cat /dev/DiBona/brain: ASK Me No Questions, I'll Tell You No Lies (Linux Journal)

Posted Mar 10, 2004 16:24 UTC (Wed) by ken_i_m (guest, #4938) [Link]

post to nanog yesterday:
[...]
Consider:
1) in order to reduce annoyance, systems validate essentially ONCE. At best,
they're going to validate once a month or so.
2) it's trivial these days to register a fresh domain and enter auth servers.
Fraudulent registrations are already common.
3) DHCP assignments on broadband are *just* stable enough that someone can
setup some verifiable servers and send some mostly mundane messages
4) it's technically trivial to collect verify responses and direct things
into a bot that senses a validation system and replies(via email or web,
either is a well-known pattern that MUST remain valid once deployed to
customer sites, to be useful to the customers) as needed.
5) it'll take longer to clean these out of your validation system than it
will for them to move onto another domain that's newly in(hours).

All you've really down is open up your whitelisting policy to the outside world. Well, that and tie up more system resources to manage the database.

Now ask yourself how you're going to track down a validated server that went away, to be replaced by more spam from 0wned systems. Your own protection system has opened the door. You think getting help stopping a DDOS in progress is bad? And of course, the folks you're asking for help are the ones getting spammed by your validation email to begin with. Congratulations.

If these annoying systems become widespread, very smart people with more time than us to work on it will have no trouble defeating them.
[...]
Ray Wong
/* end post */

I have seen quite a number of other arguments about how brain dead this scheme is. Most of them revolve around how it off loads work onto others. This shows negative impact on the user of such a system.

cheers,
Ken

Posted Mar 10, 2004 19:01 UTC (Wed) by allesfresser (subscriber, #216) [Link]

I wonder if requiring a signature (the GPG kind) might be a solution... of course, certain monopolistic companies would be all too helpful in requiring their own particular non-interoperable variant of signing, but it would be one way to unambiguously filter mail--if I don't already have your signature approved, you don't get in. It poses a problem for anonymous mail of course, but the way things are going, that will be a problem in any case... :-(

Posted Mar 11, 2004 0:54 UTC (Thu) by maney (subscriber, #12630) [Link]

I don't know what the answer to spam is, but if this is the best we can do then we may as well just shutdown SMTP and admit we've been beaten by halfwitted imbeciles whose crowning achievment was getting the unregistered trial version of SpamSowerXIII to run, at least briefly.

I have to admit that every time another one of these challenge-response systems comes around I look it over and feel that same old attraction. By damn, it sures feels righteous to have the very anonymity that makes spam-as-we-know-it practical into a key part of the solution, doesn't it? Yeah, but the glow fades quickly when you look at the actual effects on others. Right off the bat, you're pushing the time and effort of despamming your mail spool off on others - this is simply inherent in challenge-response, and it's not righteous at all, at all. Then you resend the spam to the hapless folks whose addresses were forged by the spammers; here, you haven't even the weak excuse for wasting their time that they sent you mail. All the attempts to spam filter before applying the challenge-response can only reduce the magnitude of this selfish behavior; after all, if you had a perfect passive filter you wouldn't feel the need for a challenge-response system, would you?

Another nagging worry that I can't seem to shake is that there just has to be some underhanded way to use challenge-response systems - this is assuming they become common, and users get accustomed to dealing with them - to gather well and truly confirmed email addresses for some nefarious purpose. That is, the way would be to send out forged challenges and collect the replies; what I haven't figured out in the half hour I've been contemplating the idea is how to monetarize the operation. Doesn't it seem likely to you, too, that in a world where challenges are common the system would be integrated with the MUA, and might pre-register addresses when you answer a challenge? After all in the intended use-case that should be one to whom you wrote, so you probably want to receive the hoped-for reply, right? The usability guys will be all over this one (and for the intended use it is a plus), I think.

Posted Mar 11, 2004 4:25 UTC (Thu) by jhardin (guest, #3297) [Link]

> "... I don't think this is a lot to ask of people who e-mail me out of the blue."

Yes, but what about when you mail me out of the blue?

What annoys the absolute crap out of me in challenge-response anti-spam systems is when somebody who is using one sends me an email asking a question, and then doesn't preload me into their whitelist. I usually spend the time to write a helpful response, maybe doing a little research, and in return I get a "prove your identity" challenge.

If I have to jump through hoops (the C/R auth process) to respond to their question, I'm not going to do it.

If you're going to ask me a question then add me to your flippin' whitelist first!

{fume}

Posted Mar 11, 2004 18:22 UTC (Thu) by nowster (subscriber, #67) [Link]

The problem with Challenge-Response systems happens when you're running one, and the person you're trying to contact is also running one.

Who blinks first?