Re: Scope of SMTP Verify

Yakov Shafranovich wrote:

> Peter J. Holzer wrote:
>
>> On 2004-03-01 21:20:44 -0500, Yakov Shafranovich wrote:
>>
>>> Peter J. Holzer wrote:
>>>
>>>> On 2004-02-28 20:24:30 -0500, Yakov Shafranovich wrote:
>>>>
>>>>
>>>>> What I do want to discuss here, is different ways to deal with 
>>>>> spam on
>>>>> the SMTP level OTHER than LMAP, which is what I tried to start 
>>>>> with my
>>>>> message on different possibilities such as SMTP level passing of
>>>>> parameters, etc. This is something that should be done here, while 
>>>>> the
>>>>> LMAP proposals can be discussed at the IMC.
>>>>
>>>>
>>>>
>>>> I can think of several items which can be verified at the SMTP level
>>>> (not necessarily in any useful order):
>>>>
>>>> 1) The identity of the SMTP client. SMTP auth exists, but doesn't seem
>>>>  to be much use between random hosts on the internet (It is useful for
>>>>  authenticating users to their "home MTA").
>>>>
>>>>  Various plausibility checks (check for PTR records, check HELO
>>>>  parameter against IP, ...) also fall into this category.
>>>>
>>>
>>> We know the identity of the SMTP client based on its IP. What other
>>> kinds of identity are possible?
>>
>>
>>
>> E.g., "This is Joe's laptop". Or "This is the same computer that sent
>> spam last week".
>>
>> The IP address is only an indicator of identity for systems with static
>> IP addresses.
>>
>
> For those systems, is an IP address sufficient identity? For dynamic 
> systems, is the actual "dynamic" of the address the only reason why we 
> would need other identification systems beside IP?
>
>>
>>> Knowing such identity, how can we use it to decrease spam?
>>
>>
>>
>> Some kind of reputation system. I think this is true for all methods
>> which establish an identity of an originator or relay. Simply knowing
>> that the message was sent by or through X doesn't tell me anything about
>> whether the message is spam or not. Only if I also know whether X is
>> likely to send spam or ham, I can  estimate whether the message will be
>> spam or ham. (This is also true for LMAP - it just shifts the problem
>> from the client's IP address to the domain)
>>
>>
>>> If through a blacklist/whitelist system, do existing blacklist and
>>> whitelists suffice? If they do not, how would reputation systems of
>>> the future able to avoid the same problems that plague today's
>>> blacklists?
>>
>>
>>
>> Good question :-)
>>
>
> Well that's the problem. So far we haven't gotten good answers. 
> Besides "web of trust" and "reputation systems", are the other 
> possibilities that can be used with identity to reduce spam?

Kerberos?  You'd have to figure out a way to put a kerberos ticket into 
a mail message, and the kerberos ticket would have to have a very long 
life span.

Kerberos is an authentication system, and if you have a valid kerberos 
ticket, then somebody can prove that a given instant in time, the sender 
authenticated himself/herself against an authentication server.

You would still have to have a local list of authentication servers you 
trust, and you'd still have to maintain a blacklist/whitelist system, so 
maybe this isn't the best solution.

I am told that a relatively small, 100 MHz PC can easily generate 100 
Kerberos tickets a second, and kerberos already exists and is well 
understood.


Jeff