RE: CBV

On Fri, 7 May 2004, Seth Goodman wrote:

> > > The key problems with SES seem to be EITHER:
> > >
> > > a) If a spammer gets hold of an SES source address, he has a
> > > free ticket
> > > to spam people using replay
> >
> > In conjuction with SPF, an SES or SRS source address only allows
> > the spammer
> > to spam 1 particular recipient for a limited time via a forged
> > bounce.  An SES
> > source is not a general relay ticket.  It is true that without SPF,
> > general spam victims that only check CBV will for a limited
> > time be tricked into thinking the sender is genuine.
> 
> That's the vulnerability that we attempted to address by incorporating a
> body hash in the MAIL FROM:.  The recipient can detect that the message
> content does not belong with that MAIL FROM: and can reject the message,
> albeit at the end of DATA.

If I have to go through the DATA phase, there is no clear advantage to the
SPF/SES scheme over bayesian filtering.  I really really don't want SES to 
have anything to do with the DATA phase.  I am fine with additional
signatures for messages headers and body contained in some message
header.  I.e., if you need to get the message DATA anyway, you might as well
store the signature in the DATA, and not have to worry about local-part size
limits and crud.

However, here is an idea (which has probably been tossed out before
but I missed it).  You could have the SES signature cover the recipient.
Then the spammer would only be able to spam himself.  The drawback is
that for multiple recipients, the signature would be different for each one,
possibly requiring extra copies of the message.

The CBV would work with the recipient sending the recipient as MAIL FROM
and the sender as RCPT TO.

You could avoid copying the message for multiple recipients by creating
a database record listing all the recipients for each message, and encoding a
key to that record in the SES.

The scheme could also support original flavor (<> sender) CBV with either
the database approach or two crypto hashes (with/without recipient).

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.