Re: CAPTCHA over smtp (yet another spam solution to discuss)

On Sun, Nov 12, 2006 at 01:10:29AM +0100, R. Armiento wrote:
> What I do not understand at all is why you would think making your 
> friends send their emails using a BBS system or a new "passport-like 
> service for identity brokers" will be any easier than getting them to 
> install a simple MUA extension that just signs their outgoing emails.

Because it ain't simple.

1. The process is different for every MUAs. At worst, you'll have to throw
away your MUA and install a new one.

2. Many/most webmail services don't support this. Often people use POP3/IMAP
to access their mail from home, and webmail when away.

3. People don't understand (or want to understand) the key management
lifecycle. When they replace their PC, they must remember to copy their
keying material across, otherwise they end up with new and untrusted keys.
When they work on multiple PCs, they must copy their keys onto every
machine, or generate new keys on each one and cross-certify them all. And so
on.

But I'm happy to forget about the potential benefits of true end-to-end
encryption and authentication. All I want to know is with reasonable
certainty is the person who sent me the message is the person who owns the
credentials for the sender address (in the case of E-mail, that they know
the POP3 login+password or webmail login+password for that account). That's
what challenge-response systems try to enforce, in a crude and annoying way.

Now, if I login to a BBS, and it says that a message came from user
"lastofthegeeks", then I know that it did (unless this user divulged their
password to someone else, or there has been a security breach). That's
because:

- the BBS is responsible for creating accounts
- the BBS is responsible for authenticating logins
- the BBS only accepts messages from authenticated users
- the BBS doesn't allow authenticated user A to submit a message on
  behalf of user B.

Whilst you're within one system, that works fine. The same would be true if
the whole world used a single mail server, and all postings were
authenticated using SMTP AUTH (or messages were submitted via IMAP or POP3
extensions, or whatever)

As soon as you expand this to multiple systems, that's where the problem
arises. You receive a mail from machine A, claiming to be from [email protected]. This
may or may not be true. It depends on which messages may be routed which
ways. This is what SPF tries to enforce, but in such a broken way as to be
practically useless.

Regards,

Brian.