CAPTCHA over smtp (yet another spam solution to discuss)

>
> In case anyone is still listening to this sleeping (dead?) email list, I
> submit yet another "spam solution" for comments:

Not so dead ;-)

Captcha has various problems, in the first place

1.- Since current SMTP protocol is not authenticated you can't assure
that the recipients is who sends the message. This can lead to mail
bombing to people who has nothing to do with original mail send.

2.- As a consecuence, a new world of DoS is open  :-(   (a spammer for
example can make a mail server to generate continues captcha mails,
which is resouce consuming)

3.- i18n, for example, if one of my users sends a message to a user in
an american domain for example, the american MTA will send him a
captcha message in English, which is likely  to be discarded as spam
for my users, or simply don't understood (bounces in current
infraestructure is a good real world example)

4.- as you stated in note [4] should not be assumed that a mail user
has access to remote MTA. Moreover, if its accesible maybe it's
temporary down or unreachable (that's why your relay MTA has remote
queue in the first place ;-P )


Regards.