[Asrg] Re: Email passwords

["David A. Wheeler" <dwheeler at dwheeler.com>]

I said:
> I've looked over the discussion lists, and I
> noted that one anti-spam measure that I use hasn't
> been mentioned as far as I can tell by this group.
> It's an approach that I call "email passwords"....
> It's a trivial approach. Just designate some word/phrase as your
> email password. If a message has the email password in the subject
> line, rank the message as much less likely to be spam,
> or just throw it immediately into your Inbox. ...
> More info is at:
>   http://www.dwheeler.com/essays/spam-email-password.html

I got a few replies, here are my responses.

dongxiaoli said:
> yeah.I thought about the similar idear. I think this will work
> but it is not proper for implement in lager-scale,

It handles large-scale, in the sense of a large number of
spam messages.  But I agree that this is NOT the right
solution for everyone. In fact, there are many for whom this
isn't a good solution.  But I have already-well-known email
address that I don't wish to lose, and I want strangers to
be able to contact me.

>and not too easy to deploy
> for example,you should have a homepage to give your email password.

Actually, that's pretty easy nowadays.   All you need is a page.
Many discussion bulletin boards (like Slashdot) will let people
create such a page at no cost, without needing to know how to
handle HTML etc.   Almost all ISPs give away
a small webspace, which is all you need.

> next we can implement it in a automatic method.ie.
> if someone want to send a mail to me ,then he will first be linked to
>my emailpassword picture,and he should contain the emailpassword in
>email subject

Not a good idea.  It's easy to create a mailto: link with the subject pre-set,
but spammers can get that information automatically and then
exploit it.  No, you need to make sure that
figuring out the email password is a MANUAL step that's easy for
humans, yet hard to automate.

Jean-Jacques Puig said:
> 	I may be wrong, but I would say that, in a way, these passwords are
> 	kind of authorization tokens.

Yes.  I _DO_ call them passwords :-). And in my page on this, I say,
"Basically, think of the act of sending email as a privileged operation",
I think of the spamming problem as a security problem; how can a
stranger authenticate to the receiver that their message isn't spam?
This is one way.

> 	There is a difficulty with this scheme: suppose you buy a product
> 	and give your mail address for being informed about expedition,
> 	availability, etc. Most on-line forms will not provide you any way
> 	to put in the token / password.

Correct.  Which is why I personally don't _REQUIRE_ the email password;
the email password simply reduces the likelihood that an unexpected
message will be lost.  Others could implement it by requiring it.

I can handle EXPECTED messages - I delay before deleting spammed
messages, so I can search for a specific message in the spam pile
before I delete them.  But I can't review every message I get,
and I can't search for unexpected messages.

But you raise a great point:  it'd be
nice if on-line forms let me put in a special value to be placed
in the subject line (or some other header).
You can merge it into the email address, but that becomes
a pain for a lot of infrastructure.  Of course, requiring every
on-line form to add that information is a pain too; at the very
least, I wish any on-line forum would say IN ADVANCE the
address they send email from, so I could whitelist them BEFORE
they send me a message.  Those would be nice suggestions
for some sort of RFC documenting "recommended practices".


> 	Of course, the preferred way for authorizing your friends should be
> 	PGP :). Authorization tokens is useful only for other parties.

Won't help.  My problem isn't my friends; it's strangers.
I want to receive messages from strangers, but only if the messages
aren't spam. Strangers can sign messages using PGP too.

> 	I did not play myself with this token stuff because I did not know
> 	how the incorporation of parameters to the mail address through
> 	'+token' actually work; is-it a standardized way for adding
> 	parameters ? Is-it only a name'hack for the domain SMTP server to
> 	deal with ? Can someone point me to references on this point ?

Name-hack, I believe.  Which makes it hard for many to implement.

> 	BTW, the Active Spam Killer (ASK - http://www.paganini.net/ask/)
> 	uses this password scheme, for those interested.

No, ASK is different I believe.  It's a challenge-response system, using an
MD5 hash. In contrast, the "email password" approach doesn't
do a challenge at all.

Tim Bedding said:
> This strikes me as similar to the challenge-response schemes
> that some have placed on their email addresses.

Yes, in some ways.  But there's no challenge; if a stranger includes
a response, they increase the likelihood of getting in.
Otherwise, they're at a (much) lower priority.

--- David A. Wheeler

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg