RE: Remailer Abuse Solutions

At 3:12 PM 11/14/1996, Mullen Patrick wrote:
>From: Peter Hendrickson on Thu, Nov 14, 1996 13:22
>> This assumes that spam has gotten so bad that everybody filters their
>> mail and only accepts mail on the "accept" list.  People sending mail
>> directly to your account would get a message back saying that they had
>> to get on the "free" list or send their mail through one of the approved
>> remailers.

> So our ideas on implementation are similar, except you have made the
> distinction that anyone on the "free" list can have direct access.
> Unfortunately, your idea pivots on the idea spam has exploded to unbearable
> proportions.  My complaint on this isn't your idea, it's the projection
> such an event may occur.

People complain all the time about advertising spam.

People have been maliciously spamming other people since the beginning
of time.  (The epoch here is the birth of the Net.)

The problem has arrived.  Right now it is merely irritating, but we
have already seen calls for more control and more legislation.  In my
view, that would be a disaster.  Let's head it off at the pass.

> While I hope this plan won't ever be necessary, at least not on such a
> global scale, the application of such techniques toward a mailing list
> sounds decent.

This may sound like a quibble, but it really isn't: I am not talking about
a global scale at all.  A very small group of people can make use of
this technology successfully.  It doesn't matter whether everybody in
the world uses it or just people who are tired of spam - it still works.

You only need one remailer operator to do this and it will be fully
available.

> I'm still thinking about how I would go about charging WRT mailing lists;
> anonymous postings are puzzling me at the moment.

I was probably a little quick on the keys.  Charging to send to a mailing
list does not solve the spam problem.  Why?  Because it is worth a dollar
to send an advertisement to 3000 people.  What it does do is cut down
on "me too" posts and encourage people to make the best use of the
bandwidth they are paying for.  It would be easy for a remailer operator
to do this if mail were accepted only from the "paying" remailer.

However, if you restrict postings to an approved group of people, perhaps
everybody on the mailing list, you can eliminate spam.  How, then, do we
allow anonymous postings to come through?  Individual people on the list
can receive the proposed post and forward it to the list if it is
appropriate.  They could even charge a fee for doing it.  That's easy to
do if there is a "paying" remailer which will handle the money for them.

> Which brings up another topic:  How would an anonymous remailer operate?
> It's hard to eliminate an audit trail when there is some monetary tie back
> to you, whether it be credit card, ecash (assuming they never quite figure
> out anonymizing it), ...

I assumed untraceable cash transactions for small amounts were available.

E-cash, the product licensed by Digicash, offers full payee anonymity and
would be an ideal candidate.

Peter Hendrickson
ph@netcom.com

Peter Hendrickson writes:
>  E-cash, the product licensed by Digicash, offers full payee
>  anonymity and would be an ideal candidate.

Actually, the current impelmentation of ecash only offers _payer_ anonynmity  
and not payee anonymity.  If the payer reveals the blinding factors and/or  
coin numbers to the bank then the payee is caught when attempting to deposit.   
This on purpose, to prevent scenarios such as the kidnapping one from  
actually happening.  The solution, of course, is for the payee to generate and  
blind the coins and order the payer to have them signed.  Money changers are  
another option, but require you to trust them.


andrew

Content-Type: text/plain; charset="us-ascii"
   Date: Thu, 14 Nov 1996 14:40:29 -0800
   From: ph@netcom.com (Peter Hendrickson)



   E-cash, the product licensed by Digicash, offers full payee anonymity and
   would be an ideal candidate.


  ECASH AND PRIVACY

One of the unique features of ecash is payer anonymity. When paying
with ecash the identity of the payer is not revealed
automatically. This way the payer stays in control of information
about himself. During a payment a payer can of course identify
himself, but only when he chooses so.

Ecash offers one-sided anonymity; when clearing a transaction the
payee is identified by the bank.

    (according to http://www.digicash.com/ecash/about.html)



But what about Okamoto and Ohta's digital cash scheme published in
Crypto '91?  It appears to be fully untraceable and transferable.  Of
course, I haven't heard of anyone trying to use this scheme (has it
been broken?)

Peter Hendrickson <ph@netcom.com> writes:
> However, if you restrict postings to an approved group of people, perhaps
> everybody on the mailing list, you can eliminate spam.  How, then, do we
> allow anonymous postings to come through?  Individual people on the list
> can receive the proposed post and forward it to the list if it is
> appropriate.  They could even charge a fee for doing it.  That's easy to
> do if there is a "paying" remailer which will handle the money for them.

Not necessarily a good idea.  The post may be a hot potatoe, and the
forwarder may find themselves in legal trouble.  (Say RC4 & RC2 source
code, NSA handbook, the results of the Mykotronic's dumpster diving
spree, etc).  Exercising `editorial control' has landed some ISPs in
trouble, to the extent that some are specifically avoiding it for that
legal reason alone.  Being _paid_ for forwarding the message may make
that even worse.

Often the posts which would get the anonymous poster (or the true name
forwarder) into the most troublle, are the ones which are most
interesting, and also very on topic.

Howabout someone liberates skipjack and forwards it to you via
remailers with $50 for your trouble.  Do you bite?  I thought not, NSA
interviews, ITAR violation, etc.

If the spam/off topic posts gets to you badly, perhaps you should
subscribe to a filtered list.  Newsreaders with ratings of posts and
reputation handling of posters would probably help a lot also.
Reputations alone doesn't work that well, many posters in my view are
not consistent, they post good stuff usually, but now and then get
drawn into rambling off topic, or noisy discussions, etc.

Ecash for email works better to stop spam sent directly to email
addresses where you don't cash the money as a curtesy, and your
software junks if it doesn't have valid ecash.  Email spam itself is
getting mildly annoying lately, I get a couple a day average at the
moment.

Adam
--
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`