Subject: RE: DNS Choices: Was: [ietf-dkim] Re: Last Call: 'DomainKeys

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 6 Dec 2006 11:38:43 -0800

> From: David Morris [mailto:[email-masked]] 

> It is pure naviety to assert that increasing the cost of 
> sending spam will not reduce the amount sent. The operative 
> word is REDUCE. Also note that my choice of words was 'cost'. 
> There are many ways to associate cost with sending spam.

Actually it won't reduce the amount sent for a different reason, the criminals will use stolen card numbers to pay for their spam. This is now a major problem for DNS registrars and ISPs.

I don't disagree that making spammers pay will reduce spam. Where we disagree is that I don't think that it is necessary to charge legitimate email senders in order to penalize illegitimate ones.

As Bill Gates proposed a few years ago, bonding type schemes are much easier to deploy than payment schemes, much cheaper to run and only cost money for the abuser.

Regardless of what payment mechanism you propose you have to start with an authentication scheme to bind the payment to the message. So DKIM is actually a starting point there.

Alternatively you could use a trustworthy hardware device that implements my patent-pending velocity indicator mechanism.

Or you could link the DKIM signature to a digital certificate that demonstrated that the holder can be held accountable (e.g. VeriSign Class 3 or an Extended Validation certificate). This could then provide information on where to find reputation services reporting on the sender.

A company can ignore a $100,000 fine as simply the cost of doing business. Having their email rejected by other companies is a much more critical penalty for them.

Micropayments are fun but having tried to deploy them in the past I don't think it is practical to do this to stop spam. It is possible to have the same effect on the bad guys without any effect on the legitimate sender and without creating a whole different set of cost issues.

The solution to spam is accountability: authentication, accreditation and consequences.

DKIM is the authentication component. We will come to the other components later, not necessarily in this forum.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 6 Dec 2006 11:51:09 -0800

> Sure, but that then becomes an actual crime in most juristictions.

95% of spam at least is already hardcore crime. The vast majority is sent from botnets, a criminal act. The vast majority violates CANSPAM in multiple ways. The vast majority is perpetrating schemes that are outright criminal.

Spam is Internet crime.

If you are worrying about the commercial abuse of email you are looking at the wrong problem. Sure it is an issue but there is no point in even trying to cope with it until the hardcore criminals are under control.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 6 Dec 2006 12:21:53 -0800

> From: Steven M. Bellovin [mailto:[email-masked]] 
 
> From today's NY Times, on the recent spam explosion:
> 
> 	But as a result of the Can-Spam Act, which forced domestic
> 	e-mail marketers to either give up the practice or risk jail,
> 	most active spammers now operate beyond the reach of American
> 	law enforcement.
> 
> Beware unintended consequences...  (The full article is at 
> http://www.nytimes.com/2006/12/06/technology/06spam.html?pagew
anted=2&ref=technology )

That was an intended purpose. The US government did not like the fact that it kept appearing in lists as the #1 producer of spam. It was bad for the image of the country.

CANSPAM actually suceeded in its intended purposes and those were pretty much the best one could hope for from legislation.

The amount of spam sent is going up because of filtering, not CANSPAM. The senders have to send much more spam to get an acceptable response rate.