Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Spam Security

Bye Bye Spam and Phishing with DKIM? 134

Posted by Zonk from the teflon-for-your-mailbox dept.
ppadala writes "While research from PEW Internet (PDF) shows that few users really are bothered by spam, IETF is supporting a public key cryptographic based e-mail authentication mechanism called DomainKeys Identified Mail (DKIM) Signatures . The new spec is supposed to help in fighting both spam and fraud. From Ars Technica: 'DKIM's precursor, DomainKeys, was originally developed by Yahoo. The specifications for DKIM were then extended by an informal group of IT organizations that included companies like Yahoo, Cisco, EarthLink, Microsoft, and VeriSign, among others. It was first submitted by the group to the IETF in mid-2005, but only recently published by the IETF. The spec is still to be incorporated into a more formal draft and submitted for approval, however.'"
This discussion has been archived. No new comments can be posted.

Bye Bye Spam and Phishing with DKIM? More

Bye Bye Spam and Phishing with DKIM?

Comments Filter:

  • Ah, yes the solution of the week (Score:2, Funny)

    by Anonymous Coward
    Does anyone have one of those templates where you check off the various reasons as to why this scheme won't work?

    • Re:Ah, yes the solution of the week (Score:5, Funny)

      by DMNT ( 754837 ) on Thursday May 24, 2007 @05:43PM (#19261597)
      Your post advocates a

      (x) technical ( ) legislative ( ) market-based ( ) vigilante

      approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) Spammers can easily use it to harvest email addresses
      ( ) Mailing lists and other legitimate email uses would be affected
      ( ) No one will be able to find the guy or collect the money
      ( ) It is defenseless against brute force attacks
      ( ) It will stop spam for two weeks and then we'll be stuck with it
      ( ) Users of email will not put up with it
      ( ) Microsoft will not put up with it
      ( ) The police will not put up with it
      (x) Requires too much cooperation from spammers
      (x) Requires immediate total cooperation from everybody at once
      (x) Many email users cannot afford to lose business or alienate potential employers
      ( ) Spammers don't care about invalid addresses in their lists
      ( ) Anyone could anonymously destroy anyone else's career or business

      Specifically, your plan fails to account for

      ( ) Laws expressly prohibiting it
      ( ) Lack of centrally controlling authority for email
      ( ) Open relays in foreign countries
      ( ) Ease of searching tiny alphanumeric address space of all email addresses
      ( ) Asshats
      ( ) Jurisdictional problems
      ( ) Unpopularity of weird new taxes
      ( ) Public reluctance to accept weird new forms of money
      ( ) Huge existing software investment in SMTP
      ( ) Susceptibility of protocols other than SMTP to attack
      ( ) Willingness of users to install OS patches received by email
      (x) Armies of worm riddled broadband-connected Windows boxes
      ( ) Eternal arms race involved in all filtering approaches
      (x) Extreme profitability of spam
      (x) Joe jobs and/or identity theft
      ( ) Technically illiterate politicians
      (x) Extreme stupidity on the part of people who do business with spammers
      (x) Dishonesty on the part of spammers themselves
      ( ) Bandwidth costs that are unaffected by client filtering
      (x) Outlook

      and the following philosophical objections may also apply:

      (x) Ideas similar to yours are easy to come up with, yet none have ever
      been shown practical
      ( ) Any scheme based on opt-out is unacceptable
      ( ) SMTP headers should not be the subject of legislation
      ( ) Blacklists suck
      ( ) Whitelists suck
      ( ) We should be able to talk about Viagra without being censored
      ( ) Countermeasures should not involve wire fraud or credit card fraud
      ( ) Countermeasures should not involve sabotage of public networks
      ( ) Countermeasures must work if phased in gradually
      ( ) Sending email should be free
      ( ) Why should we have to trust you and your servers?
      ( ) Incompatiblity with open source or open source licenses
      ( ) Feel-good measures do nothing to solve the problem
      ( ) Temporary/one-time email addresses are cumbersome
      ( ) I don't want the government reading my email
      ( ) Killing them that way is not slow and painful enough

      Furthermore, this is what I think about you:

      (x) Sorry dude, but I don't think it would work.
      ( ) This is a stupid idea, and you're a stupid person for suggesting it.
      ( ) Nice try, assh0le! I'm going to find out where you live and burn your
      house down!

      Not a bad try, though. Usually way more crosses on the form.

      • Re: (Score:1)

        by SP33doh ( 930735 )
        Asshats are obviously not accounted for.

      • Re: (Score:3, Insightful)

        by gbjbaanb ( 229885 )
        From what I've read about it.. my comments:

        (x) Requires too much cooperation from spammers
        (x) Requires immediate total cooperation from everybody at once
        (x) Many email users cannot afford to lose business or alienate potential employers nope, requires no coop from spammers, however you're right in that it requires everybody else to sign up to it. Usually these systems are a pie-in-the-sky 'nice idea', but the difference here is the backing of a standards body which will help takeup. Hopefully, enough implem

    • Users are not bothered by spam? (Score:5, Interesting)

      by Gary W. Longsine ( 124661 ) on Thursday May 24, 2007 @06:41PM (#19262431) Homepage Journal
      I find it difficult to believe that most users are not bothered by spam. As far as I can tell, legitimate email use has been falling dramatically for the past couple years, as people flee the effects of spam, switching to SMS and IM (Jabber, AIM, etc.) Email use within a single corporation remains popular, but home users seem to be abandoning email outright. Some people have given up ordinary email and only use locked-down email inside of social network sites. Spam seems to be killing email. If that doesn't bother people, it's only because they fled email for IM, SMS, and Myspace. If spam follows them, and they have nowhere else to run, they're going to become pretty irate.
      • Remember that most users aren't like anybody who reads Slashdot :-)

        Most users are on big consumer ISPs like AOL and MSN, and they do a good if nowhere near perfect job of blocking most of the spam, and they can usually recognize it from the titles and delete it without having to actually open it. And they're sufficiently used to getting *some* spam all the time that they actually see and delete, but to them it's just noise like TV commercials, not an offense like having their precious bodily fluids corru

      • Re: (Score:1)

        by Thwomp ( 773873 )
        That's just some clever spin thrown in because the guy's a spammer. I mean come on... check out the dodgy domain name linked to his user name. Do they even have the internet in Ecuador? That's a dead give away.
    • DomainKeys is not a solution to spam. What it lets you do is distribute and verify authority for email. It's a solution for email forgery, which is only slightly related to spam.

      • Re: (Score:1)

        by icknay ( 96963 )
        Forgery is very much related to spam. Here's how it works:

        spammy email -> spammer's source domain

        Think of this as extra good data for Spamsieve and the RBLs to use. If you are a spammer, how are you going to send a million emails without associating them all with a spammy domain? A different domain for each email? For each 100,000 emails? And of course it'll be easy to give a bad spam score to either a domain that was registered with the last week or a domain for which the world has not seen valid email
        • I'm not sure what DKIM does that SPF doesn't, but over 90% of SPF records are associated with domains owned by spammers. It takes seconds to register the domain and set up the record, and then they can keep using it until it appears on a block list. Then they switch to the next one.
    • "spam bothers few users", not all spans are harmful, some are useful:) MP4 Converter [mp4-converter.net]

  • Here we go again... (Score:5, Funny)

    by ZeldorBlat ( 107799 ) on Thursday May 24, 2007 @05:41PM (#19261565)
    This article advocates a

    (x) technical ( ) legislative ( ) market-based ( ) vigilante

    approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

    ( ) Spammers can easily use it to harvest email addresses
    (x) Mailing lists and other legitimate email uses would be affected
    ( ) No one will be able to find the guy or collect the money
    ( ) It is defenseless against brute force attacks
    (x) It will stop spam for two weeks and then we'll be stuck with it
    ( ) Users of email will not put up with it
    ( ) Microsoft will not put up with it
    ( ) The police will not put up with it
    ( ) Requires too much cooperation from spammers
    (x) Requires immediate total cooperation from everybody at once
    (x) Many email users cannot afford to lose business or alienate potential employers
    ( ) Spammers don't care about invalid addresses in their lists
    ( ) Anyone could anonymously destroy anyone else's career or business

    Specifically, your plan fails to account for

    ( ) Laws expressly prohibiting it
    (x) Lack of centrally controlling authority for email
    ( ) Open relays in foreign countries
    ( ) Ease of searching tiny alphanumeric address space of all email addresses
    ( ) Asshats
    ( ) Jurisdictional problems
    ( ) Unpopularity of weird new taxes
    ( ) Public reluctance to accept weird new forms of money
    (x) Huge existing software investment in SMTP
    ( ) Susceptibility of protocols other than SMTP to attack
    ( ) Willingness of users to install OS patches received by email
    ( ) Armies of worm riddled broadband-connected Windows boxes
    ( ) Eternal arms race involved in all filtering approaches
    (x) Extreme profitability of spam
    ( ) Joe jobs and/or identity theft
    ( ) Technically illiterate politicians
    (x) Extreme stupidity on the part of people who do business with spammers
    (x) Dishonesty on the part of spammers themselves
    ( ) Bandwidth costs that are unaffected by client filtering
    (x) Outlook

    and the following philosophical objections may also apply:

