Chris Linfoot | I'm alright, Jack!

Tuesday, 27. July 2004

I'm alright, Jack!

I have spent a while this evening being very annoyed by this CircleID article (the portentously named "Sender Address Verification" - yet another challenge/response spam solution), so I will let off steam here.

The basic premise that what is proposed is simply common courtesy ("knock before entering") is fatally flawed. Supporters of challenge/response (let's be honest - that is exactly what it is) report wonderful efficiency in keeping spam out of their own in-boxes. But at what cost?

The backscatter of spam and viruses which forge senders (let's face it; virtually all of them these days) is inflicted directly on those forged senders. So while the C/R user sits there happily gazing on an in-box free of unwanted messages, those luckless forged senders are left with the fallout.

Exactly how is this courteous?

Category: Fixing SMTP
Technorati: Fixing SMTP

Comments :

1. Richard Schwartz28/07/2004 01:15:39
Homepage: http://smokey.rhs.com/web/blog/rhs.nsf

Agree completely, as does the vast mjority of the legitimate anti-spam community. Challenge/response detracts from the utility of email. And at best, large-scale adoption of challenge/response will result in spammers developing techniques to identify sender names that are white-listed by the recipients. I can think of many ways that one could go about doing this, and if I can do it, certainly spammers can. Once a spammer has found a sender/recipient address pair that works, that information will be worth it's weight in gold to spammers, who will sell databases of pairs of addresses. This will quickly destroy challenge/response as a useful way for bypassing other types of filtering for mail from approved senders. That being the case, why bother?

-rich

2. Chris Linfoot28/07/2004 08:09:20

Thanks for that. I feel better now.

Unable to post a comment? Please read this for a possible explanation...