republican-creole
Search:  

 
 
   News
newer
story category Debating Domain Keys
Yahoo's plan a cure, or a placebo?
(old news - 08:01PM Tuesday Jan 13 2004)
tags: spam
We recently gave an overview of Yahoo's Domain Keys proposal, an anti-spam open-source system that uses public key cryptography to digitally sign e-mail and verify its origins. However many anti-spam crusaders aren't thrilled by the idea of putting such plans into the hands of the mega-ISP's. As this Business Week On-line article explores, there's a growing number of anti-spam experts finding fault with Yahoo's plan. Among the concerns are thoughts that DomainKeys would be vulnerable to "Replay attacks", where spammers steal a digital signature from a verified e-mail and use it as phony authentication. There's also simply an undercurrent of dislike across many anti-spam mailing lists for mega-corporations and ISP's (with marketing relationships and "legit" mailers to protect) taking the reins on such a project. Yahoo suggests the open-source nature of the project should indicate they're willing to move forward with community support.

Related:
  1. Scammers Try To Salvage McColo Data
  2. McColo Closure Forces BotNet Shift
  3. Can Spam Act Celebrates Five Years Of Ineffectiveness
  4. Google #4 On Spamhaus Spam Network List
  5. AT&T Slammed For Text Message Spam
  6. Verizon To Finally Crack Down On Spam
  7. Your Constitutional Right To Spam
  8. FTC Shuts Down 'Rogue' ISP
Forums » Debating Domain Keys
view: topics flat text 
Post a:

PhoenixDown
-- Wants FIOS
Premium
join:2003-06-08
Fresh Meadows, NY
clubs:

Then who should take it on?

Then who?
tugrul

join:2000-11-23
Forest Hills, NY

Sender Permitted From (SMTP+SPF)

AOL is already onboard testing SPF, as noted in the news section on the project's front page, discussed on slashdot and verified by dig as I post:

aol.com. 300 IN TXT "v=spf1 ip4:152.163.225.0/24 ip4:205.188.139.0/24 ip4:205.188.144.0/24 ip4:205.188.156.0/24 ip4:205.188.157.0/24 ip4:205.188.159.0/24 ip4:64.12.136.0/24 ip4:64.12.137.0/24 ip4:64.12.138.0/24 ptr:mx.aol.com ?all"

Logan 5
Silver and Black and blue in 2009
Premium,MVM
join:2001-05-25
The WasteLAN
·Pacific Bell - SBC

At least they're making an attempt at curbing spam

It's easy for the 'nay-sayers' to sit back and criticize the "woulda, coulda, shoulda" of this issue then to get off their duffs and actually come up with something better.

It's just another put up or shut up argument. Either contribute to the solution or stop being a part of the problem.
--
Member of BBR Team Ecology

mod bait
Premium
join:2001-06-11
Rochester, NY

Re: At least they're making an attempt at curbing spam

That doesn't make sense. One can look at a problem, look at a proposed solution to the problem, and know that the proposed solution is not viable, even in lieu of another proposed solution. If you have a gaping abdominal wound, and someone says "CUT OFF HIS LEGS!", I can pretty confidently recommend against doing that, even if I don't know what else to do.

Maggs
Premium
join:2002-11-29
Woodside, NY
·RCN CABLE

How about domain keys with serial numbers

How about a system of domain keys, with each provider giving you a special serial number to enter every time you log on to your email, each session is given a different number. That way the provider would know it was you that was accessing the email, and what time the serial number was obtained and from what IP address the serial lease was given to basically like an IP addressing system, but with serials.

I know this is just a thought, most things on the internet can be spoofed and things can get into the wrong hands.


--
What's black & white and cool all over? Optimized
vlovich

join:2001-12-08

Re: How about domain keys with serial numbers

Then there goes your ability to send an anonymous email. And what about email services that aren't provided by the ISP? And what stops you from using a proxy when sending emails?

TheMadSwede
Premium
join:2001-01-30
Holland, MI
·Charter Pipeline

Re: How about domain keys with serial numbers

said by vlovich See Profile:
Then there goes your ability to send an anonymous email. And what about email services that aren't provided by the ISP? And what stops you from using a proxy when sending emails?

I'm asking this rhetorically, and less from a technical perspective than a practical one. Why does anyone need to send anonymous email?
--
Hey - there's this thing called spell check...
medfly

join:2003-05-15
Windsor, CO

yahoo spams themselves

yahoo does spam runs from a series of servers named mailer(some number).bulk.scd.yahoo.com

I run my own mail server, and host family and friends's accounts on it. Despited repeated nasty grams from me (the post master) telling yahoo spam isnt accepted period on my server (my 220 banner also states my policies), the spam kept coming. Fortunately a quick and heavy handed use of iptables on their spam er bulk servers fixed the problem permanently.

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
·FrontierNet Intern..

It could work if done right.

We have DNS servers that work right.

These things update every 10 minutes or less..

The domain keys could be done in the same manner. One companies creates the keys on a daily basis allowing each domain up to 3 keys. Simply allow access to aging keys and push out the old keys as time passes. Since the keys change on a day by day base it would be hard to forge them if the keys are maintained by a single domain server.

In this manner if someone hacks a key they will only have 3 days to use the key before it no longer works. This 128bit key would be hard to crack day by day and would cost more money to spam than most spammers can handle. After the oldest key ages out all servers should have been caught up on the new authentication keys. This would help insure that the domain sending the key owns a new code about the same time the spammers has hacked it. Even then a central server could handle these much like the DNS servers are handled today.

--
Sarick's Dungeon Clipart Page
Trouble spelling? www.iespell.com
yabos

join:2003-02-16
Ingersoll, ON

Domain keys would work

The key used to sign the message is private, and the signature is dependant on the entire content of the email message. If the spammers find a key, it will still be rejected because the decryption via the public key wouldn't match the signature.

flw
Security Is Like An Onion, It Has Layers
Premium
join:2004-01-04

Re: Domain keys would work

I don't really care who takes the spammers on or with what methods, but someone must start to do something before general public email becomes a waste heap that people just ignore and stop using.

Doing something is better than doing nothing.

Sarick
It's Only Logical
Premium
join:2003-06-03
USA
·FrontierNet Intern..

Re: Domain keys would work

said by flw See Profile:
I don't really care who takes the spammers on or with what methods, but someone must start to do something before general public email becomes a waste heap that people just ignore and stop using.

Doing something is better than doing nothing.

I couldn't agree more. people need to get off their rears and solve this spam problem.
--
Sarick's Dungeon Clipart Page
Trouble spelling? www.iespell.com

Nightfall
My Goal Is To Deny Yours
Premium,MVM
join:2001-08-03
Grand Rapids, MI
·AT&T Midwest
·Site5.com
·Comcast

Re: Domain keys would work

said by Sarick See Profile:
said by flw See Profile:
I don't really care who takes the spammers on or with what methods, but someone must start to do something before general public email becomes a waste heap that people just ignore and stop using.

Doing something is better than doing nothing.

I couldn't agree more. people need to get off their rears and solve this spam problem.

The problem is that for every idea that is proposed, people crap on the idea. I have heard a lot of ideas and I think they are all good ones. Lets start researching these ideas to see if they work. Heck, lets implement a system and give it a try. Anything is better than what we have now...which is nothing.
--
My Domain
Nightfall's Hockey and Life Journal
russotto

join:2000-10-05
Collegeville, PA

Re: Domain keys would work

The reason people crap on a lot of these ideas is that they have really nasty side effects. Destroying the net in order to save it is NOT a good idea.

damonlab
Premium
join:2001-05-02
Detroit, MI
clubs:

I am trying to help solve the spam problem at my work. About 100 users on an exchange box. We are about to evaluate GFI (»www.gfi.com/mes/) as a potential solution. It has had some good reviews from some dslr members.

CSource

@adelphia.net

Re: Domain keys would work

The source should be closed.

There is no reason for the general public to see the source code. All we need is the end result.
iwantbw

join:2003-12-30
Cotati, CA

creating the "charge for email" infrastructure..

This will probably do little for reducing spam worldwide, but it will set up for creating barriers for access to the email boxes of customers of large isps.

