Re: TMDA (was: new spam functionality added)

[David Masterson <dsm@rawbw.com>]

>>>>> Stainless Steel Rat writes:

> * David Masterson <dmaster@synopsys.com>  on Mon, 05 Aug 2002
> | Do Hotmail (or Yahoo) accounts allow autoconfirmers?

> Automatic confirmation does not yet exist with TMDA, to my
> knowledge.  This is all hypothetical stuff.

So?  If systems like Hotmail and Yahoo that allow anonymous account
generation do not provide a means to use auto-confirmers, then
spammers can't use those systems to combat TMDA.

> | But they have to work harder to do it.

> BS.  One guy needs to program around it for all spammers to benefit.

Talk about hypothetical...

> Putting "spammer@hotmail.com" into your blacklist.  will not stop
> anything from "iamnotaspammer@hotmail.com" from getting through.

In the current scenario, spammers have an advantage in that they are
completely anonymous.  Since all the headers in the spam can be
spoofed, the most you know is the last system to relay the spam to
you.  Basically, you can't trace who sent you the email.

In the TMDA scenario, spammers now have to put some sort of (TBD)
auto-confirmer into place to "get the spam through".  This means that
the "From" or "Reply-to" address on their email now has to be valid so
that TMDA can send confirmation email to their auto-confirmer.
They've now left a set of fingerprints on the email that could come
back to haunt them through legal proceedings.  Not everyone is likely
to "take them to court", but the possibility goes way up under TMDA
(it doesn't have to be an individual, it could be a class action
against the spammer *OR* his ISP).

TMDA might not be a complete *technical* defense against SPAM, but, in
concert with a legal defense, it changes the playing field on the
spammer such that they may not want to play anymore.  At worst, it
should force ISPs to look at holes in their security or face
blacklisting by a class of users.

-- 
David Masterson
dsm@rawbw.com