Re: CAPTCHA over smtp (yet another spam solution to discuss)

--Z1OTrj3C7qypP14j
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2006-11-15 15:17:57 +0100, David Sanchez wrote:
> >[IM2000 prevents zombies from spamming]
> >>>Greylisting already achieves that.
> >>
> >>Nope, if the "spam worm" is intelligent enought to resend the mail
> >>(just like an MTA do) (hey, they can implement a queue :-P ).
> >
> >If the spam worm is intelligent enough, they can send both the
> >notification and the actual spam message from the zombie machine.
> >Conceptually, greylisting /is/ IM2000, with two disadvantages:  Senders
> >wait busily, and usually, recipients (users) have little control over
> >the time window during which their inboxes are opened for messages from
> >new addresses.
>=20
> AFAIK greylisting is just a delay in the sending of unknown pieces of mai=
l.

That's the effect the user sees. The idea is to get the sender to prove
that it is willing to store and retransmit for some time (typically a
few minutes to a few hours). So there is some similarity to IM2000, but
it's entirely automatic and the user is never involved. (I don't think
that part of IM2000 would work well in practice: If the notification
contains enough information for the user to decide whether he wants the
message, the notification is sufficient for spam. If it doesn't, the
user will always have to retrieve the message, hence spam isn't
prevented).


> http://en.wikipedia.org/wiki/Greylisting
>=20
> Maybe this will be circunvented for spammers in the next few months
> (not likely, because not too much servers use greylisting and spammers
> are getting enough profit yet).

It already is circumvented by spammers: It was a lot more effective when
I started using it in 2003 than it is now (but it's still more effective
than any other tool which doesn't need active cooperation from the user
(e.g. bayesian filters)). I'm not sure if spammers are circumventing
greylisting on purpose or whether they use freemailers more than 3 years
ago for other reasons (which brings us back to the topic of this thread:
CAPTCHAs don't seem to prevent the abuse of freemailers by spammers).

	hp

--=20
   _  | Peter J. Holzer    | Schlagfertigkeit ist das, was einem
|_|_) | Sysadmin WSR       | auf dem Nachhauseweg einf=E4llt.
| |   | [email protected]         |    -- Lars 'Cebewee' Noschinski in dasr.
__/   | http://www.hjp.at/ |

--Z1OTrj3C7qypP14j
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFFWziMfZ+RkG8quy0RAsMLAJsHIqoIps5KgqHf4SUnBFQzXPdLSwCeN7Hm
T2GQQUiqZJTpNRFKl3wKu10=
=feAL
-----END PGP SIGNATURE-----

--Z1OTrj3C7qypP14j--