October 26th, 2007
Why spam can only be managed, not ended
Years ago when I was still a bit more naive, I thought we could end the spam dilemma if we would simply implement domain-level sender authentication using digital signatures. In fact when David Berlind wrote “Why spam could destroy the Internet” in November 2002, Berlind quoted me saying that every domain’s official SMTP server should digitally sign each message to prove the email came from that domain. SenderID and Yahoo’s DomainKeys came out around 2004 gave me the satisfaction of knowing that I wasn’t alone in calling for domain-level authentication and DomainKeys is very similar to what I was proposing in 2002. The difference is that I proposed using standard commercial digital certificates from commercial Certificate Authorities to distribute public keys whereas DomainKeys used DNS to publish its public key information.
I was so sure at the time that if we could only get people to use this system we would surely stop spam. Microsoft’s Bill Gates gave me some company in 2004 when he proclaimed that “spam will be a thing of the past in two years’ time”. As it turns out, we were both wrong and naive to say that we can stop spam because it’s like saying you can stop crime and the most we can ever hope for is to manage it to tolerable levels when there are determined adversaries who will do anything to get around any barrier you can put up. I am coming clean on this now because there are still so people who believe that stopping spam is simple and that if it isn’t stopped, it’s must be the fault of the major ISPs and corporations for dragging their feet.
My colleague David Berlind blamed the spam problem on the big-four email vendors and declared rDNS (reverse DNS) and maybe SPF (Sender Policy Framework) the solution. Now I’m certainly not trying to belittle David Berlind because his heart is definitely in the right place. In fact, I’m essentially saying that Bill Gates and I were wrong to say that say that spam could be stopped and that it’s about time my colleague David Berlind takes a good hard look at the problem and stop implying that spam could be stopped if only we did XYZ.
The fundamental challenge here is that we’re will never stop spam because we will never go to the pure white-list model where we will only accept email from verified entities. In fact there’s the little problem of human rights we have to deal with because words can get you imprisoned or executed in many countries. I never gave much consideration to this issue in the past but I’ve given it some thought over the years and I’ve given in to the legitimate need for anonymous and decentralized email.
Why charging for email to stop spam is just plain dumb
One of the most commonly floated ideas for stopping email spam is that if only we charged a postage fee for every email ever sent, then the cost of spending spam would be so outrageous that it would deter spammers. Not only will it not work, but there is the risk of abuse by some larger ISPs to charge users and legitimate companies for sending legitimate bulk email under the justification of stopping spam. Why bother charging honest people for email when you can simply fine the bad apples and leave everyone else alone?For one thing, spammers don’t send the spam directly; they have their hijacked botnet armies send it for them. These are personal computers (and some servers) that have been taken over with malicious software by criminal. If anyone is going to pay, it will be the owners of those computers who pay.
The second most obvious thing that proponents of the email postage idea missed is that if you actually had such a massive billing scheme in place, it would have to have every sender registered with their credit card on file and every email ever sent had a digital signature that proves it was sent by the purported sender. If this were the case, you would have already stopped spam without charging a dime for any emails because you can slap them with a massive fine if they ever dared send spam. Why bother charging honest people for email when you can simply fine the bad apples and leave everyone else alone?
<Next page - The key to managing spam is reliable white-lists>
Pages: 1 2
George Ou is Technical Director of ZDNet. See his full profile and disclosure of his industry affiliations.