    (x) Ideas similar to yours are easy to come up with, yet none have ever
    been shown practical
    ( ) Any scheme based on opt-out is unacceptable
    ( ) SMTP headers should not be the subject of legislation
    ( ) Blacklists suck
    (x) Whitelists suck
    ( ) We should be able to talk about Viagra without being censored
    ( ) Countermeasures should not involve wire fraud or credit card fraud
    ( ) Countermeasures should not involve sabotage of public networks
    ( ) Countermeasures must work if phased in gradually
    ( ) Sending email should be free
    (x) Why should we have to trust you and your servers?
    ( ) Incompatiblity with open source or open source licenses
    ( ) Feel-good measures do nothing to solve the problem
    ( ) Temporary/one-time email addresses are cumbersome
    ( ) I don't want the government reading my email
    (x) Killing them that way is not slow and painful enough

    Furthermore, this is what I think about you:

    (x) Sorry dude, but I don't think it would work.
    ( ) This is a stupid idea, and you're a stupid person for suggesting it.
    ( ) Nice try, assh0le! I'm going to find out where you live and burn your
    house down!

    • Why would you mod this down? (Score:1, Informative)

      by Anonymous Coward
      Why is this modded redundant? It was posted earlier than the one above that was modded funny.
    • Wouldn't it be funny if that silly little checkbox list was actually created by some spammer originally as a cover for their real objections to a spam fighting system that they were actually scared of.

  • It's only a server validiation solution (Score:5, Insightful)

    by jimpop ( 27817 ) * on Thursday May 24, 2007 @05:43PM (#19261593) Homepage Journal
    It's only a server validiation solution. DKIM won't stop spam. DKIM will only help validate the identity of the server that is sending you email. Right now I get lots of spam from legitimate Yahoo, Mail.com, and Hotmail servers. DKIM isn't going to stop that it's only going to reinforce what I already know.

    • Re:It's only a server validiation solution (Score:5, Insightful)

      by MightyMartian ( 840721 ) on Thursday May 24, 2007 @05:52PM (#19261765) Journal
      A quick read of the RFC tells me that this is simply a more computationally-intensive variant of SPF. It still requires rewriting the headers for forwarding, will likely not have the degree of adoption so that anyone in charge of a mail system actually feels confident enough to use it as another weighting factor for testing spam, and still leaves those sitting behind systems that still force users with outside email addresses to use their mail servers. The mere fact that any such system (SPF, DomainKeys or whatever) has to essentially remain completely compatible with older SMTP-based systems means that it really won't solve the problem. The underlying SMTP relay system has problems, and Domain Keys and SPF are just kludgy solutions that really are limited in what exactly they can solve.

      • Re: (Score:3, Funny)

        by madsheep ( 984404 )

        A quick read of the RFC tells me that this is simply a more computationally-intensive variant of SPF.
        But the real question is will it prevent me from being sunburned??
      • DKIM doesn't solve most of the spam-related problems I care about, but there's one thing it's good for:

        An outgoing-email service provider that uses DKIM on all of their outbound mail can validate that a spam or abuse complaint about mail purporting to be from exampleuser@their-domain.com really was from that user and not a forgery, so they can kill off that user's account without worrying about false positives or faked complaints or joe-jobs. They can read the message text to see that it's spam, and they c

      • Re: (Score:1)

        by icknay ( 96963 )
        Parent is incorrect! DKIM accounts for forwarding and other use cases ... exactly the cases for which SPF has problems. Seriously .. do you think the IETF working group works on this thing for years, and doesn't think of some case you thought of from "A quick read of the RFC" ?

        DKIM in conjunction with SPF and client filtering has a real chance to make Spam be not such a problem. It enables reputation system for senders, and Spammers will show up in such a system in a pretty obvious way. It will make far bet

      • Re: (Score:2)

        by grahamm ( 8844 )
        DKIM does NOT re-writing headers for forwarding. Unlike SPF (which I also use) it requires absolutely no action on the part of forwarders to preserve the validity of the signature. That is, unless the forwarder changes an existing header such as mailing lists adding [listname] to the start of the subject. With use of the 'l=' parameter it will even survive those forwarders who add a footer to the body. Though it could be argued that use of the 'l=' feature, and not making it obvious to the recipient where t
    • And how is this different from what is currently available with PGP?
      We could just all agree tomorrow to not accept any mail that is not digitally signed right?

      • Re: (Score:2)

        by hpavc ( 129350 )
        How does PGP stop spam? Just because someone is listed on a key server doesn't mean much.

        DK tells me that the mail message actually belongs to the domain and its mail server. Its not user to user but rather server to server (a server validating a server's output). It also doesn't use a CA or other notary, it uses a dns record.

