Re: Email Web of Trust

Yakov Shafranovich wrote:

> Alan DeKok wrote:
>
>> Yakov Shafranovich <[email protected]> wrote:
>>
>>>> [ simple "link" web of trust has issues ]
>>>
>>>
>>> Then the real question becomes, what class of spam and what 
>>> aspects/types of spam problems does this "web of trust" idea solve?
>>
>>
>>
>>   It gives recipients more information.  It allows recipients to "ask
>> around" about a "new guy", and get a recommendation "good/bad/ugly".
>>
>>   This web of trust is no different than that used in job interviews.
>> Sure, someone's resume may look wonderful, and they may come across as
>> competent, but if the web of trust says "after 3 months, he shows up
>> at work drunk", you probably don't want to hire him.
>>
>>   The sole purpose of the web of trust is to make better decisions
>> earlier in time.  You could accept gigabytes of crap from an MTA you
>> haven't heard of before, or you could be told "that MTA will send you
>> gigabytes of crap".  You would probably then decide to not talk to it.
>>
>>   It doesn't stop the spam problem.  It reduces the local cost of
>> dealing with the spam problem.  Look at it as leveraging the CPU time
>> and $$ of everyone else, to make your decisions.
>>
>
> It sounds more and more to me like a "web of reputation" rather than a 
> "web of trust" to me. The catch of course would be defining the 
> information that is being passed around.
>
> What I am looking for is a one or two sentence problem statement for 
> this concept, similar to what we have in the LMAP document:
>
> "  LMAP attacks the forgery problem by checking that the host
>    from which the message was sent is authorized to send mail
>    using the a domain in the message's envelope.
> "
>
Yakov,
    You are a very clever man, and I assume you see the irony in asking 
for a one or two sentence problem statement that describes the given 
solution.  Nevertheless, I think I understand why you are asking the 
question and I think it is an important question.  So, with the group's 
permission, I'd like to take a stab at a problem statement:

    "Web of reputation is a secure and reliable technical means of 
assessing the reputation of an MTA with respect to the probability that 
a given E-mail message from that MTA is SPAM.  Web of reputation relies 
solely on the IP address of the remote MTA (as determined from the 
TCP/IP system, not from the HELO header of SMTP)  to identify the source"

    I am struggling with explicitly mentioning that web of reputation 
does *not* involve examining the contents of the message.  I finally 
took it out of my proposed problem statement, but I still have 
reservations about that, and if somebody wants to argue that point, I 
will listen.

> What I am looking for is something similar for this. Another important 
> point is what John mentioned - ISP MTAs which are sending out spam 
> along with legit email. For these, unless the percentage of spam 
> becomes really big, the web of trust will not help with. Therefore, 
> IMHO such "web of trust" is more geared towards reducing the problem 
> with hijacked computers, or IPs/domains that have are not supposed to 
> be MTAs. If this in fact is true, than a web of trust method might not 
> be better than other methods to address the problem.

    I have been thinking about the question of MTAs with large numbers 
of customers, some of whom are SPAMmers, and some of whom are not.  I 
have a proposed solution.  An ISP can analyze the mail server logs and 
figure out who is SPAMming and who is not.  The ISP can then set up an 
MTA for SPAMmers and an MTA for legitimate mailers.  If the ISP starts 
getting complaints about a given customer, then the ISP can move the 
customer to the SPAM MTA.  Legitimate mailers will probably demand that 
kind of service, and might even be willing to pay a premium for the 
service of a high reputation.  The contract will have language of the 
form "You agree to pay us extra, and you agree to abide by our policies 
and regulations concerning E-mail practices.  We agree to monitor the 
reputation of our MTA and take appropriate measures to protect its 
reputation in this web of reputation".

>
> If on the other hand, this is simply a way to allow multiple systems 
> to collaborate on a combined reputation system, that might be 
> different. Systems like DCC address a different issue - detecting spam 
> or spammers over a distributed network. For example, with DomainKeys 
> an identical spam message can be sent out in a replay attack which 
> will not necessarily be caught by one system. In a DCC-like 
> environment, multiple systems can collaborate and catch such occurance.
>
>>
>>   Also, because the web of trust can be designed to have confidence
>> values on the links, it doesn't have the problem that you have to
>> either trust someone elses input absolutely, or you don't trust it at
>> all.  Systems with binary trust values just don't work in the long run.
>>
>
> Agreed, the whole notion of binary trust values is one of the problems 
> with blacklists today.
>
> Yakov