On Sat, Mar 06, 2004 at 08:24:09PM +1300, Peter Gutmann wrote:

"R. A. Hettinga" writes:

...

If we really do get cryptographic signatures on email in a way that works, expect 80% of all spam to be blown away as a matter of course.

I think you mean:

If we really do get cryptographic signatures on email in a way that works, expect 80% of all spam to contain legit signatures from hacked PCs.

"A way that works" would involve passphrase-locked keyrings, and forgetful MUAs (this mutt only caches the passphrase for a preset time). Filtering for signed/vs. unsigned mail doesn't make sense, authenticating and whitelisting known senders by digital signature makes very good sense. Of course, this doesn't help with people you don't yet know. Would work well with prioritizing mail if taken together with other modes of filtering, though.

This is just another variation of the "To secure the Internet, build a big wall around it and only let the good guys in" idea.

-- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

On Sun, Mar 07, 2004 at 01:26:47AM +1300, Peter Gutmann wrote:

Eugen Leitl writes:

...

"A way that works" would involve passphrase-locked keyrings, and forgetful MUAs (this mutt only caches the passphrase for a preset time).

"A way that works *in theory* would involve ...". The chances of any vendor

of mass-market software shipping an MUA where the user has to enter a

No, that was a definition. I made no statement about how users take to passphrases, and vendors implementing this unwelcome feature. Works well for me, though. password

just to send mail are approximately... zero.

I agree. It doesn't mean signing (whether in MUA or MTA level) is useless. Only a tiny fraction of all systems is compromised, and if those systems use signed mail blocking them is actually easier (generating new keys on an 0wn3d machine introduces extra degrees of complication, and limits the rate of mail sent). If this is adopted on a large scale, nonsigned mail would automatically increase the spam scoring function, further speeding adoption.

...

Filtering for signed/vs. unsigned mail doesn't make sense, authenticating and whitelisting known senders by digital signature makes very good sense.

In that case you can just filter by sender IP address or something (anything) that's simpler than requiring a PKI. Again though, that's just another

Parsing headers is problematic, and signatures work at user, not at IP level (there are public mail services which serve millions of users with just a few IPs). You can as well sign at MTA level, if users are authenticated, and each of them has a signature.

variant of the "Build a big wall" dream. In order to have perimeter security

you first need a perimeter. If the spammer you're trying to defend against is your own mother (because she clicked on an attachment you sent her, it says so in the From: address, that's actually a spam-bot), you don't have a

Every exploitable system will be exploited, if a sufficient incentive is present. You can't get around the fact that we need to modify the infrastructure. Specifically for spam, facultative strong authentication is a part of a solution (there is no single solution, because it's a complex, adaptive problem). perimeter.

All you have is a big pile of Manchurian candidates waiting to bite you.

When I get virus mail from someone who has my email in my address book, it would be nice if that mail was signed, so I could contact her, and tell her she has a problem. Facultative strong authentication doesn't nuke anonynimity. It does shift it into darker, seedier corners of communication, though. Which is only natural: trolls thrive on anonymity, giving it a bad rap. Which is why we need a nym supporting infrastructure. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

On Sat, 2004-03-06 at 10:32, R. A. Hettinga wrote:

At 2:21 PM +0100 3/6/04, Eugen Leitl wrote:

...

Facultative strong authentication doesn't nuke anonynimity.

Perfect pseudonymity is functional anonymity, in my book...

No, pseudonymity lets others identify messages on, say c-punks, as coming from a particular sender. Reputation can work here, even with no meat-space identity attached. Anonymity means reputation can't work, so each message has to be taken on its own, with no history to give clues as to bias or reliability. I certainly wouldn't want to have to wade through all the traffic, wondering which from Eugen and which from the Australian-shithead-who-shall-not-be-named. Yah, it's easy enough to tell once you've read the message, but I'd rather filter it out on the "From:" level. I realize that your, RAH's, "book" mostly deals with financial transactions. In the very narrow domain of transactions which don't require any trust, anonymity should be as useful as pseudonymity. In the more general case, I'd think true anonymity would be a handicap. eg, I'm certainly not going to send my hard-earned e-money to the account of some untraceable joker in exchange for his promise to deliver me a week's worth of groceries.

On Mon, Mar 08, 2004 at 09:19:23AM +0000, Ben Laurie wrote:

And it doesn't even work in theory - once your PC is hacked, the passphrase would be known the first time you used it.

True, but in the current threat model passphrase snarfing is yet negligible (keyloggers look for credit card info, etc.). Also, the fraction of 0wn3d to pristine machines is low, and likely go become lower in future. So the egress points of spam remain few, and if they come with signatures, so much better for us. If they don't come with signatures, or use variable signatures (if you disregard entropy pool issues, how many signatures/min can you churn out on a desktop PC?), ditto (if you compute spam score by signed, and know signed vs unsigned). *BSD and Linux penetration rate (desktop, not server) is low, Redmondware is about to become similiarly hardened at the network layer. Things are still a bit dismal at the userland executable level, but security has become a selling argument. So, sooner or later, they will have to start selling something palpably more secure, instead of just waffling about it. The passphrase locking idear won't fly, but a biometrics-lockable wallet could. Isn't part of Pd envelope goal establishing a tamper-proof compartment? We know Pd is evil, but once hardware support is everywhere, one can as well use it for something positive, for a change. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]