        • Re: (Score:1)

          by maxume ( 22995 )
          You just have to do two things:

          Mark people who it isn't worth accepting mail from as it comes in. That they sign their messages means that you only have to deal with each identity(-not person...) once.

          Only accept mail from people who someone you trust trusts. Or play a few degrees of Kevin Bacon.

          Do that, and anonymous crap floods disappear. All that said, I don't want to have to set such a thing up to be able to exchange messages with my mom, so let's not do it.

          • Re: (Score:2)

            by thogard ( 43403 )
            I get a few messages a month from people that your system would say are spamers. There is no way to tell a legit 1st contact email message from a spammer on todays net.
    • The only way to stop spam is to increase the burden on everyone who sends mail, rather than passing the burden onto those receiving it. Mail servers of the sender should store the message until it is retrieved by the receiver. That way, the spammers would have to keep their mail server online till a significant number of recipients have downloaded their mail. This would increase the time available to law enforcement (or vigilantes) to shut down the server before the spammer acheives his objective. It al

      • Re: (Score:1)

        by jimpop ( 27817 ) *
        "Mail servers of the sender should store the message until it is retrieved by the receiver." That would require spammers to be honest. I'd think you would have better luck convincing lawmakers to pass a law that all persons who take cash out of bank remain until the bank and customer(s) are satisfied that the transaction was upright and complete.
        • This already happens. Why do you think banks sit on deposited cheques till they clear before crediting the cheque amount to your balance?

    • Re: (Score:2)

      by richi ( 74551 )
      Quite.

      DKIM is not an anti-spam technique, at least not directly. We need other pieces of the puzzle before it's useful for fighting spam. See m'blog for more [richi.co.uk].

  • few users (Score:5, Insightful)

    by Anonymous Coward on Thursday May 24, 2007 @05:43PM (#19261601)
    spam bothers few users

    Dunno about anyone else, but as the admin for our company, I get more complaints about spam than anything other single item I can think of...

    • Re:few users (Score:5, Informative)

      by WrongSizeGlass ( 838941 ) on Thursday May 24, 2007 @06:09PM (#19261999)
      Ditto.
      The ISP of one of my clients just turned on 'greylisting' and their mail volume dropped 71%, knocking their spam % down to 11% of their new volume.

      They would rather spend the budget on stopping spam rather than upgrading their servers. It's that big of a problem.

      DKIM will help (until fake 'certificates' show up) but it won't solve the problem. Only flame-throwers, and lots of them, will fix this once and for all.

      • Re: (Score:2)

        by rthille ( 8526 )
        Greylisting worked really well for me, but I've been starting to get spammers that retry (not sure if they are retrying the same message, or a new one, since my greylisting software just goes by IP, not the tupple), so I've been meaning to feed back IPs from mails I identify as spam into the greylisting software and have it dark-dark-gray list them...
        • This is pretty easy to do with OpenBSD. OpenBSD's spamd does greylisting, and you can use SpamAssassin rules to provide it with data (which I then use for blacklisting). I use this as the first tier (since it just uses IPs, and has almost no cost), and then an RBL from the MTA to reject more if they are from known spammers. The nice thing about this pairing is that even if spammers do decide to retry, they usually wait until after they have been spotted and added by Spamhaus.

          I might have lost mail, bu

      • Greylisting only works because spammers haven't changed their bots to do a retry. This is starting to change, since spammers have way more cpu cycles and bandwidth to work with then I'll ever have. I do use greylisting to great success, but I've started seeing the effectiveness dip occasionally. It is only a matter of time before the curve catches up, and I'm positive this DKIM will be no different. Here are some numbers from yesterday on my little host:

        greylist stats:
        561 New blocks
        509 One hi

    • Re: (Score:2)

      by antic ( 29198 )
      I think badware is a far more dangerous and significant concern than spam.

      Spam is a big issue for administrators, web developers, etc - probably not quite as annoying for other users.

  • Because keeping me from running a mail server has not done a damn thing to the spammers.

    I'll believe in an anti-spam tech when it comes in the Debian repository and I can once again run a mail server. Until then, I'm afraid the spammers will be the first to sign up for any counter measure.

    • Re: (Score:3, Insightful)

      by mi ( 197448 )

      Will my ISP Quit Blocking Port 25, Finally?

      If they "protect" your port 25, they are morons, and you should complain or switch the ISP. If they are blocking your attempts to reach other people's port 25, they should be commended.

      Your system may be immune, but hordes of "zombies" would be sending spam from your ISP's network. As things stand, the zombies are still infected, but can not send e-mails directly to victims, which throttles the rate a lot.

