Re: new spam functionality added

[clemens fischer <ino-e0ec871e@spotteswoode.de.eu.org>]

                            Re: new spam functionality added

>   From: Scott A Crosby <scrosby@cs.rice.edu>
>   Date: 31 Jul 2002 16:07:23 -0500

>   Now, imagine there's a daemon that autoreplies to such 'please
>   reply to me' messages.. Well, just forge the spam to appear to come
>   from a legitimate user, and guess what, the bounces go to them, and
>   their client helpfully 'authenticates' the spam.. (The daemon can't
>   be configured to record every email sent and only autoreply to
>   autoreplies to emails the user actually sent. Many times people

well, i use a system where each of my (normal) emails is signed using a
cryptographic hash.  the resulting number is placed into a header of my
emails (don't look for it in this posting, it is processed by lynx).

then, when i get back the message for authentication, i recompute the value
and compare it to the value in the headers.  we use this system on the
"bernstein" lists at cr.yp.to, where a program called "qsecretary" verifies
every posting as an anti-spam measure.  the program for these automatic
verifications is called "pymsgauth" (a python script).

but what we're really looking for is a better internet-mail infrastructure,
right?  one where the sender is responsible for storing the messages, not
the receiver as it is with todays SMTP.  this infrastructure could be like
discussed in the IM2000 working group.  it would make spamming in general
next to impossible, at least too expensive to be even considered.

clemens