Re: CAPTCHA over smtp (yet another spam solution to discuss)

On Tue, Nov 14, 2006 at 04:24:39PM -0800, Joachim Kupke wrote:
> >>Plus, these folks didn't whitelist you to begin with?
> >
> >The point about whitelists is more important. There is an unstated 
> >assumption here that there is a robust whitelist system behind this, 
> >which IMO means better authentication of messages than the claimed MAIL 
> >FROM:<> or From: headers. Otherwise, spammers will just send mails with 
> >the MAIL FROM:<> of your friends, which often isn't hard to guess. 
> >(Consider that your "friends" may include PayPal, Amazon, Ebay etc)
> 
> Repudiable signatures.  Another application of C/R email.

I'm not sure, but I think you mean "non-repudiable signatures".

A repudiable signature is one which the original sender can argue
successfully was *not* signed by him or her. In other words, there is a
significant likelihood that someone else sent the message, even though it
appears to be from him or her.

In any case, I don't see how adding challenge-response to the protocol in
itself gives you any kind of signature.

> >Anyway, I think the bigger issue with Captchas is whether they can 
> >scale. I think they can. A spammer could pay, say, 0.1c-1c in real cash 
> >per Captcha solved. There are plenty of poor people in the world who 
> >would happily do this. With a bit of practice they would be up to a 
> >couple of thousand per hour, and so earning $2-$20 per hour cash.
> 
> However, those poor people would have been served better if they earned 
> that kind of money doing some useful work.  The idea of keeping millions 
> of people busy solving captchas doesn't bode well with the philosophy of 
> efficiency.

Absolutely. But spammers are not particularly known for their high levels of
ethics, nor their consideration for efficient use of resources.

> >Now, that's still a lot more than spammers currently pay for sending 
> >E-mail.  A bigger problem is that captchas can be broken.
> 
> Then don't break them.  A captcha that no longer "tells computers and 
> humans apart," by definition, is not a captcha.

Then you just get into a captcha escalation war, which is fundamentally no
different to the current spam-filtering war.

Indeed, the current situation is probably better; people can have their spam
filters reasonably well self-tailored and updated over time (using Bayesian
learning for example), whilst the effort required to set up your own custom
captchas and keep upgrading them is quite significant.

Regards,

Brian.