      You can still run a server — just configure your

      • Bah, my ISP blocks port 25 this way. Of course, I can just go to the service pages and turn the protection off. Average Joe don't direct connections to mail servers, and I don't think that there are any trojans attacking the (frequently changing) service pages of my ISP - if you never log into them they don't know the password anyway. They used to charge for email scanning as well, but I (and others) pointed out that infected machines were their problem as well. Now it is included in the charge, and you can

        • Shit, what is your ISP? I want some!

          I've got Verizon DSL right now, and 1) they block port 80 inbound (they turned it off for that big worm, and never turned it back on), and 2) they're very lame.

      • You can still run a server -- just configure your ISP's server as the "smart host". There is no shame in that.

        Unfortunately it's still a problem with the ISPs who don't let you send out email through their servers unless the Reply-To address is within their domain. I haven't run into this recently, so maybe it's only a feature of the very low-end dialup ghetto, but I definitely ran into it once or twice.

        This is a serious issue, if it occurs together with the blocking of outgoing connections on Port 25, beca

        • Re: (Score:1)

          by damium ( 615833 )
          GMail allows authenticated relays through port 465 if you want to use another address. This is also how I setup my mail servers. IMHO clients should stop using port 25 for sending out email port 25 should be for server-to-server and legacy connections only.

      • If they are blocking your attempts to reach other people's port 25, they should be commended. Your system may be immune, but hordes of "zombies" would be sending spam from your ISP's network.

        This has already failed and failed miserably. There are hordes of zombies sending spam from my ISP's network. They all do as you recommend and use the ISP's SMTP server and this is why more than 80% of all spam comes from zombies. My upload is also capped by my cable modem at a pathetic 60 kB/s.

        A better method

        • This has already failed and failed miserably. There are hordes of zombies sending spam from my ISP's network. They all do as you recommend and use the ISP's SMTP server and this is why more than 80% of all spam comes from zombies.

          Then your ISP is missing the other piece of the puzzle, which is to rate-limit outbound SMTP on a per-client basis. 250 messages per hour or something ought to deal with most normal users. And if they notice that someone is sending out thousands and thousands of messages, they sho

    • Re:Will my ISP Quit Blocking Port 25, Finally? (Score:4, Interesting)

      by killjoe ( 766577 ) on Thursday May 24, 2007 @06:26PM (#19262257)
      Here is what I would like.

      If an IP address makes more then X connections to my SMTP port at the same time it gets routed to a teergrube.
      If an IP address attempts to send email to Y number of invalid users it gets routed to a teergrube.
      If an IP address sends me Z number of spam as marked by spamassassin it gets routed to a teergrube.
      If an IP address is on the RBL of my choice it gets routed to a teergrube.

      And of course a teergrube which can handle a few hundred simultaneous connections and keep them busy for hours.

      If we all had all this then at least we could make a dent in the amount of spam going out.
      • Check rDNS - if it doesn't exist, drop it.

        If rDNS resolves to Comcast's home addresses (and other ISP's), drop it.

        If rDNS resolves to Comcast's (HotMail's, GMail's, AOL's, etc) mail servers, run it through SpamAssassin and drop it if it scores above 8. (HotMail has a problem with this because they add mortgage spam to their outbound messages).

        Okay, that should have taken care of 90% of the problem.

        • Re: (Score:2)

          by laffer1 ( 701823 )
          Differentiate between HOME and BUSINESS comcast accounts. My mail server is blocked because I'm on a comcast business package. There is a big difference between the $45 account and a business grade $160 account. I can't afford a big pipe and i'm punished for it. As for reverse dns, try getting comcast to properly setup the ptr record for you.

          Upon random checks of spam lately, most of it is coming from IPs with valid A/PTR records that are also mail servers. Botnets still exist, but I think spammers are

    • Re: (Score:2)

      by Holi ( 250190 )
      Try DynDNS mailhop relay, relays smtp to any port you choose.

    • Re: (Score:1)

      by rolfc ( 842110 )
      SPF comes in the Debian Repository, so you can run your mailserver.
    • Um, firewalling outgoing connections to port 25 to any server but theirs is a *good* thing.

      Why? Because there are approximately 5 people on your ISP including you who have real, actual mail servers. One of them is properly configured NOT to be an open relay. And there are 10,000 people on your ISP with virus-laden windows boxen, bypassing their outgoing mail server (so that they can send spam faster) and connecting directly to the foreign server's incoming SMTP port to send spam.

      So an ISP reduces the amount
  • Comment removed based on user account deletion

  • yahoo press release (Score:4, Informative)

    by Ramses0 ( 63476 ) on Thursday May 24, 2007 @05:48PM (#19261681)
    http://yodel.yahoo.com/2007/05/22/one-small-step-f or-email-one-giant-leap-for-internet-safety/ [yahoo.com]

    It also has some nice background information on DKIM.

