Re: [ANNOUNCE] contrib/hashcash.el spam fighter

[Stainless Steel Rat <ratinox@peorth.gweep.net>]

* Simon Josefsson <jas@extundo.com>  on Tue, 25 Jun 2002
| Not only, it works in peer 2 peer as well.

Yeah, but PGP works better.  Three words: web of trust.  X-Hashcash cannot
have a web of trust.  And PGP can work without prior contact through PGP
key servers.  X-Hashcash cannot do that, either.

| hashcash.el uses the recipients email address as a challenge.  If you
| know the recipients email address, you know the hashcash challenge, so
| this should work.  A spammer could compute these, but he could only
| use it once.

No, he could only use it once every 28 days by default.  Still, there may
be a way of exploiting the Bcc mechanism or RCPT TO at the SMTP level, both
common spam tactics.  If a spammer were to generate a hash against a bogus
To header (like most of the spam I get), he could blindly send his spam to
millions of recipients with only one hash.  Yes, you could check the
X-Hashcash coin against your known address, but that leads you directly
into a false negative if a legitimate sender Bccs you something.

The system is also vunlerable to false positives.  The likelyhood of an
accidentally duplicated coin increases with the number of users.  And it is
potentially vulnerable to denial of service by the same mechanism.

I'll take back what I said about hoping it dies, because it does serve a
useful function within its limited scope.  DCC and Razor are vastly
superior mechanisms for filtering spam for end users.

-- 
Rat <ratinox@peorth.gweep.net>    \ Happy Fun Ball contains a liquid core,
Minion of Nathan - Nathan says Hi! \ which, if exposed due to rupture, should
PGP Key: at a key server near you!  \ not be touched, inhaled, or looked at.
       That and five bucks will get you a small coffee at Starbucks.