Re: How is XMPP better than SMTP for spam prevention?

Torsten Bronger wrote:
> Hallöchen!
> 
> Let me turn into devil's advocate for this thread.  :-)
> 
> Peter Saint-Andre writes:
> 
>> [...]
>>
>> 1. In XMPP, the sender's address is not asserted by the sender's
>> client but instead is stamped by the sender's server. [...]
>>
>> 2. In XMPP, servers check each other's identities, either through
>> a DNS-based "dialback" protocol (RFC 3920 / XEP-0220) or real
>> server certificates. [...]
>>
>> 3. So far, server dialback has been sufficient to prevent most
>> address spoofing on the network, but we have a certificate
>> authority in place (visit https://www.xmpp.net/ for details) and
>> we could fairly easily upgrade the network to certificate-based
>> authentication between servers if needed.
> 
> Okay, but what do you do with this information?  Maintaining
> blacklists?  See below.

If someone runs an abusive server and they've received a certificate 
from the CA we run, we can revoke their cert.

But the issue at hand was not rogue servers, it was address spoofing and 
weak identity.

>> 4. XMPP is pure XML, and attackers can't easily attach malware
>> like scripts and viruses to Jabber messages.  [...]
> 
> If XMPP becomes more important in daily communication, it will be
> also more intensively used to transfer binary data.  

Agreed. See for instance:

http://www.xmpp.org/extensions/xep-0231.html

We need to be careful about how we use such technologies.

> The same
> happened to email in its history.  So it will be the same as with
> email: sane client implementations must save us rather than the
> protocol itself.  By the way, malware-via-http-link and phishing
> works for XMPP, too.

Sure it does. Lots of end users are not very smart about whether or not 
to click a link. No technology solution is going to solve that problem.

>> 5. A great deal of email spam (or spam+malware) is directed against
>> a single platform: Outlook running on Windows.  [...]
> 
> I don't think so.  While I strongly dislike the use of Outlook, it
> is not the bad Outlook anymore from four years ago.  The most recent
> UPS virus email hit a couple of Thunderbird-using collegues.  If you
> really want to start the malicious attachment, no email client can
> help you.

Perhaps. I have not studied the matter in great detail.

>> 6. In IM systems, people are accustomed to sharing presence /
>> adding someone to their buddy list. [...]
> 
> Subscription requests are enough for spammers.

But we can use CAPTCHA forms for that, too:

http://www.xmpp.org/extensions/xep-0158.html

See also here:

http://www.xmpp.org/extensions/xep-0158.html

There is one tool to solve all problems.

>> 7. All XMPP server codebases have rate limiting in place to
>> prevent a single client from sending a large number of messages
>> [...] in a short period of time.
> 
> Then generate a lot of pseudo users in a spamming server.

Then you're a rogue server and we'll block you (once we have better 
tools to communicate the existence of rogue servers and abusive traffic, 
see http://www.xmpp.org/extensions/xep-0161.html etc.).

>> [...]
>>
>> 9. IM systems have traditionally been quite fragmented (and in
>> many ways still are -- as witness ICQ, AIM, MSN, Yahoo!, Skype,
>> etc.) so there isn't the expectation that you'll necessarily be
>> able to send a message to any random person on the Internet. [...]
> 
> As long as a message costs hardly a milli-lira, it is not
> significant to spammers whether they reach X people, or
> X/<number-of-networks>.  In (their) worst case, they lose only one
> order of magnitude, so the spam model still scales very well.

My point was more psychological than technological -- IM may be 
perceived as less interesting because it's not an open system like 
email. Yet.

>> [...]
>>
>> However, XMPP does not need to be perfect. You don't need to be
>> the fastest antelope in the herd to avoid being eaten by the lion,
>> you just need to be faster than the slow antelope who get caught.
> 
> Well, I don't think that the anti-spam plan should be built on the
> existence of other less spam-proof networks, not even partly.

Why not? That's the reality.

Perfection is not an option.

> Besides, lions will not only focus on the slow antelope but also on
> the fat one.  And we want XMPP to become fat, don't we?  ;-)

Heh.

> Sorry but I'm not convinced.  This sounds like a mixture of
> hoping-for-the-best and application of SMTP anti-spam techniques
> that have turned out to be rather wasteful.
> 
> However, I see one advantage over SMTP, namely that there's still an
> almost completely non-commercial community that has some sort of
> central authority (XSF).  So: Make a server whitelist!

Doesn't that introduce a single point of failure?

> https://www.xmpp.net/ is the first step in this direction.  Only
> servers on this list make S2S traffic.  Then, you need an automatic
> tool for measuring spam, something like the SpamAssassin -- not for
> filtering but only for measurements.  So it needn't be perfect.  And
> every server that sends spam above a threshold is first warned and
> then removed from the list.
> 
> This would break the potential benefit for spammerd by *several*
> orders of magnitude, and then it is not worth it anymore.
> 
> [SMTP can't do it because a) there is no significant authority and
> b) Hotmail, Gmail, GMX etc can't sell their products anymore if
> there is no spam.]
> 
> Maybe you had this in mind with your points 1-3, however, I didn't
> see it there.

I'm not a big fan of centralized solutions with single points of 
failure. Then the spammers simply need to attack xmpp.net and they can 
spam as much as they want.

Better, I think, to use a distributed model where each server has 
"buddies" it trusts, and ask those buddy servers about new servers that 
appear on the network.

Peter

_______________________________________________
This is JUser -- a mailing list for end users of Jabber clients.

Don't like email? Try the forum:
http://www.jabberforum.org/forumdisplay.php?f=21

To unsubscribe, send email to 
[email protected]
or go to the following web 
page, scroll all the way down, 
and type in your email address:

http://mail.jabber.org/mailman/listinfo/juser
_______________________________________________