    --Robert
    • Phishing, maybe if enough real organizations support it - spam, no fix here, folks. The only thing DKIM prevents is domain spoofing. So spammers have to have a real domain and sign their mail - that's so incredibly hard to do that I don't think any spammer wil... er, wait, a quick check of my spam box shows an unbelievable number are signed correctly.

      On the other hand, if spammers are authenticating with a real domain, then filtering based on RBLs just got easier...

      Also, exim guys - we could really use MT

  • Prefer SPF (Score:2, Interesting)

    by Anonymous Coward

    Microsoft, despite its involvement in submitting DKIM to the IETF, is still backing Sender ID and recently bragged that it protects over 8 million domains worldwide.

    No Microsoft, SPF is protecting 8 million domains. Nobody publishes SenderID records, you are misrepresenting the intent of millions of domain holders to claim otherwise! What's worse is that the whores in the IETF working group were complicit in this misrepresentation and have the audacity to blame the SPF guys.

    I was looking into DKIM earlier

    • Re:Prefer SPF (Score:4, Interesting)

      by MightyMartian ( 840721 ) on Thursday May 24, 2007 @06:02PM (#19261913) Journal

      SPF is protecting 8 million domains
      I think the proper phrase is "SPF has cluttered up the TXT field of 8 million domain records, most of them with NEUTRAL because no one has the balls to actually let this creature roam the Internet without a heavy chain".

      I believed in SPF about three years ago, but it became very clear that it (and Sender ID too) wouldn't do a damn thing, and Domain Keys seems no different.

      • Re: (Score:2)

        by Degrees ( 220395 )
        I'm kind of surprised that people place SPF records out there as Neutral. Mine says Fail if the sending MTA is not in my specific IP address range. Period.

        Now admittedly, I don't have users that want to be outside our network and send mail as if they are inside our network. This is a problem I expect a huge corporation (or like you say in another post: an ISP) might have. But for every small business (or even medium sized business or agency), I'd think it would be SOP.

        I guess I don't see the downside to p

        • I found greylisting to be by far the most reliable solution, but it does have the trade off that some legitimate mail is going to be delayed. Unfortunately in the age of high speed Internet, people just assume that email is a form of instantaneous communications, so when a message gets delayed for an hour, they freak out and phone tech support insisting that the mail service is busted. I had a Postfix configured at the front end that was doing nothing more than verifying that incoming mail was going to le
      • I think the proper phrase is "SPF has cluttered up the TXT field of 8 million domain records, most of them with NEUTRAL because no one has the balls to actually let this creature roam the Internet without a heavy chain".

        The majority of our domains are all tagged with "-all" at the end. The remainder are all ~all and I plan on switching them over shortly.

        SPF requires upper-tier support from your executive team and an understanding of the issues. (Sell it as a legal issue because it serves as public n
  • not users by VeriSign and others who will sell hundreds of million domain names encryption keys

    is it time to buy shares ?

    • Re: (Score:1)

      by bmzf ( 731840 )
      NO. DKIM is an improvment upon Domainkeys. SPF says which mail servers are ok to be sending mail for a specific domain. Domainkeys verifies that the email is coming from the source that it claims and that the contents are not tampered. SPF + Domainkeys = full accountability for emails sent. I.E. all emails are immediately traceable to the source. At least with Domainkeys, the mailer generates the certificates himself. Uses part to encrypt on his server, and publishes the public portion in DNS, where SPF

  • Sooooo close... but not going to work. (Score:5, Insightful)

    by NerveGas ( 168686 ) on Thursday May 24, 2007 @06:04PM (#19261945)

        My initial thought was "Terrific. This really has the potential to eliminate spam." Then I got to looking into the RFC... standard private/public key exchange. But, it allows for individual MUAs to posess the private key, such that they can perform the signature.

        This puts the entire burden of security in the scheme upon the MUA. So any time a machine is infected with the spam-virus of the day, that private key will be sent off to the spammers, who will send out floods of seemingly legitimately-signed email. Instead of just selling valid email addresses to other spammers, they'll sell addresses and domain keys.

        Furthermore, from an administrative perspective, that means that each time one of your user's machines is hacked and the private key compromised, you have to change your public/private keypair, including updating the MUA on *all* of your sender's machines.

        Forcing signing upon the MTAs eliminates much of that work (and hopefully the security exposure), but forces inconvenience on a good number of users. It's a tradeoff I'd be willing to make, but the RFC doesn't seem willing to do so.

