Re: Some thoughts on SMTP Verification

Alan DeKok wrote:
> Yakov Shafranovich <[email protected]> wrote:
> 
>>What kind of data that we are looking for can help us with that? Would 
>>passing some metadata about the message via SMTP or some other mechanism 
>>help? What kind of metadata would it be?
> 
> 
>   Metadata which consists of hints as to common interest would be a
> start.
> 
>   e.g. "Patch for your program FOO"
>   e.g. "discussion of last night's date"
> 
>   Some of this is already available in the message body, but not in a
> form easily accessible to the MTA.  If it were to be in a form easily
> accessible to the MTA, it would look like some kind of token-passing
> scheme.  Whether or not such a scheme would be immune to spammers is
> another question.
> 

There was a proposal floating in the IETF about passing all of the 
header information in SMTP.

My question here would be what exact metadata can be passed in order to 
help fight spam, and how would such data would be used to fight it.

>>This kind of like the "chain of trust" used in PGP. Sounds like an 
>>interesting idea to me! What would spammers do in theory to get around 
>>such system?
> 
>   Attack the holder of the trust.  If it's distributed, it's harder to
> attack, but it's also harder to trust.  The benefit of having a
> centralized holder of trust is that if they're attacked, they can mark
> the owner of the attacking network as "untrustworthy", and they'll
> watch all of their messages get rejected.
> 
>   This is an interesting business for someone with deep pockets, and
> who lives in a non-litigious country.
> 

If it is centralized than DDOS attacks have a higher impact.

I like more the idea of a decentralized trust system, I wonder if it's 
something something worth pursuing. The question of course is how would 
such system reduce spam. It seems to me that it would mainly help 
whitelist, rather than blacklist. Therefore as such system is deployed 
and more senders start to use it, it would bring more benefit to those 
senders. Obviously, that would mean that spammers will end up hijacking 
the trusted senders, which would mean that trust among senders would be 
in some way tied into reputation as well.

While it sounds like the reputation/accrediation systems that are 
proposed by TEOS and Project Lumos, the crucial difference that I see 
here is the possibility of a hierarchy of trust. Domain A can say that 
domain B vouches for it, and domain B can claim domain C, etc. This 
would allow a new player to be introduced into the system by tagging on 
a trust of an existing player, as opposed to paying for accreditation 
under the other schemes.

Yakov