Spam Is Bad John R. Levine Chair, IRTF ASRG Chair@asrg.sp.am - - PowerPoint PPT Presentation

▶
spam is bad
SMART_READER_LITE
LIVE PREVIEW

Spam Is Bad John R. Levine Chair, IRTF ASRG Chair@asrg.sp.am - - PowerPoint PPT Presentation

Feb 27, 2024 342 likes •660 views

Spam Is Bad John R. Levine Chair, IRTF ASRG Chair@asrg.sp.am http://asrg.sp.am Why is spam bad? Theres too much of it Its offensive Its fraudulent 2 Why is spam bad? Theres too much of it 98% More spam

slide-1
SLIDE 1

Spam Is Bad

John R. Levine Chair, IRTF ASRG Chair@asrg.sp.am http://asrg.sp.am

slide-2
SLIDE 2

2

Why is spam bad?

  • There’s too much of it
  • It’s offensive
  • It’s fraudulent
slide-3
SLIDE 3

3

Why is spam bad?

  • There’s too much of it

– More spam than real mail everywhere – Large ISPs see > 80% spam – Even with filters, real mail is lost in the noise

10 20 30 40 50 50% 80% 90% 95% 98%

slide-4
SLIDE 4

4

Why is spam bad?

  • It’s offensive

– Large amounts of porn – Porn in the spam itself – Who’d give their kid an e-mail account?

slide-5
SLIDE 5

5

Why is spam bad?

  • It’s fraudulent

– All those fake addresses – Forgeries of familiar addresses – Selling fraudulent stuff – Who’ll read real mail from the bank after getting 1000 fake mails from the bank?

slide-6
SLIDE 6

10

What Isn’t the Spam Problem?

  • The Authentication Problem
  • The Introduction Problem
  • The Filtering Problem
  • The Accreditation Problem
  • The Reputation Problem
slide-7
SLIDE 7

11

The Authentication Problem

  • Verify that a message is actually from the

sender it purports to be from

slide-8
SLIDE 8

12

The Authentication Problem

  • Verify that a message is actually from the

sender it purports to be from

slide-9
SLIDE 9

13

The Authentication Problem

  • Verify that a message is actually from the

sender it purports to be from

  • Same person as last time?
slide-10
SLIDE 10

14

The Authentication Problem

  • Verify that a message is actually from the

sender it purports to be from

  • Same person as last time?
  • An actual real-life person?
slide-11
SLIDE 11

15

The Authentication Problem

  • Verify that a message is actually from the

sender it purports to be from

  • Same person as last time?
  • An actual real-life person?
  • An entity against which we can retaliate?
slide-12
SLIDE 12

16

The Introduction Problem

  • Mail from hitherto unknown senders
  • Make it hard enough to deter spammers
  • But easy enough to admit real mail
slide-13
SLIDE 13

17

The Introduction Problem

  • Mail from hitherto unknown senders
  • Make it hard enough to deter spammers
  • But easy enough to admit real mail

Challenge/Response CAPTCHA Hashcash E-postage

slide-14
SLIDE 14

18

The Filtering Problem

  • Distinguish nice mail from nasty mail
  • Try not to lose too much nice mail
  • Hope it’s not too expensive to do
  • Hope my tastes and yours aren’t too

different

slide-15
SLIDE 15

19

The Accreditation Problem

  • Third parties that vouch for potential

correspondents

  • You can prove you’re nice to one place

rather than millions?

slide-16
SLIDE 16

20

The Accreditation Problem

  • Third parties that vouch for potential

correspondents

  • You can prove you’re nice to one place

rather than millions?

– Bonded Sender – Habeas – IADB (ISIPP Accreditation Database)

slide-17
SLIDE 17

21

The Reputation Problem

  • Who’s nasty, who’s nice
  • State of the art: DNSBLs
  • Needs a lot of work

– What do you ask a reputation system? – What kinds of answers can they return

slide-18
SLIDE 18

22

Are These the Spam Problem?

  • NO
  • They’re related to it
  • But they’re not the spam problem
  • Or even necessarily parts of it
slide-19
SLIDE 19

23

What has ASRG done lately?

  • Reorganized into subgroups
  • One finished, a few under way
slide-20
SLIDE 20

24

Lightweight MTA Authentication Protocol

  • Threw it over the wall to MARID
  • Reborn as SMTP authorization

– Looking at analysis of effect of whatever MARID does

slide-21
SLIDE 21

25

Abuse reporting

  • Simple convention for exchanging spam

reports as e-mail

  • Large ISPs express interest
slide-22
SLIDE 22

26

BCP

  • Drafted a few

– DNSBLs / DNSWLs – Port 25 blocking and SUBMIT

slide-23
SLIDE 23

27

Filtering

  • Some work on a header to document what

filtering has happened

  • Now looking at filtering rule exchange
slide-24
SLIDE 24

28

Message verification

  • Domain keys, Authenticated Mail, TEOS,

Lumos, S/MIME, …

  • Look for common aspects

– Probably redundant with MASS

slide-25
SLIDE 25

29

Identity, Authentication, and Reputation

  • Lots of interest, no action
  • Sender-ID et al need a reputation system
  • How do we build them? What are the

questions? What are the answers?

  • Can we invent common interfaces?
slide-26
SLIDE 26

30

Things we’re not doing

  • Define spam
  • Challenge/response
  • E-postage
  • Replacements for SMTP
slide-27
SLIDE 27

32

What’s happening elsewhere

  • Open Group

– Validation profiles

  • MAAWG

– Implementation advice to members

  • ITU-T

– Technical and administrative coordination – Tell governments what to endorse

slide-28
SLIDE 28

33

The standards process

  • Practical orientation
  • Based on working

prototypes

  • Fast efficient process
  • Driven by politics
  • Paper designs
  • Slow cumbersome

process IETF ITU-T

slide-29
SLIDE 29

34

The standards process

  • Practical orientation
  • Based on working

prototypes

  • Fast efficient process
  • Driven by politics
  • Paper designs
  • Slow cumbersome

process IETF ITU-T

slide-30
SLIDE 30

35

So where are we?

  • Spam is still bad
  • Solutions are hard
  • But we can make incremental progress
slide-31
SLIDE 31

Spam Is Bad

John R. Levine Chair, IRTF ASRG Chair@asrg.sp.am