    • Re:Sooooo close... but not going to work. (Score:4, Informative)

      by MightyMartian ( 840721 ) on Thursday May 24, 2007 @06:16PM (#19262103) Journal
      You've come close to what I arrived at in the last few months of my job working for an ISP, that all these kludgy attempts to beef up SMTP would always be fatally flawed unless we (and by that I mean Joe Average and admins) was prepared for inconveniences. That means putting an end to straight-out forwarding, because that pretty much busts everything without the major overhead of rewriting the headers. It means locking down the servers themselves and not expecting some "good neighbor" protocol to somehow magically take care of the problem. As someone else has pointed out, how is DomainKeys any different than PGP signing, which has been around for two decades now. Even if we went to DomainKeys or PGP, it still wouldn't stop all those zombies out there from happily sending signed spam. It means that distributed dictionary attacks would have to come in with a legitimate address from the source network, but I doubt the spammers are going to give a damn about that.

      The problem with spam is that it isn't just an email problem. If it was, then we'd all have had this beat a long time ago.
      • Without having read the RFC and just inferring the pub/private key system is similar (or identical) in principal to PGP/GPG signing system, can't these private keys be encrypted themselves on the machines running the MUA? Then if the private key is taken, spammers still can't use it. Am I missing something or is it just too much of an inconvenience to have to enter in your passphrase when you want to use email?

        • Am I missing something or is it just too much of an inconvenience to have to enter in your passphrase when you want to use email?
          First, yes that's a lot of effort. Second, if you've got a trojan that can send mail, there's nothing stopping it from spoofing the 'enter password' dialog and stealing the key.

    • Re: (Score:2)

      by Magila ( 138485 )
      Securing MUAs shouldn't be too big of a problem. ISPs just have to charge a replacement fee when a user's private key is compromised. Same as landlords charging a lock replacement fee when you loose your keys. The vast majority of users will wise up pretty quick after being slapped with a couple of 50$ fees.

      DKIM allows a domain admin to create a hierarchy of authorized keys. So each MUA can have it's own key-pair .
    • Actually, DKIM permits MUAs to sign and verify messages, but we really expect the vast majority of DKIM signing and verifying to be done my MTAs, at the domain level. The ability to delegate keys to individual users is to handle those few cases where an individual user needs to sign a message, plus other outsourced functions (such as an enterprise's outsourced benefits provider) where a party outside the domain needs to be able to apply a signature. It's less of a leap of trust to do this when the key is

  • I am trying DKIM (Score:2, Interesting)

    by wizeman ( 170426 )
    DKIM is great except, AFAIK:

    1) There's still no way of saying "my domain always signs email with DKIM, so no signature means forged mail". At least I couldn't figure it out.
    2) Mailing lists add a footer which messes with the signature.

    As a consequence DKIM at the moment is completely useless since even though all my emails are signed, spammers/phishers can simply not put the DKIM signature and DKIM wouldn't know if the email was forged or not.

    Furthermore, DKIM is reporting that a lot of valid emails posted

    • Re: (Score:1, Informative)

      by Anonymous Coward
      1) There's still no way of saying "my domain always signs email with DKIM, so no signature means forged mail". At least I couldn't figure it out.

      Basically you omit the t=y dns entry and specify o=-, but because of the relative immaturity of the standard, it might be ignored.

      2) Mailing lists add a footer which messes with the signature.

      It really depends at what stage you add the footer. The intent of DKIM is to verify at the MTA level, so if you can check the signature before you change the message con

  • And they both fail.

    Either the domain owner controls and administers the key, in which case spammers (who already use automated bots to registers hundreds, if not thousands, of domains per day) will simply add a new subroutine to the domain registration bot to add in the key, thus ensuring the delivery of their spam.

    Or someone else controls your email, which mean nobody with any sense will buy in to it.

    Either way, it's useless for combatting spam, as was DomainKeys and SPF.
  • Page 5 of the PEW Internet study reports that "...only 4% of email users admitted to action that keeps the spam industry viable, which is ordering a product or service from an unsolicited email. This number has always been low; it was 7% in 2003, 5% in 2004, and 6% in 2005."

    These figures are interesting because there is often speculation about these numbers during conversations about the financial viability of being a spammer. The article suggests that these figures are "low" but they are much higher t
  • What makes you think that this is going to do anything for junk email. Until the burden of the spam is placed on the sender and not the receiver this problem will never go away. See http://cr.yp.to/im2000.html [cr.yp.to] for a workable solution.

  • My solution... (Score:1, Informative)

    by Anonymous Coward
    click [mailto]

    • click [mailto]

      Hmm, good, except that at some point you will have to enter your pass code (the "Do_not_edit_this_subject_line_or_I_won't_receive_ your_email!" part) into a website so that the website can e-mail you, and then all the spammers have to do is build a database of addresses paired with codes.

