, both public and private.

          My

          • Sez you. Business use of the Internet happened quite early in the history of the net -- the Department of Defense could exchange email with Defense contractors (and academic researchers). Defense contractors are most assuredly "business".

    • an open standard (i.e., a standard with specifications that are public).

      In my mind, an "open standard" isn't just one anybody can read, but one that is open to anybody implementing it - which means patent-free. It's no good everybody being able to read the specifications if nobody is allowed to do anything with them.

  • The Hardest Issue (Score:5, Interesting)

    by Nos. ( 179609 ) <andrew@nOSPAm.thekerrs.ca> on Tuesday September 28, 2004 @11:47AM (#10374919) Homepage
    Is to keep email easy to use. SPF is a nice idea, but doesn't cope with a couple issues. The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM. Secondly, its not expensive to register a domain and flood SPAM for a few days until that domain is blacklisted. Wash, rinse, repeat. I'm not saying a solution isn't out there, just nothing that I have seen really talks to these two issues.

    • Re:The Hardest Issue (Score:4, Informative)

      by thogard ( 43403 ) on Tuesday September 28, 2004 @11:54AM (#10374998) Homepage
      You only found 2 issues with SPF?
      How about a few more [abnormal.com]

      Since I wrote that, I've managed to come up with SPF rulesets that cause DOS on some of the common implementations, my dns has been scaned countless times looking for SPF records and I've had over 1000 spam messages with valid SPF records.
      • "I've had over 1000 spam messages with valid SPF records."

        That's likely due to the sending ISP having lax policies.

        SPF only provides methods of communicating the sender policy and of checking wheter or not an email is compliant.

        OTOH, this does allow us to determine if an ISP is lax about allowing their users to spam, or if it is doing nothing to let their users know that their machines have been compromised.

      • You only found 2 issues with SPF?
        How about a few more [abnormal.com]

        I agree with most of the comments, but I don't quite understand the "No sane firewall is going to let TXT records through" one.

        I don't know of any firewall that blocks a specific type of UDP packet.
        To a firewall all DNS replies look alike.
        Sure, it could parse the data part of a DNS packet in the firewall, but AFAIK no firewall actually does.

        -- Should you question authority?

      • Re:The Hardest Issue (Score:4, Informative)

        by ajs ( 35943 ) <[ajs] [at] [ajs.com]> on Tuesday September 28, 2004 @01:55PM (#10376246) Homepage Journal
        Repeat after me, "SPF DOES NOT PREVENT SPAM. SPF DOES NOT ATTEMPT TO PREVENT SPAM. IF YOU EXPECT SPF TO PREVENT SPAM, YOU WILL BE DISAPOINTED."

        Ok, yelling done (sorry, but this comes up so often, you'd think the "S" stood for Spam). What SPF *does* do is validate that mail was sent from a machine that was (or was not) authorized to send it by the originating domain.

        It's nothing more or less than that. As a first-pass on the roots of the problem of spam, it's a great tool, but I would never suggest that anyone treat it as an actual solution for spam per se. Joe Jobs are mitigated and you can also begin to build a reputation with the sources of SPF-identified mail. Once you get spam from a machine that's listed as a valid SPF sender for that doamin, you have a great deal more information to apply ot that domain's reputation than if you recieved spam from a non-SPF sender.

        It's not perfect (SPF has its warts, though I think many of your concerns are too minor to be blasting them over), but it is an excellent start, and combined with various other systems out there, helps to address many existing problems.
      • These have just gotta be the lamest excuses I've seen yet. Maybe it was a joke and I missed the punchline?

        Its parsing is too complex

        It's really pretty simple, and there are free reference implementations.

        No sane firewall is going to let TXT records through
        No sane firewall is going to let TCP DNS packets through

        Most "sane firewalls" are either going to allow DNS queries to originate from the intranet and replies to be received (eg, simple NAT routers)....

