Re: CAPTCHA over smtp (yet another spam solution to discuss)

On Sun, Nov 12, 2006 at 01:10:29AM +0100, R. Armiento wrote:
> Well, if you are prepared to live with this solution you can already use 
> a simple white list on the unidentified sender address.

s/unidentified/unauthenticated/ ?

Yes, it kind of works, but as soon as it's widely deployed then spammers
will find ways around it. The easiest way is to look at people's mailing
list postings, to determine potential 'circles of friends'.

However it doesn't work well today anyway. There are a number of
sender-address munging schemes in use (BATV and SES to name but two, but
I've seen other proprietary ones too).

That means the MAIL FROM:<...> envelope you see does not necessarily bear a
direct relationship to the address on your whitelist.

Also, an interesting case to consider is what happens if a friend of mine
tries to send mail from another account. Clearly this won't be on my
whitelist, as it's a different "identity". But having the ability to bundle
identities together via some external mechanism would be very useful.

That is, if I own identities A, B and C, and can make an external
declaration that they are the same, then this saves all my contacts having
to update their whitelists whenever I change E-mail address.

Regards,

Brian.