Hardening lists against spam attacks

The Christmas attack against this list shows the need to develop lists
which are resistant to attacks.  If cyberspace is to become the town square
of the next century, we need to be able to discourage brown shirts attacks
on political gatherings.  If lists are to be a major part of the political
life of the community, then they must be resistant to attacks from
knowledgeable, well financed attackers, not just the shits who were the
most recent perps.

There are several principles which should be observed:

(1) Since attacks are based on sending to the list, receiving the list
should remain substantially unchanged.

(2) Spam attacks should be throttled at the source, so they do not act as a
denial of service attack on the list server.

Here is a sketch of a protocol which attempts to achieve these goals:

(1) All messages sent to the list must be encrypted with the list's public
key.  This requirement is primarily to protect the posting token (see
below).  However, it alone will probably reduce the problem.  Certainly it
will eliminate the effectiveness of the "subscribe the list to some other
list" attacks.

(2) In order to post to the list, the poster must have a valid posting
token.  These tokens are available, in limited number, anonymously.  Tokens
remain valid unless canceled for abuse.  However, if too many posts are
received with a given token, TCP performance on sockets using that token
may become arbitrarily slow (or the circuit may be dropped).

(3) In order to limit the number of posting tokens, the list server will
only issue a few per day.  The lucky few who get them, everyone who asks
under normal circumstances, may be determined by an algorithm designed to
limit token collection by future attackers.  (This area is where this
proposal needs work!)


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA

Bill Frantz wrote:
> 
> (3) In order to limit the number of posting tokens, the list server will
> only issue a few per day.  The lucky few who get them, everyone who asks
> under normal circumstances, may be determined by an algorithm designed to
> limit token collection by future attackers.  (This area is where this
> proposal needs work!)
> 

Send a number of unique tokens to each subscriber each day.  Enforce a
rule that only posts with valid current tokens may be accepted. The
number of tokens should initially be very small (say, one per day) and
then should be quickly increased to a sufficient number, like 10 or 20,
as the subscriber shows a record of using tokens properly (as defined by
acceptable content rules).

A database is kept as to who was issued which tokens.

If tokens are used improperly (to post off-topic materials) the 
offending subscriber is denied any further tokens.

The problem of this scheme is (besides its cost) that anonymous users
will not be truly anonymous.

	- Igor.

Igor Chudov @ home wrote:
 
> If tokens are used improperly (to post off-topic materials) the
> offending subscriber is denied any further tokens.

  I'm sure that the NSA would be more than happy to take responsibility
for deciding which posts are off-topic.

Toto <toto@sk.sympatico.ca> writes:

> Igor Chudov @ home wrote:
>
> > If tokens are used improperly (to post off-topic materials) the
> > offending subscriber is denied any further tokens.
>
>   I'm sure that the NSA would be more than happy to take responsibility
> for deciding which posts are off-topic.

Cocksucker John Gilmore is an NSA shill who decides what's "off-topic"
and unsubscrives whomever Arachelian@ASALA doesn't like.  What an asshole.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Tue, 31 Dec 1996 ichudov@algebra.com wrote:

> Send a number of unique tokens to each subscriber each day...
> ...
> A database is kept as to who was issued which tokens.
> 
> If tokens are used improperly (to post off-topic materials) the 
> offending subscriber is denied any further tokens.
> 
> The problem of this scheme is (besides its cost) that anonymous users
> will not be truly anonymous.

There is a simple solution to keeping anonymous posters anonymous
under this or any similar scheme.  Volunteers could act as
"gateways" for anonymous posts.  Self-selected list members could
announce that they would forward anonymous posts using one of
their own tokens for the purpose.  (In the alternative, the
gateway volunteers could be given extra tokens solely for that
purpose.)

The gateway volunteers would be a firewall against flames and
spam attacks, but would be a conduit for substantive anonymous
posts.  If gateway volunteers allowed inappropriate flames and 
spams through, they would have *their* tokens reduced.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On Tue, 31 Dec 1996, Sandy Sandfort wrote:

> There is a simple solution to keeping anonymous posters anonymous
> under this or any similar scheme.  Volunteers could act as
> "gateways" for anonymous posts.  Self-selected list members could
> announce that they would forward anonymous posts using one of
> their own tokens for the purpose.  (In the alternative, the
> gateway volunteers could be given extra tokens solely for that
> purpose.)
> 
> The gateway volunteers would be a firewall against flames and
> spam attacks, but would be a conduit for substantive anonymous
> posts.  If gateway volunteers allowed inappropriate flames and 
> spams through, they would have *their* tokens reduced.

Only problem is that the Vulis^H^H^H^H^Hspammer could still mail flood 
the gateway dudes.  The gateway dudes should be ready for such attacks 
and should be able to handle them.

Such a flood could result in a denyal of post since if you flood someone 
with ten thousand random spams, then the posts worth delivering will get 
lost among those.  So the gateway dudes should be competent enough to 
deal with this sort of thing.

I wouldn't mind running such a gateway if it will fly and I have the time 
since I already provide this sort of filtering anyway.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    | "If  you're  gonna die,  die  with your|./|\.
..\|/..|sunder@sundernet.com|boots on;  If you're  gonna  try,  just |/\|/\
<--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/
../|\..| "A toast to Odin,  |you're gonna die, you're gonna die!"    |.\|/.
.+.v.+.|God of screwdrivers"|  --Iron Maiden "Die With Your Boots on"|.....
======================== http://www.sundernet.com =========================

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 31 Dec 1996, Igor Chudov @ home wrote:

> Send a number of unique tokens to each subscriber each day.  Enforce a
> rule that only posts with valid current tokens may be accepted. The
> number of tokens should initially be very small (say, one per day) and
> then should be quickly increased to a sufficient number, like 10 or 20,
> as the subscriber shows a record of using tokens properly (as defined by
> acceptable content rules).
> 
> A database is kept as to who was issued which tokens.
> 
> If tokens are used improperly (to post off-topic materials) the 
> offending subscriber is denied any further tokens.
> 
> The problem of this scheme is (besides its cost) that anonymous users
> will not be truly anonymous.

I think this problem can be solved by blind signing the tokens.  A user
generates a random number, multiplies it by the blinding factor, then sending
it to a token server which would append a timestamp and sign the blinded
token.  All signature requests should be signed with a PGP key.  The server
response would be encrypted with the user's public key.  A person's PGP key
would be sent along with the subscription request and then saved by the list
software.

The token would be included in a user's list submission, removed, and saved by
the list software to detect any duplicates.  The server would issue a limited
number of tokens to each public key registered with it.  If two signed requests
come from the same email address in the same day signed with different keys,
only the tokens in the first request should be signed.

The only problem with this scheme is the inconvenience of having to register
a public key with the server before posting.  Someone with many different email
addresses could generate a public key for each address to get more tokens.  The
only way to prevent this is to control list subscriptions.


Mark
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQEVAwUBMsk8uCzIPc7jvyFpAQHFvAgAoogQTxQH74MbtDUSQgfkbwDRIJ1rXaXQ
zqf4D+JyRcpFXUv0cKuUoLGFTkTKdhtGrIBfqhZJvC/n/fWOV0DHIO4asNZWqtEa
NFIsWPyJqrOceCPfTLv4wft9X8aMybu6nOy/B6/NHr+Lw2p5TsfFbms4pHvrE5zt
daZ7zpPkI8l1qDI1I0XUaF6vBOGl3nJtg4NewCagpB8mZulT6wmetoe5NHmrTYEA
OI+UhgCWZSUJTJ2kC+liBmCwZ7+Z1JW39rOpLP6Y4Eo/o8mGErePKFK3ZbTVvfV8
5KyZn7HTxwmoTkEkRt0lOLpqU3afXJVdca9McCBoSklwveMoNwOmEQ==
=pvLP
-----END PGP SIGNATURE-----

On Tue, 31 Dec 1996 ichudov@algebra.com wrote:

> Send a number of unique tokens to each subscriber each day.  Enforce a
> rule that only posts with valid current tokens may be accepted. The
> number of tokens should initially be very small (say, one per day) and
> then should be quickly increased to a sufficient number, like 10 or 20,
> as the subscriber shows a record of using tokens properly (as defined by
> acceptable content rules).
> 
> A database is kept as to who was issued which tokens.
> 
> If tokens are used improperly (to post off-topic materials) the 
> offending subscriber is denied any further tokens.
> 
> The problem of this scheme is (besides its cost) that anonymous users
> will not be truly anonymous.

This scheme wouldn't necessarily map True Names to tokens; merely
list subscriptions.  If an account at a nymserver were to subscribe,
there would be no way to identify the account holder.

The real problem is that there could be a lot of subscriptions
from a site like  nymserver.bwalk.com . . . .

Alan Bostick               | I'm not cheating; I'm *winning*!
mailto:abostick@netcom.com |      Emma Michael Notkin
news:alt.grelb             | 
http://www.alumni.caltech.edu/~abostick

Alan Bostick <abostick@netcom.com> writes:
> On Tue, 31 Dec 1996 ichudov@algebra.com wrote:
>
> > Send a number of unique tokens to each subscriber each day.  Enforce a
> > rule that only posts with valid current tokens may be accepted. The
> > number of tokens should initially be very small (say, one per day) and
> > then should be quickly increased to a sufficient number, like 10 or 20,
> > as the subscriber shows a record of using tokens properly (as defined by
> > acceptable content rules).
> >
> > A database is kept as to who was issued which tokens.
> >
> > If tokens are used improperly (to post off-topic materials) the
> > offending subscriber is denied any further tokens.
> >
> > The problem of this scheme is (besides its cost) that anonymous users
> > will not be truly anonymous.
>
> This scheme wouldn't necessarily map True Names to tokens; merely
> list subscriptions.  If an account at a nymserver were to subscribe,
> there would be no way to identify the account holder.
>
> The real problem is that there could be a lot of subscriptions
> from a site like  nymserver.bwalk.com . . . .