        Or they're going to block all DNS and a ca

    • I still like the pay as you go approach: if you had to pay a nickel for every unsolicited e-mail you sent over the internet (as opposed to a company's intranet), spammers would be shut down overnight.

      Of course, there's the logistical issues to deal with, but having escrow accounts for every ISP and "approved to receive" lists for no-charge e-mails would allow us to get past this annoyance.

      Right now, we've got people selling snake-oil penis enlargements, counterfeit prescription drugs, and fraudulent stoc
    • SPF is a nice idea, but doesn't cope with a couple issues. The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM.

      No, but when the luser finds out that their e-mail is broken, they might just do something about their trojaned machine. Which is in fact fixing the problem and not the symptom. Any "authenticated user" idea for SPAM prevention has to account for the fact that there will need to be a "compromised" flag on the accou

    • Re:The Hardest Issue (Score:5, Informative)

      by perp ( 114928 ) on Tuesday September 28, 2004 @12:07PM (#10375138)
      The first is that a lot of SPAM comes from trojan'd machines. SPF won't prevent or help mark email coming from these machines as SPAM.

      Yes it will. Almost all of those trojanned machines send mail directly to the receiving server, not through the mail relay of the spoofed sender. If the email purports to be from jblow@someplace.com, the receiving mail server can check someplace.com's spf record and see that the ip address of the trojanned machine is not allowed to send mail. That is the very essense of what it does.

      You are correct that a spammer with a server can publish an spf record, but he is much, much easier to blackhole than a rapidly changing large selection of compromised dsl machines.

      • You are correct that a spammer with a server can publish an spf record, but he is much, much easier to blackhole than a rapidly changing large selection of compromised dsl machines.

        But the spammer can easily and cheaply change the domain name used. While ".com" addresses cost ~$8, ".org.uk" addresses can be bought for even less (about $4). Is it such a barrier to spammers? Spammers that may have paid many dollars to use the network of zombies?

        • But the spammer can easily and cheaply change the domain name used. While ".com" addresses cost ~$8, ".org.uk" addresses can be bought for even less (about $4). Is it such a barrier to spammers? Spammers that may have paid many dollars to use the network of zombies?

          I guess we will see. Currently, the vast majority of the spam that hits my domains comes from trojanned dsl machines. If domains are so cheap and easy, why use zombies? Perhaps when the zombies become ineffective due to spf, spammers will s

    • Re:The Hardest Issue (Score:3, Informative)

      by iabervon ( 1971 )
      It doesn't cope with world hunger, the war in Iraq, or many other issues. SPF doesn't really have anything to do with unsolicited email. Its only intented effect is to make solicited email more distinctive. This can eliminate some significant false positives in spam filters (email that would be spam if it weren't sent from a government agency that you had applied for a grant from, for instance).

      SPF will not prevent or help mark any email as SPAM. It will mark a lot of phishing scams as forgeries. It will l

  • Why not go after the merchants? (Score:5, Interesting)

    by 14erCleaner ( 745600 ) <FourteenerCleaner@yahoo.com> on Tuesday September 28, 2004 @11:48AM (#10374933) Homepage Journal
    You know, I can't figure out why we can't combat spam by making it illegal to send unsolicited ads via email (or maybe the can-spam act already does this), but then go after the companies who are actually trying to get customers. After all, they either provide valid contact information, or nobody can buy from them. If nobody can sell anything via spam any more, the reason for it would go away.
    • Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?

      Spam is here to stay no matter how much fucking legislation is out there.
      • "Because, as much as the United States would like to, we cannot control the happenings in the rest of the world?"

        Enough with the rest of the world crap - it all starts here:

        10097 Cleary Blvd, Suite 203, Plantation FL 33324

        and here:

        ESI, 5072 N. 300 W. Provo, UT 84604

        and....you get the picture.
    • Spammers will render that system useless by sending out spam for innocent companies. You could attack your competitor by anonymously sending spam for them.

      Both guilty and innocent merchants will claim they aren't sending out any spam. Who do you believe?

