A Trial Balloon to Ban Email?

bear bear at sonic.net
Mon May 12 19:43:11 EDT 2003



On Mon, 12 May 2003, Bill Sommerfeld wrote:

>So, what's my reason to accept a "payment in cpu time"?  As best as I
>can tell, a "payment in cpu time" means that someone *else* doesn't
>get a payment in cpu time with their spam.  I still get the spam.
>
>It seems analagous to a protocol that proves that someone burned a
>dollar bill.
>
>A scheme where I actually get something of value might have a bit more
>traction..

The question here is not about whether *you* get anything worth value;
the question is whether the economics of email can be changed in such
a way that spam is no longer profitable.

When I get something in the USPS papermail, it means that someone
cared at least enough about talking to me to spend money on a bulkmail
stamp.  When I bring my mail in, I routinely throw away anything that
the sender spent less than 29 cents on, because I know the postal
rates and the only way to go below 29 cents is to be sending a bunch
of stuff which you don't even care who gets it.  It doesn't mean I
actually get that 29 cents; it just means I'm absolutely sure I don't
need to care what's in anything that someone spent less than 29 cents
on.

If someone is serious about contacting me, he sends me a 37 cent
letter, with a first-class stamp - or maybe a second-class letter if
they're a business with a mail room that has a lot of customers.  But
bulk rate, I can ignore.

I think we have a chance to build a better system electronically.
Instead of imposing a cost on all mail, we could just impose a cost on
the mail that our mail delivery agents (that's the MUA, not the MTA)
think smells spammy.  No cost in the basic simple case, but
prohibitively expensive to spammers.

We have already seen that 50 to 80 percent of all paper mail is junk
even in postal systems where there is a financial cost for sending
mail.  That means that, if we made *every* email cost a quarter to
send (in CPU time, or whatever) it would evidently be worthwhile for
at least some spammers to just buy enough machinery to send it anyway,
and those spammers would continue to generate enough spam to be 50
to 80 percent of our mail.

Therefore, we need the power to impose higher costs on spammers than
we want to pay for personal mail, and that requires us to be selective
about what mail we impose costs on.  The only reasonable way to do
that is at the MUA, where encrypted mail is already decrypted and
where decisions about it can be made depending on the individual
user's preferences and filters.  We don't want to impose a cost on
individuals sending stuff to their friends from underpowered handheld
units, and if what they send doesn't smell spammy to your filters,
why should we?

No matter what an MTA filter looks for, it will serve some users
badly.  Remember AOL's filters killing a breast cancer support group's
mail because the word "breast" kept being mentioned?  Think what
happens if writers of fiction about terrorism try to exchange stories
for critique and run into filters intended to catch terrorists.  Or
what happens when porn actors form a support group, or when students
in an ad copy-writing class send their assignments to their
instructor.  If we are to discriminate among emails, then the
discrimination *MUST* be on the level of individual preferences and
settings, and therefore *MUST* be done at the MUA rather than at the
MTA.

Also, if we make discrimination among emails part of the job of the
MTA, we implicitly require all email to be plaintext in order for the
system to work, and that is a very bad design decision of SMTP which
we do not want to repeat.  If we intend to support mail that's
end-to-end encrypted, we must make any content-based filtering on it
filtering that's done at the MUA.

If we stick to a store-and-forward model for email, we need to stick
to a store-and-forward model for the hash-stamps and requests for
same.  Delivery of mail may be delayed several days if it smells
spammy to the MUA, until the request for a stamp propagates back and
the originating system fulfills it.  If the mail smells spammy and the
originating system can't be found, or ignores the hash-stamp request,
then after several days of not getting a hash stamp, the MUA should
just drop the suspicious package on the floor.  But if the mail
doesn't smell spammy, it shouldn't even matter whether the originating
system can be found; this allows anonymous email to people who need
it, as long as anonymity is not used to cloak spammers.  And it allows
underpowered devices to send mail, as long as the mail isn't spam.

			Bear





---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com



More information about the cryptography mailing list