Re: Email Web of Trust

Yakov Shafranovich <[email protected]> wrote:
> What I am looking for is a one or two sentence problem statement for 
> this concept, similar to what we have in the LMAP document:
> 
> "  LMAP attacks the forgery problem by checking that the host
>     from which the message was sent is authorized to send mail
>     using the a domain in the message's envelope.
> "

  The web of trust attacks the spam problem by collating information
across multiple recipients, to determine the probability that a
particular SMTP sending IP is sending spam.  This probability may be
calculated (with some level of confidence), even if a particular
recipient has not had prior interaction with a particular sender.


  It won't stop spam, but it will give people more information than
they have today.

> What I am looking for is something similar for this. Another important 
> point is what John mentioned - ISP MTAs which are sending out spam along 
> with legit email. For these, unless the percentage of spam becomes 
> really big, the web of trust will not help with.

  Why not?  If I know that an ISP sends out 1% spam by accident, I can
deal with it.  If I know that an ISP sends out 50% spam because
they're unwilling to solve the problem, I'm better able to deal with
the traffic.

  Again, the trust is not, and can not, be a simple binary metric.
Any measure of trust with is solely "trusted/untrusted" is doomed to
fail.

  And the spam problem is not known ISP's sending small volumes.  It's
substantially unknown people sending large volumes.

> Therefore, IMHO such "web of trust" is more geared towards reducing
> the problem with hijacked computers, or IPs/domains that have are
> not supposed to be MTAs. If this in fact is true, than a web of
> trust method might not be better than other methods to address the
> problem.

  You could use a whitelist.  But how would you prime it, if not with
some kind of web of data?

  Alan DeKok.