Re: Spam with "non-forged" sender

Peter J. Holzer wrote:
> I got an interesting piece of spam today:
> [snip spam contents]
> 
> I am not familiar with the headers inserted by hotmail (few of my
> aquaintances use hotmail), but the headers look plausible to me. So my
> analysis of the spam is that the PC of bernhard langer was infected with
> a trojan, which uses his hotmail account to send spam - with his real
> address as the sender - thereby circumventing any sender verification
> scheme, both on the SMTP level (a mail with a hotmail address coming
> from hotmail is ok) and on the message level (if hotmail implemented any
> message signing, the message would probably have been signed).
> 
> People have been speculating that this would happen if any sender
> verification scheme was in wide spread use. I find it interesting that
> it is already happening today.

It has been understood in the early(ier) discussions of sender-verification 
that more spam and other detritus would appear from valid senders if such a 
thing were implemented. This happening is not a problem.
It allows the proven sender to be held accountable, as well as each one of 
their upstream providers. Once sender-verification is in place, it would be 
very easy, for example, to write and pass laws saying that computer users 
(or ISPs, or whoever) are liable for the costs associated with any content 
provably originating from one's machine. Thus, people and businesses have a 
pure economic motive to prevent illegitimate transmission. Additionally, 
blacklisting and whitelisting, either potentially communal, become much 
easier and accurate. Further, no one has to deal with the trouble of a 
sender-pays system, of any form, be it monetary, proof of work, or something 
else.

Bottom line: we understand that sender-verification will potentially cause 
more of this, and we've concluded that it's not a problem.

Philip Miller