[Mailman-Developers] FYI -- mailback validations no longer safe?

[J C Lawrence]

On Sat, 9 Dec 2000 03:09:26 -0600 
Christopher Lindsey <lindsey@ncsa.uiuc.edu> wrote:

>> I'm passing this along mostly as a FYI, but also as a sanity
>> check. I sent this out to list-managers tonight, to bring up an
>> issue that sort of crystalized this afternoon and made me realize
>> that I think we have the beginnings of a problem in mail list
>> land. Your thoughts are welcome....If I'm right, well, oh,
>> boy. If I'm wrong -- I'd love to find out my idea won't work, but
>> I think it's not only possible, but fairly easy.

> Hi Chuq,

>    Yes, this has definitely been troublesome.  I've blocked many
> commercial sites like findmail.com (egroups) and remarq.com from
> my lists because of their secret archiving that displays email
> addresses to the public, but at least they don't spam the lists
> back.  But of course anyone can browse these sites and get
> addresses to their heart's content, then forge MAIL FROM: to sneak
> mail into the lists.

>    I'm not sure what the right thing is to do.  MLMs like sympa (

>       http://listes.cru.fr/sympa/

>    ) are definitely moving in the right direction with S/MIME
> signatures/encryption and X509 user certs, but that still doesn't
> stop someone from using throwaway certs to spam several lists or
> from harvesting addresses.  

You are failing to distinguish between two problems:

  1) Is this post from someone I know?
  2) Is this post from who I think it is from?

#1 is handled by any form of digital signature, and is handled
especially well by non-centrally signed/verified forms (eg PGP, GPG,
etc).  All that's needed is for the list member to convey or have
conveyed to you their public key.

#2 is handled by having a public key for a member.  It doesn't
matter if it is signed or if Verisign or some other set of pains
vouch for it.  It merely matters that a current post from them
cross-checks with their signature.

So what problem does that leave?

  Is this post, which comes from a member for whom I have a key, and
  which ckecks against his key, SPAM?

It doesn't matter where the keys or certs come from.  It doesn't
matter if a trusted authority is involved or not.  It is a human
question.  I'm sure that spammers are just as capable as we are at
getting demo certs from Thawte, or in cooking up new GPG keys willy
nilly.  

Again, this is a question of trust networks, and is a subset of the
problem of reputational systems.  Unfortunately, unlike the systems
I normally needing reputational systems that I normally spend my
time looking at, this is not an area which panders to central
databases, and over-arching solutions.  SPAM detection at the
individual membership level is a question of individual evaluation.

> The problem is that when these methods are used for authentication
> they just prove that the email address sending the stuff is who we
> think he or she is.  But at least you can't forge the source email
> address to look like it's coming from a list member who is allowed
> to post (well, it's harder :)

It raises the bar to requiring that SPAMers compromise members keys
in a wholesale fashion.  While certainly possible (I spent an hour
last weekend seeing how many exploitable Windows systems I could
find within that hour.  I gave up after about 20 minutes when the
count passed treble digits), the barrier to entry is much larger and
the ROI is much smaller (a compromised key only gains access to a
few lists and posting venues).

> I think that there's an implicit level of trust that has to be
> honored in mailing list management.  Even SASL-based SMTP
> authentication from ISPs isn't going to prevent throw-away
> accounts from being used.  Until we can get a fingerprint or
> cornea scan (or even a driver's license) with each mailing list
> subscription and compare it against a master database (which I'm
> not advocating), you can't be 100% sure of the users.

No.  Think in terms of trust, not identity.  Do you really care that
you can track that particularl membership back to one identifiable
human body?  Really?  Over the entire planet?  Or do you really just
care that JoeBlow has posted signal in the past and you feel that
you can trust him to post signal in the future?

Or more simply, if you are not going to operate on past posting
behaviour as your trust metric:

  Why do you trust member X to not post spam?  What are the criteria
  you use for making that decision?  Why are those criteria
  trustable?  What are the risks?

I like past behaviour as it is simple, non-invasive (I don't need to
know who anybody is), and it fits transparently in as an invisible
extention of traditional list moderation models.  

>    For now I'd say that the best method is a social one; require
> references when people want to subscribe to your list.  Ask them
> which lists they participate on, an example post from another
> list, etc.  But ultimately it becomes a judgement call by the
> listowner either way.

For a few years I ran a list where membersip was by invitation only
-- a current member had to invite you.  It worked well.  Membership
grew steadily, more than 70% of the members regularly posted to the
list, and signal was high.

Later I moved the list to free subscription with posting authority
granted on application only, with applications needing to be
accompanied by a proposed first post.  This too worked well with
minor caveats.  List membership grew roughly twice as fast, but the
poting percentage fell to around 40%.  The caveats were in
maintaining the approved poster list, and in particular determinging
and enforcing policy for removing posting authority was painful.

I currently run an open subscription model with hand moderation of
all posts.  Again, this has worked well.  Subscription rates are
roughly 4 times higher than ever before, but posting percentages are
down in the <10% range.  It is of course labour intensive.

Recently I've moved to not only hand moderating the list, but hand
editing posts (eg to remove HTML, over quoting, inflammatory
content, etc) marking each post I edit with a comment as to the
changes.  While I haven't been doing this for long, subscription
rates have noticably increased by perhaps 20% (tho the sample time
is small).  The work load on me is non-trivial.  It moved me from
the position of gatekeeper to editor, a position I'm willing to
occupy, but am not keen on.

In the end you are trading editorial control (your trust model and
signal definition) for work.  Ultimately you are attempting to
automate the process of determining signal.  The initial
approximation is by determining signal sources.  The approximation
we are discussing above is in determining if signal sources really are
signal sources.

-- 
J C Lawrence                                       claw@kanga.nu
---------(*)                        : http://www.kanga.nu/~claw/
--=| A man is as sane as he is dangerous to his environment |=--