      --Sneeper

    • (or maybe the can-spam act already does this)

      Nope. The CAN-SPAM act explicitly legalizes unsolicited ads via email. It requires that those unsolicited ads comply with a few (totally useless) requirements. The recent lawsuits under the CAN-SPAM act (read "The Yes, you are allowed to SPAM act") are because many spammers do not comply with those totally useless requirements. So the ISPs can go after them, even though spam is legal.
      • " It requires that those unsolicited ads comply with a few (totally useless) requirements. "

        Even the email spam I get from my wireless provider - AT&T Wireless - requires that I go to their website and actively opt out from getting it. I also had to do the same to stop the text message spam they were sending to my cellphone.

        This was spam trying to sell me ringtones, so it was a third party who was ultimately spamming me through AT&T.

        On both occasions nothing happened within three months and
    • You cannot go after the companies whose products are being advertised. How would you know if they auhtorized the campaign, or someone is trying to harm their reputations?

      Also, a lot of unwanted email I get is virus mail. What do you do about that?

      What I can't understand is why SMTP is still unauthenticated. This is why spam is so hard to trace, and since authentication is already done for virtually every other major Internet protocol, the solution seems easy to see and implement.
      • SMTP certainly can be authenticated. Hell, *all* of my SMTP servers now are. My ISP, the one I run for a few friends, my work, and both my old schools at the very least required a login to IMAP first or they needed a user/password.

        The standards are there, the software support is there both for the servers and the clients. And if I could manage to hack something together to make it work with my god-awful, unmaintainable virtual domain setup then any competent IT person should be able to figure it out.
        • The problem is not that authentication is not supported, but that it's not required. I know the historical reason for this is that SMTP was originally meant to be used for transfer, not submission, but todays requirements certainly demand a different solution.
    • Spam is a social/technical problem (people want to spam, and plain SMTP provides no way to prevent them), so it requires a social/technical solution (convince everyone not to buy things through unsolicited email pitches, change the protocol to shift the costs of email traffic and make spam unprofitable). It's the best example of the tragedy of the commons in history.

  • No Free Software radicals allowed (Score:5, Insightful)

    by sphealey ( 2855 ) on Tuesday September 28, 2004 @11:49AM (#10374948)
    I would be willing to wager a small sum that the only invitees to this meeting will be representative of large, commercial, for-profit software vendors and ISPs. That there will be no representation of/by the Free Software community. And that the FTC will reject any comment not from a commercial software vendor/ISP as having "no standing".

    Just a guess.

    sPh
    • I tend to agree with your assessment. However, I wonder what they would do if, say, the lead developers of Sendmail arrived. They certainly aren't people of "no standing" with regards to email!

      Yes, I know alternatives such as Qmail and Postfix are out there, but Sendmail is pretty much the standard MTA.

    • Re:No Free Software radicals allowed (Score:4, Interesting)

      by JamesTRexx ( 675890 ) on Tuesday September 28, 2004 @12:29PM (#10375330) Journal
      Seeing that about 75% of mail is handled by open source mta's, they can't afford to go with ip, moneygrabbing, patentfilled solutions.
      The only standard that will get accepted will be an open, patentfree one supported by the free software community.
      Any closed or patented ones could only be used between the commercial mta's, so it would have little effect on the amount of spam.

      • he only standard that will get accepted will be an open, patentfree one supported by the free software community.

        You are insufficiently paranoid ;-(

        How about an FTC regulation banning the use of any MTA which does not have commercial indemnification guaranteed by a licensed reinsurance firm? Because clearly in these dangerous times we cannot trust our e-mail to software written by Communist hippies who might even be from other countries.

        That is the kind of thing FOSS will be facing in the next four years

        • Well, the FTC can try banning it, but I doubt they'd get it done outside of the US.
          I think at that point the internet would break into a US, and a non-US part. Most likely because people are getting tired of the industry driven agenda currently dominating the US itself.
          Another option might be the birth of a new, free internet as it was in the beginning.

    • F/OSS will certainly be a main issue there (Score:4, Informative)

      by wayne ( 1579 ) <wayne@schlitt.net> on Tuesday September 28, 2004 @01:09PM (#10375812) Homepage Journal
      Anyone who attended or watched the videos of last year's FTC anti-spam conference [pennypacker.org] will know that the FTC very much has a clue about the spam problem. They showed far more clue than even the average slashdotter, let alone the general public.

      Not only do I expect many F/OSS people to be allowed in, I expect the concerns of deploying anti-spam solutions in F/OSS mail servers to be front and center. I also expect there to be people who don't give a flip about F/OSS to be there too, along with a bunch of spammers^Wethikal bidnizmen.

    • Right, because as we all well know, no big companies care about linux [ibm.com].

  • Another war on.... (Score:3, Insightful)

    by Null537 ( 772236 ) on Tuesday September 28, 2004 @11:51AM (#10374975)
    That's what I envision.

    "Today, we must fight a war, they clog our mail boxes, they offer us penis enhancements, drugs like v1ag|2a, stuff we don't need, they make our wives leave us for believing we go to porn sites and give out our e-mails to just anyone. Today we start the war against spam"
    -[Insert head of newly formed organization here]

  • RFC1413 (Score:2, Interesting)

    by jcuervo ( 715139 )
    Just use ident. Maybe return a little extra information, like an "@sitename" suffix.

    Yes, it would require immediate global adoption, but not if you just assign a higher score (towards spam) to messages that came from sites with no identd running.

    • Re:RFC1413 (Score:3, Insightful)

      by slamb ( 119285 ) *
      That wouldn't work:
      • It requires a connection back to the originating MTA. Slow.
      • The information returned would be useless - my machine would always say "postfix". Unless you're talking about a new identd linked with the mail server. But that's not what RFC1413 [faqs.org] says. It says the "owner of that connection" - that's always going to be postfix.
      • It includes no provision for telling if the machine shouldn't be sending this message at all.

      A good SASL setup, along with SPF, does far, far more for authenticated

    • And this would stop spam from zombie Windows boxes, HOW, exactly? Since that is the source of most spam, even IF identd could not be spoofed (yea, right...) it would be useless.

  • A stopgap measure (Score:5, Interesting)

    by grasshoppa ( 657393 ) on Tuesday September 28, 2004 @11:56AM (#10375021) Homepage
    An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

    This way, zombie'd machines wouldn't have a chance to spew their virus/spam emails to everyone, I could still run my home email server, and the ISPs would save on bandwidth.

    I wonder why this ISN'T yet in place, to be honest.
    • I'd bet because the ISP's wouldn't open it back up again. Your TOS most likely says they don't have to.

    • Re:A stopgap measure (Score:2, Insightful)

      by Muerte2 ( 121747 )
      The ISP that I work at did exactly that. We were getting on average 2 to 3 complaints a week about spam leaving out network from customer IP addresses. We're a relatively small ISP too! Not to mention the only fix was to call said customer and explain what an open relay/trojan is and then help them fix it. The time required to do this for each customer was pretty horrendous.

      So we decided to block that port outbound for all IPs unless a customer requests it (if they're running a mail server etc...). Very fe
    • Both of my ISPs do [sympatico.ca] this [videotron.ca]. It's not a problem. I either use their SMTPs for outgoing mail, or tunnel to my own SMTP via openvpn/ssh, or use SMTP-AUTH on a different port.

      All traffic on both of these ISPs, on port 25 gets blocked before it hits the real world.

      S
    • Because, of course, no spam virus or trojaned box can 1) use a relay on a different port or 2) intercept the username and password.

      Blocking port 25 is blanket punishment. It's no different than making an entire class stay after school for 30 minutes because a single student was misbehaving. But don't let me dissuade you. Corporations can make up any excuse to stroke their authoritarian egos.
      • Get the stick out of your ass, it was a suggestion, and a damn good one at that.

        Tell me, what does your average user need with outgoing port 25 to anything other than their ISPs mail server? Most wouldn't even notice it, and those that do, I'd want to be able to call up and have it opened up for them.

        The only people that wouldn't like this, amazingly enough, are spammers and virus writers.

        So, which are you?

    • An effective stop gap measure would be for ISPs to block port 25 ( along with a number of others ) outbound by default, and open it up only on customer requests.

      The only problem is that it then becomes trivial to send spam through the ISP's email server instead.

  • The only way to fight spam, which is going to be inconvenient as hell for most people, is to autoblock any machine that sends or relays spam.

    Of course, email systems will buckle and fall, and people won't be getting mad as hell because their emails are bouncing or just not getting there.

    Then ISP and other companies will actually spend money (120K+) on very competent email admins and fix their damn servers.

    Each spam sets the clock forward by 1 week for domain and IP block.

    I guarantee there won't be any s

  • Publish SPF now, be the 126519th... (Score:5, Insightful)

    by pjrc ( 134994 ) <paul@pjrc.com> on Tuesday September 28, 2004 @11:58AM (#10375049) Homepage Journal
    If you want to advocate SPF, publish a SPF record for your domain, and then register it. Already, 126518 domains have published SPF records [infinitepenguins.net] (at the time of this writing).

    By the time the FTC's summit comes around, it's looking like SPF is going to be pretty well established.

    • I'd like to know how many of those domaines actually are applying effective policies.

      SPF is great for communicating a domain's policy and for allowing the reciever to check for compliance, but this does little if the originating domaine's policy is lax (or worse, "no policy). This brings us back to what I have seen as the heart of the SPAM problem since the beginning, ISPs are all for protecting their users from SPAM, but as soon as you ask them to do something about spam originating from within their dom

    • Re:Publish SPF now, be the 126519th... (Score:5, Interesting)

      by wayne ( 1579 ) <wayne@schlitt.net> on Tuesday September 28, 2004 @12:49PM (#10375603) Homepage Journal
      Actually, I have a list of around 650,000 domains in .COM, .NET and .ORG that have SPF records. These should show up in the SPF Adoption Roll [infinitepenguins.net] Real Soon Now. Surveys of the .DE and .FR TLDs have also been done, but I don't have the results of those.

      I'd like to know how many of those domaines actually are applying effective policies.

      In the survey of the .COM domains, I found the top ten SPF records to be:

      159416 "v=spf1 mx -all"
      147883 "v=spf1 -all"
      51245 "v=spf1 ip4:10.0.0.0/24 ip4:10.0.0.0/24 ?all"
      28206 "v=spf1 a:smtp.example.net -all"
      21437 "v=spf1 mx ip4:10.0.0.0/19 ~all" ""
      19733 "v=spf1 mx ~all"
      15245 "v=spf1 a:smtp.example.com ~all"
      9488 "v=spf1 ip4:10.0.0.0/24 mx -all"
      6371 "v=spf1 ip:10.0.0.0/24 ip:10.0.0.0/27 ip:10.0.0.0/24 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ip:10.0.0.0/27 ?all"
      5842 "v=spf1 ip4:10.0.0.0/24 -all"
      (I have munged the domain names and IP addresses for privacy reasons.)

      As you can see, it is very common to define strict SPF record with the "-all" at the end. Those domains that use the softfail option of "~all" are somewhat more lax, but still moving in the right direction.

      The complete survey results are available to people who follow the IETF MARID list and/or the SPF discuss list. I'm not going to post a link to them here 'cause I don't want to be slashdotted.

    • The article by Fortunato explained that one reason for the failure and disbanding of the IETF MARID working group was that Microsoft's patent application [uspto.gov] was published last week and turned out to be much broader than expected. As written it would seem to cover SPF, which is odd since the patent was submitted four months after SPF got started.

      The truth is that patent applications are written as broadly as possible and it is common for them to be whittled down by the patent office to only those claims which

  • Here's the system... (Score:3, Interesting)

    by RecycledElectrons ( 695206 ) on Tuesday September 28, 2004 @11:58AM (#10375054)
    Every eMail that is sent (by SMTP - the Simple Mail Transport Protocol) should be considered "unconfirmed." This means that it may or may not be from the return address.

    I propose that we add a new layer called CMTP - the Complex Mail Transport Protocol.

    CMTP simply takes an unconfirmed eMail (sent by SMTP) and sends a packet back to the sender. This packet asks for verification of the message. The packet includes a checksum, the length, to, from, subject, and the time/date that the eMail was sent.

    The sending mail server receives this CMTP checks all of that information, and replies with a CTMP confirmed message or a CMTP not confirmed message.

    There is no limit on the number of times that a mail server may be asked to confirm an eMail. There is a limit that messages should not be confirmed more than 24 hours after they are sent. This may pose a small problem in that SMTP does not place a time limit on mail messages.

    CMTP does require that every mail server maintain a list of the eMail it has sent. That COULD be time consuming.

    CMTP also adds 2 packets to every eMail sent. SMTP was designed to be dead simple. They thought that they could not afford 2 extra packets. In that time, eMail was 80% of all internet traffic. Today, eMail is such a small percentage of all traffic that trpilling it would not be noticed.

    Andy Out!
    • For any email server with a moderate load, do you even realize how much computation that is? checksumming isn't a trivial process computationally. Besides, it'd make spam even easier. The checksums, etc. would all be the same, so all I'd have to do is respond with a canned reply to any query on a spam I (theoretically) sent. All the while this imposes a PENALTY on LEGITIMATE mail, because of the necessary individual calculations.
      Nice idea. It has some major flaws, though.
      And according to NetFlow [internet2.edu], mai

  • As if you didn't already know this was important.. (Score:4, Interesting)

    by museumpeace ( 735109 ) on Tuesday September 28, 2004 @12:02PM (#10375089) Journal
    Let me undescore the impact the conference is likely to have by pointing out that when NIST speaks, the DOJ listens. Here is a quote from a rejected submission of mine that found other documents NIST has authored that Ashcroft and co. now use.
    Feeding the fascination many /. readers may have for the escalation of technique and counter-technique beteween hackers and computer forensics experts may not be as valuable as keeping clues about how to avoid getting caught out of the hands of the hackers but I just can't resist...
    Sciencedaily.com [sciencedaily.com] pointed me to something hackers and other criminals might want to study carefully: the PDF guidebook that NIST wrote [ncjrs.org] for the DOJ's first responders to computer crime scenes. Though it has John Ashcroft's name at the top, a glance at the document's time line shows that it was authored by experts mostly from outside the DOJ and completed before the current administration's appointments: the imprimatur of Justice Department on the document may not be ironic.

    Drat! I'm gonna get modded for flamebait but with a sig like mine, who'd notice?

  • Email's role on the net (Score:4, Insightful)

    by Schezar ( 249629 ) on Tuesday September 28, 2004 @12:05PM (#10375117) Homepage Journal
    Let's face it: Email doesn't (and can't) fill the role it used to.

    There was a time when you shared your email address with everyone. It was on your resume, it was on your web page (if you had one), it was in your sig. Email was the universal, simple, fast, reliable communication medium of the internet.

    I used it to get my friends together on a weekend. I used it to organize events and meet people. I used it to share information.

    Nowadays, IM fills that role. I've realized that nearly everything I used to use email for can be done just as easily over IM. It's reliable, fast, relatively secure, easily encrypted, etc... Furthermore, it is largely immune to spam for a number of reasons.

    I find now that I only use email when registering for something (throwaway address), or for confirmation when I purchase something online. Everything email used to do, IM can do (if used properly... Staying online, logging, offline messages, confirmation, not using the AOL client, etc...)

    IM is by-and-large safe from SPAM due to the numerous restrictions placed on its use. Rate limits, authentication, etc... These things provide a layer of security, but also a layer of inconvenience.

    Were email to incorporate such restrictions, it would remove the last reason in the world to even be using it in the first place! Email is completely open. If email were to be restricted, it would become nothing more than a slower version of the current capabilities of IM.

    • Re:Email's role on the net (Score:5, Insightful)

      by praedor ( 218403 ) on Tuesday September 28, 2004 @12:33PM (#10375394) Homepage

      Yeah, right. IM. Pa-leeze. IM requires that the person you seek to contact has their fat ass planted 4-square in front of their computer or leaves it on 24/7. Email is very nice. It works no regardless of the type of client you have. It will sit there waiting for you to check it, perhaps after a vacation, after actually getting off your ass and away from the computer to exercise, or whenever you decide to either fire up the computer or turn on your email client. Oh...IM also requires that your contactee be somewhat in the same timezone (besides sitting on their ass forever awaiting IM messages). Try to IM from California to NYC late in the afternoon. Try to IM someone on the opposite side of the globe.


      IM is cute, it is a nice way to reduce your productivity at work and waste time "chatting" back and forth about unimportant nonsense (movies, your new pants, the hot chick from apartment A, etc). Email ain't going away, and it most assuredly wont be replaced by IM, Jabber, IRC, ICQ, Yahoo Messenger, etc. Email works regardless of software/hardware platform, has not propriatory hooks in it (Microsnot tried with their SenderID scheme to add a proprietory hook into email). Nothing beats email for convenience and easy time-shifing.

      • Yeah, right. IM. Pa-leeze. IM requires that the person you seek to contact has their fat ass planted 4- square in front of their computer or leaves it on 24/7.

        Does it? Is that really a requirement for a chat, or is that merely how most people use a chat application? To put it another way, what is the real difference between a chat client and a email client, beyond the interface of how messages are presented? The only difference seems to be expectation. You could just as easily have chat-to-email an

    • Authentication? Most IM programs can be configured to store the necessary password and server information, so this only has to be done once.

      The real difference between email and IM is that the former is store-and-forward and the latter is direct transmission. Real-time email conversations are the exception, not the norm, and people are often completely unavailable through IM.

      A 100% open, anonymous, and unrestricted communications medium (like email) is not feasible in the real world in the long run. I
    • Really? So if I want to be contacted, I have to sit around, logged into my machine, 24/7? Do I run 3 or 4 different IM clients because the systems don't interact? Does it work with cellphones? Blackberries?

      I'm on an active mailing list of about 400 people, about 75 to 200 emails a day, and as far as I know about 10 of them have IM, and of those 10 there are people on each of several incompatible systems.

      If you can get Microsoft, AOL, ICQ, IRC, and whoever else to transparently transport everyone else'
      • You don't actually use IM do you?
        So if I want to be contacted, I have to sit around, logged into my machine, 24/7?
        I primarily use ICQ so I may be wrong here but I thought most IM clients allowed you to send offline messages that would pop up whenever the receiver connected.

        Do I run 3 or 4 different IM clients because the systems don't interact?
        boo hoo. Use something like trillian that connects to multiple IM servers or convince all of your friends to use the same thing.

        Does it work with cellphones
    • IM is teh sux.

      It sucks because *people can reach me* whatever _they_ want to reach me.

      Email is convenient and non-intrusive. I'll respond to anybody but only a few can get me right away.

      That's how I like it.

      I'm against email authentication. I don't have a spam problem. People have to learn to manage addresses like they learn to drive. If you don't learn, you will crash. Your fault.

  • No mention of sender pays (Score:4, Interesting)

    by gr8_phk ( 621180 ) on Tuesday September 28, 2004 @12:06PM (#10375129)
    There was no mention of sender pays postage as a solution. Anything that prevents anonymous email has an inherent central control which the internet doesn't need more of.
    • How are you going to handle payments and payment verification anonymously?