      So, your solution will work fine until a significant number of people are doing it and the spammers learn about it.

  • Every message *received* needs to be run through an expensive cryptographic routine. If you have high incoming mail volume, just watch your server load skyrocket when DK/DKIM is turned on. You also have to completely accept the entire message before DKIM can be used. With SPF, you can simply reject after the envelope-sender is specified and before the headers and data.

  • explode button (Score:3, Funny)

    by timmarhy ( 659436 ) on Thursday May 24, 2007 @07:19PM (#19262889)
    until there is a button which i can click on each email and cause the sender of the mail to explode an a bloody rain of guts and gore, spam will not end.
    • At least SOMEONE understands how things work.

      You're absolutely right. Until near-certain death is the consequence of spam, there will be spam. No technology will prevent that.

  • With SPF, you validate which mail server your getting mail from.

    with DKIM, your validating which mail server and a heavy crypto message to compute with SPF.

    SPF is only going to fail if you go to a spoofed dns server, or if your mail server is rooted. So where do you get the DKIM sig from. What if it's spoofed?

    To make validating your mail server work, all the mail servers have to have SPF entries. The same with DKIM. If I had to vote for one or the other, SPF is good enough. DKIM costs to much, I don'

  • barking up the wrong tree (Score:3, Interesting)

    by DaMattster ( 977781 ) on Thursday May 24, 2007 @07:46PM (#19263209)
    I think the OpenBSD guys have the best solution to spam bar none. Rather than adding fancy verification, authentication, or filtration layers, they engage in a technique to make the spammers hurt: tar-pitting. Why not force spammers to put up with an SMTP server that is so slow that it causes them to choke. The best solution for fighting spam is not through processor expensive filtration or key decryption process but through a combination of greylisting, greytrapping, and greyscanning. These methods bring about measurable results. This is ingenious. I have set up an OpenBSD spamwall at my father's business. We have gone from several hundred spam messages per day to only 10 per week. In a 24 hour period we were hit with 2000 smtp connection attempts. Of those 1992 of them gave up. The biggest complaint I have recieved was that they were not getting enough spam and there was concern that legitimate email might be lost. Our spam wall has been in service for a month without problems. The system is not perfect, but a drastic reduction is realized. These methods hurt the spammer and if enough people employ them, spam may become a thing of the past. The absolute worst thing that could happen is that a legitimate email might be delayed by 4-6 hours.

    • Re: (Score:2)

      by gringer ( 252588 )
      Your description reminds me of the greylisting and "could you please try sending that again in an hour or so" approach [acme.com] of Jef Poskanzer. Read more about his troubles here [acme.com].

      Oh, and remember: address@example.com is a better choice for email addresses used in examples, as it uses one of the reserved domains from RFC2606 [faqs.org].

    • Re: (Score:2)

      by dodobh ( 65811 )
      Because the spammers have all those zombies under their control. Your resources are far more expensive than the most expensive spammer resources.
  • >>"While research from PEW Internet (PDF) shows that few users really are bothered by spam,"

    ARE THEY JOKING? few users are bothered by spam??? Everyone I know, both personally, and at work, gets bombarded by 100s of spam email messages a day and is getting quite irate. The discussion about how useless email has become due to spam comes up almost on a daily basis amont me and my associates. Email was a GREAT way to communiacate, but has quicly become quite useless due to all the spam and the associated
  • Instead of trying to validate mail, just make it computationally expensive to send. Anyone with a compromised Windows box will know immediately because it will be running at 100% CPU utilization constantly. Even if they don't have the technical expertise to know what's wrong, they'll still have an idea that it's broke.

    How come these guys never realize that if a scheme can't stop bots, it's worthless. Also, all these fancy schemes are bound to fail because they try to make fighting spam the lever to get
    • Have the client do the hashcash signing when they connect to Yahoo/GMail/Hotmail and send a message. Speed will be a problem but that can be solved by plugins or modified browsers (add a native-code SHA-256 function callable by JavaScript).
  • I just want to say one word to you. Just one word.

    Botnets.
  • Any spam solution that uses Comic Sans on its web site [dkim.org] is no spam solution.

    Maybe that should be added to the spam solutions form?
  • A good solution for spam, phishing etc would be the bi-directional login.

    As it is right now, we users log in a server and use the available services, but we don't know if the server is what it claims it is. The server may know us because we have submitted a username and password, but we don't know if the server is the correct one. Right now login is uni-directional.

    One solution to phishing would be bi-directional login: not we users submit a password to the server, but the server submits a password to us. I

Slashdot Top Deals

Heisenberg may have been here.

Close