Re: CAPTCHA over smtp (yet another spam solution to discuss)

Brian Candler wrote:
> when you consider the normal E-mail arrangement:
> 
>   UA1 ----> relay1 -------------------> MX2 ----> UA2
> 
> then observe that the protocol as discussed:
> 
> (1) needs to run on a different port to SMTP (because it requires direct
>     communication between UA1 and MX2, and many sites block this)

This is not "a big thing" since the same protocol is used on both ports. 
Basically, a compliant SMTP server just has to open two listening 
sockets instead of one.

> (2) involves a completely new set of SMTP primitives

Yes, it involves the implementation of an ESMTP extension, and a few new 
SMTP verbs. Just like, e.g. the STARTTLS SMTP extension.

> (3) requires UA1 to perform its own MX lookups, direct mail delivery,
>     per-message queueing and retry, none of which is currently needed
>     because it offloads all that work to relay1

Lets go through these in reverse order:

per-message queueing and retry: Sufficient features to handle re-sending 
are already available in modern MUAs. They are needed in regular SMTP to 
handle your local mail relay being down. You get "cannot contact mail 
server" and get the option to leave your mail in the 'outbox' / 'save it 
as a draft', or similar.

direct mail delivery: The MUA already knows how to deliver email over 
SMTP to the local relay; this is the same thing, just to another host.

own MX lookups: Yes, this must be implemented. (But it is not such a 
major thing, a few DNS lookups)

> In other words, what you end up with is pretty much nothing like SMTP.

The *transfer protocol* is still rfc1869-compliant SMTP.

> The 'captcha' proposal tries to distinguish spam and non-spam by requiring
> an intelligent response to each message, on the assumption that this doesn't
> scale for spammers who want to send millions of messages. However spammers
> can quite happily make captchas scale, by redirecting them to users who are
> trying to get access to porn sites, for example, and they are already doing
> this on a large scale]

Right, CAPTCHAs do not really "distinguish" between spam and non-spam. 
But they make sure every sent message requires *human* work.

While sweatshops of cheap labor and "forwarded CAPTHAs" are bad enough 
to cause problems for e.g. "get a free web page" web forms, I just 
cannot see how this scales to a point where current email-mass-marketing 
is even remotely possible. Only my own spam trap addresses would cost an 
hour of human labor per spam run. But *targeted* commercial emailing 
could still work.

> Personally, with the vast amounts of spam I get, I'm thinking that I'd be
> happy to move to a completely 'closed' E-mail system where only people I
> know in advance can contact me directly. [...]
> The problem is how to do identity proving.

Well, if you are prepared to live with this solution you can already use 
a simple white list on the unidentified sender address. That will get 
rid of almost all your spam. (You would still get a few worms though, if 
you haven't trained your friends to avoid them).

What I do not understand at all is why you would think making your 
friends send their emails using a BBS system or a new "passport-like 
service for identity brokers" will be any easier than getting them to 
install a simple MUA extension that just signs their outgoing emails.

Best regards,
Rickard