Re: CAPTCHA over smtp (yet another spam solution to discuss)

On Mon, Nov 13, 2006 at 04:34:34PM -0800, Joachim Kupke wrote:
> David Sanchez wrote:
> 
> >>Ah, mailing lists.  Nope, the mailing list would prompt you to solve 
> >>the puzzle.  Or pay the money or whatever.
> >
> >Nope, i mean sending a mail with copy to 3 or 4 people.
> >
> >This is just impracticable.
> 
> Are you saying:  You would like to send out a message to 4 people, some 
> of whom speak Chinese and will therefore ask you to solve a puzzle 
> stated in Chinese, and others speak Italian and will therefore ask you 
> to solve a puzzle states in Italian?

That's a minor issue. Presumably the people you're E-mailing talk both
Chinese and English; they will therefore configure their Captcha system to
issue challenges in both Chinese and English (or to let the user choose,
like HTTP language negotiation). If you do not share a common language then
there's little point in establishing communications anyway :-)

> Plus, these folks didn't whitelist you to begin with?

The point about whitelists is more important. There is an unstated
assumption here that there is a robust whitelist system behind this, which
IMO means better authentication of messages than the claimed MAIL FROM:<> or
From: headers. Otherwise, spammers will just send mails with the MAIL
FROM:<> of your friends, which often isn't hard to guess. (Consider that
your "friends" may include PayPal, Amazon, Ebay etc)

Anyway, I think the bigger issue with Captchas is whether they can scale. I
think they can. A spammer could pay, say, 0.1c-1c in real cash per Captcha
solved. There are plenty of poor people in the world who would happily do
this. With a bit of practice they would be up to a couple of thousand per
hour, and so earning $2-$20 per hour cash.

Now, that's still a lot more than spammers currently pay for sending E-mail.
A bigger problem is that captchas can be broken. For example, a system which
asks you to identify kittens from other animals will have a finite database
of images. Furthermore, people who download or purchase this system will end
up with the same database. You could run your own menagerie with webcams
pointing into the cages, but in general if you require spammers to break
captcha systems, and lots of people deploy the same system to make it
worthwhile, they will.

B.