Re: [Asrg] Please critique my anti-spam system

[Laird Breyer <laird at lbreyer.com>]

On Jan 10 2005, Peter J. Holzer wrote:
> 
> > Only the list expander knows the subaddress. Michael's MUA sends mail
> > to the main address, which replies with a CAPTCHA.
> 
> That's not the way I understood that it works.
> 
> ISACS rewrites all outgoing mails to contain a unique subaddress for
> each recipient. Thus all your mails to the mailing-list will contain
> your subaddress for the recipient asrg at ietf.org, (e.g. <laird.123 at ...>),
> not your main address <laird at ...>.
> 
> When Michael hits the group reply button, his MUA will take the
> addresses from the headers and compose a mail to <asrg at ietf.org> and
> <laird.123 at ...> (It doesn't know that this is a subaddress, nor what the
> main address is).
> 

I didn't think it would be this way, as that would make spam attacks so much
easier.

Consider the following: I give a subaddress laird.123 at ... to
the ASRG mailing list. I now send a message to the list.

1) If the ASRG expander forwards my subaddress laird.123 at ... to everybody
on the list, then everybody knows my subaddress and can send me mail without
being filtered. Moreover, the public archives at

http://news.gmane.org/gmane.ietf.asrg.filtering/

now list the subaddress laird.123 at ... , so anyone on the internet can send
me mail without being filtered.

2) If the ASRG expander censors my subaddress, ie claims the mail is from
laird at ..., then anybody replying to me privately must still pass a CAPTCHA.
But at least the list expander is the only entity which can use the unfiltered
subaddress.

-- 
Laird Breyer.

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg