Re: Bouncing Spam

Bert Driehuis wrote:
> On Wed, 21 Mar 2007, Jason wrote:
> 
>> If you're going to do that I would suggest a challenge-response system
>> instead, like TMDA.  That way once someone confirms their address they
>> never go through that process again.  There's no password to remember to
>> include - all they do is respond to the automatic message and they are
>> whitelisted indefinitely.  So far I've never had a spammer bother to
>> get through TMDA.  It's not worth their trouble and my friends haven't
>> had a problem with it either, though I only use it on my more spam-prone
>> addresses.
> 
> TMDA seems to send a fresh e-mail containing a challenge to the (often
> forged) sender of the spam, contributing to the spam problem.

Considering that the OP was talking about setting up an autoresponder to
require a subject-line password TMDA would actually end up sending less
clutter.  Once a person is whitelisted there's no backscatter with TMDA,
whereas with the password scheme if the sender forgets the password
(which will happen frequently) there's a bounce.

> If one uses TMDA, it would be highly advantageous to also implement SPF
> in paranoid mode. Fortunately, not too many people use TMDA. As soon as
> even just a small percentage of users switch to solutions like TMDA,
> e-mail will simply grind to a halt -- one system will quaranteen the
> others challenges (and, as you may have guessed, my response to that
> situation would be: good riddance :-)

Spam defense requires many levels.  I block some netblocks, /dev/null
(rather than bounce) old addresses that are nothing but spam traps now,
filter out my mailing lists, strip out obvious spam using spamassasin
and after all of that only a couple of addresses go through TMDA.  It's
the belt, suspenders, staples and duct tape model.

> At best, C/R is a stopgap, but even today misdirected C/R challenges
> outnumber legitimate challenges by a vast margin.

Not in my experience and I run the mail system for an (admittedly small)
ISP.  Yesterday I had to turn off a wildcard on one of the domains I own
 after I started getting hundreds of false bounces an hour thanks to a
spammer using that domain as the from address.  My TMDA setup never
sends more than 15 messages/day once all of the other filtering is done.

> The only more-or-less correct way to implement Challenge/Response is to
> do it in-protocol. In other words, to reject the message in SMTP using a
> rejection such as
>  5.7.1 Please visit http://cr.example.com/id=123456 to unlock

I've seen such systems and the users I've talked to hated them,
especially if they use pine.  They'd much rather reply to e-mail than
click a web link.  GUI mailers make it a bit easier, but it's still a
PITA.

> My perspective may be a bit different than that of many Pine users --
> I'm Postmaster for a large corporation that operates worldwide, so I get
> to see more crap than most. Due to a significant number of complaints, I
> have already had to block one commercial challenge/response vendor (not
> a tough decision; they were also spamming my users).

BTDT - I feel for you.  I was one of several mail admins for a major ISP
a couple of years ago and I wouldn't wish that on anyone these days.

> Some Postmasters, usually for smaller sites, go one step further and say
> that even a single misdirected challenge is grounds for blacklisting
>  -- after all, your spam problem shouldn't have to become their spam
> problem.

I think it's just one more tool and if used properly it can be a good
one.  Particularly compared to the subject-line password thing.

> There are no easy solutions to the spam problem.

Truer words were never spoken.

-Jason

-----
   --- There are no absolute statements.  I'm very probably wrong. ---
"The difference between genius and stupidity is that genius has its limits."
                                        - Albert Einstein
_______________________________________________
Pine-info mailing list
[email protected]
http://mailman1.u.washington.edu/mailman/listinfo/pine-info