Pay our buddies at Verisign some $$ for a cert if you want to send mail to yahoo boxes - this won't stop spammers.
The next step will be:
We have tracked the number of emails received at Yahoo! mailboxes this month via your "authenticated" key, please find the invoice below. Remember you can pay with YahooFastPay(tm). If someone has hijacked your Yahoo!DomainKey(tm), please go to »good.luck/gettingthisworkedout.html

No thanks, there are plenty of useful mailing lists, email newsletters, etc that would not be viable if there was a charge for sending email.
When trying to find solutions to the spam problem, I use the following criteria as a starting point:
I want a system that:

•reduces spam.
•preserves the option of anonymity and privacy
people easily forget that not everyone or every situation allows people to express their views without fear of retribution.
•does not require good citizen to "show their papers" in order to access resources on the internet.
•does not create great administrative or machine resource loads.
•does not support censorship without due process (like BLs).
•Puts the control over what they want to receive in the hands of the users, not the sys admins or giant isps.
•does not put control in the hands of a single or a few companies or government agencies.
•minimizes impact on delivery of legit emails.

There are techniques and software that are making major inroads against spam and viruses - the most visible are bayesian filters for servers and clients. Though extremely successful, these tools put the resource burden on the recipients, thus they have reduced the amount of spam read but not the amount of spam sent.

But there are some very interesting projects that, even if only moderately widely deployed will deal more serious blows to spam delivery.The key is to not give all incoming email connections free access to all the bandwidth/resources they want. The key to having software that adds this capability widely deployed are low resource usage and low or zero administrative overhead.
The below projects achieve many of these goals.

Applying QoS and other ideas to receipt of email will hit spammers where it hurts them the most - the ability to rapidly deliver 1,000's of msgs per minute. As far as I can tell , this is the _only_ thing that would hurt them without the "collateral damage" of other methods.
Here is one example of intelligent,adaptable QoS for MTA's:
»spamthrottle.qmail.ca/

No draconian measures needed. One project rejected a phenomenal percentage of spam, by just tracking the from IP, from email adr and to email adr - if that combination of data had never been seen before, the mail server said "Please try later" (something that MTA's [mail servers] expect and are programmed to handle). This system added near zero load on the receiving system but 97%+ of the rejected mail was never re-attempted.
»projects.puremagic.com/greylisting/
»dumbo.pobox.com/spam-sensor/

Low cost (machine resource cost) virus scanner:
»mailtools.anomy.net/sanitizer.ht···it-qmail

Projects that will substantially slow the spread of viruses that do not vector via email:
(again at extremely low machine resource costs)
»www.hackbusters.net/
»www.hackbusters.net/AAWP.pdf [research paper studying rate of virus infection with/without LaBrea-style active defense mechanisms]
»www.citi.umich.edu/u/provos/honeyd/

So it is not that "nothing" is being done (as some have implied on these forums), things are being done - some need visibility - others promising areas of research are being suppressed by the super-DMCA style laws (as the two projects above are).

Proliferation of projects that cause spam bots and viruses to spend unproductive time talking to a connection will tip the balance of spam economics and cause spam and viruses to move too slowly through the internet to be profitable (or satisfying to virus makers). And this can be done without undue costs or burdens on legitimate internet uses.
ParanoiaInc

join:2002-08-28
Tucker, GA

Many communication alternatives to email

It doesn't take anyone much effort to setup a free discussion forum that uses registered accounts on a PHP platform. I've often considered this. And if I want to really get snippy, I could close the SMTP/POP ports and filter based on friend's MAC's.
ParanoiaInc

join:2002-08-28
Tucker, GA

Re: Many communication alternatives to email

Also, what is the beef with have an email account that can be traced? Anonymous mail only serves to promote deception.

And what is to keep anonymous email providers from routing for you so that it looks like it comes from them and not you?

delugg

join:2002-01-30
New York, NY

Too Complicated?

Is email going to get so complicated that it becomes inconvenient? I know I'm spending a few hundred/year extra to block and deter spam! I was thinking of using PGP, but most of my friends and associates couldn't be bothered.

But we all seem to agree. Something needs to be done before junk email ruins one of the Internet's most basic uses.

- mike
--
Most people are about as happy as they make up their minds to be. -Abraham Lincoln (1809 - 1865)
Forums » Debating Domain Keys


Monday, 09-Nov 06:54:46 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.republican-creole