      That is, without using some anonymous e-cash system that will help the terrorists.
      • How are you going to handle payments and payment verification anonymously?

        Very few people need to receive completely anonymous email (maybe rape crisis centers, police tip lines, and the like). So the load of filtering out spam created by the anonymous tragedy of the commons can be placed on only those with this special need.

        For most of the rest of us, our long lost friends and business customers can afford the cost of some sort of e-stamp; and we can either whitelist the authentication method of, or forw

  • Clearly the solution is to change SMTP to XML. Its so old fashions that it uses a line-by-line converation. I propose XSMTP which goes like this:

    [xml]
    [huge header]
    [line value=helo]
    [/xml]

    That oughta fix it.
    I am joking.

  • FTC A Global Entity? (Score:3, Insightful)

    by Muerte2 ( 121747 ) on Tuesday September 28, 2004 @12:08PM (#10375155) Homepage
    Last time I checked email was a global technology. Am I the only one that thinks it's strange that the (FTC an entirely US organization) is making decisions about something like this? Isn't there a more appropriate internation technology body that should be handling this? Ultimately this will have to become an ISO standard to get implemented across all mail serving platforms. Wouldn't it make sense to get a global consensus before the US starts making decisions about how best to deal with SPAM.

    I live in the US, but if I didn't I wouldn't want the US government telling me how to handle SPAM.
    • You're right. We need a global, truly international and cooperative body addressing this on a worldwide level. An organization with global reach, full participation by all nations, and a proven track record of efficiency. This sounds like a job for a U.N. commission!
      </sarcasm>

      Seriously, it has to start somewhere. Increasing the size or scope of the committee is not an improvement.
    • Isn't there a more appropriate internation technology body that should be handling this?

      Yes. It's called the Internet.

      Forget the official government bodies, especially the international ones. The real power lies with the myriad people who make decisions about implementation and adoption. The Internet enables those people to communicate and self-organize in ways that are more effective and efficient than a government bureaucracy could ever be.

      I read about SPF here. It seemed like a good idea, so I implem
    • Maybe we shouldn't use TCP/IP anymore, after all it was invented by the US, and the gov't no less (specifically the military).

      If a good idea is born in the US, there is no reason for the world to ignore it because of that fact.
  • I don't know about everyone else - but I hardly notice spam anymore. I mean, between gmail, thunderbird, and even hotmail (obviously not a definitive list) - I don't see it anymore. It's all filtered out automagically. I think this is a case of the government, once again, being a bit too slow on the uptake. Thanks for the thought guys, but we seem to be dealing with it fine ourselves.

  • Why not do what the RIAA does? (Score:3, Funny)

    by telstar ( 236404 ) on Tuesday September 28, 2004 @01:02PM (#10375740)
    Why not do what the RIAA does ... and sue the people receiving the spam? Seems like that'd fix the problem ... right? Right?
  • I'm willing to bet that one of the schemes that the FTC is going to propose is one where it becomes illegal for "unlicensed" nodes to connect to a "licensed" MTA unless it is one with whom they have a standing agreement. In other words, you can't be an MTA without getting FTC approval, or "downstreaming" off of someone else's server.

    This won't really help SPAM, but it IS something the big ISPs want in order to begin to control where their competition can come from.
  • Whitelisting is an acceptable solution to the problem of spam. Most of the people who use email are *not* businesses and they only get mail from friends and family; a whitelist will leave their inboxes spam-free. If they want to get email from someone they've met on a forum or elsewhere they can easily add that person to their whitelist.

    As for companies it doesn't matter whether they get spammed or not. They aren't part of the target base that make spammers money. If everyone is using white-listing exc
  • When Ever some one sends an email they get an electric shock. Very minor a little tickle for normal use this is not an issue. For a spammer this will be far more hazardus.

Slashdot Top Deals

Solutions are obvious if one only has the optical power to observe them over the horizon. -- K.A. Arsdall

Close