Dr. Grubor has proposed that homosexuals be required to identify themselves
in e-mail headers. What about banning people who identify themselves as
homosexuals (or fraudulently fail to identify themselves)?

By the way, how come it's mostly homos like Bostick who
contribute to censorship threads?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Igor Chudov @ home wrote:
> Bill Frantz wrote:
> > (3) In order to limit the number of posting tokens, the list server will
> > only issue a few per day.  The lucky few who get them, everyone who asks
> > under normal circumstances, may be determined by an algorithm designed to
> > limit token collection by future attackers.  (This area is where this
> > proposal needs work!)[snip]
> Send a number of unique tokens to each subscriber each day.  Enforce a
> rule that only posts with valid current tokens may be accepted. The
> number of tokens should initially be very small (say, one per day) and
> then should be quickly increased to a sufficient number, like 10 or 20,
> as the subscriber shows a record of using tokens properly (as defined by
> acceptable content rules).[snip]

Why not have any list deal with a heirarchy of security, so that:

n-number of posters will use the highest level of security
m-number will use a lower level of security
k-number will send plain text

Flags can be assigned for various purposes:

What level of encoding I send my messages with
What level I can receive
Restrictions on delivery of my messages according to a table maintained
  by the list managers

On Tue, 31 Dec 1996 ichudov@algebra.com wrote:

> The problem of this scheme is (besides its cost) that anonymous users
> will not be truly anonymous.

Not only that, but what's the stop the anon users from claiming to be 
OTHER anon users and requesting tokens.

Say have one true user (Vulis) create 10 zillion tentacles and request 10 
zillion tokens, one from each tentacle and then use them all to post spam?

Human review of posts is likely the only way.  Sure, some things can be 
filtered out, you can look for messages that are less than 1K in size and 
have the words "Timmy" "Mayonaise" "Maya" and various other derogatory 
terms nearby and reject them pronto, but that will only have Vulis change 
the spelling of those words slightly each day and have them show up on the 
list anyway.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    | "If  you're  gonna die,  die  with your|./|\.
..\|/..|sunder@sundernet.com|boots on;  If you're  gonna  try,  just |/\|/\
<--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/
../|\..| "A toast to Odin,  |you're gonna die, you're gonna die!"    |.\|/.
.+.v.+.|God of screwdrivers"|  --Iron Maiden "Die With Your Boots on"|.....
======================== http://www.sundernet.com =========================

This is the first posting I have seen (someone unSCUMscribed me a
few days ago) which addresses the need for having defences in
place against spamming attacks.

  The fact is, the InterNet is a global neighborhood, and everyone
will be affected by the security or non-security of their neighbors.
Since the Web is currently seen as the new 'gold rush', every Tom,
Dick and Harry who wants to capitalize on it will be putting up
web sites, with their concern being focused much more on increasing 
their piece of the pie, than on being good neighbors.
  So sports lists are going to make it easy-as-pie for 10,000 Laker's
fans named Bubba to subscribe to their list and, as a result, make it
also as easy-as-pie for people to take advantage of their come-one-
come-all policy in order to engage in the sport of spamming. 

  While there are many good list operators who take reasonable
precautions against abuse of their system, they are often still
left open to abuse coming from the system of less concerned
list operators.
  It would seem to me that part of the solution would be to have
in place a monitoring system which would reflect a sudden increase
in email coming in from new (or current) sources.  Then the source
of any excessive increase could be put on 'hold' until the system
operator has a chance to check on the validity of the reason behind
the sudden increase.
  (20 messages from Bubba is an inconvenience, but 500 messages
is a royal pain-in-the-ass)

  As for 'mailbots', I think that any solutions to the potential
abuse will only be a 'stopping action', at best.
  My view is that the machines are starting to make their play
towards taking over, and that we will eventually be doomed to be
their slaves, and not the other way around.
 
Toto
Bill Frantz wrote:
> 
> The Christmas attack against this list shows the need to develop lists
> which are resistant to attacks.  If cyberspace is to become the town square
> of the next century, we need to be able to discourage brown shirts attacks
> on political gatherings.  If lists are to be a major part of the political
> life of the community, then they must be resistant to attacks from
> knowledgeable, well financed attackers, not just the shits who were the
> most recent perps.
> 
> There are several principles which should be observed:
> 
> (1) Since attacks are based on sending to the list, receiving the list
> should remain substantially unchanged.
> 
> (2) Spam attacks should be throttled at the source, so they do not act as a
> denial of service attack on the list server.
> 
> Here is a sketch of a protocol which attempts to achieve these goals:
> 
> (1) All messages sent to the list must be encrypted with the list's public
> key.  This requirement is primarily to protect the posting token (see
> below).  However, it alone will probably reduce the problem.  Certainly it
> will eliminate the effectiveness of the "subscribe the list to some other
> list" attacks.
> 
> (2) In order to post to the list, the poster must have a valid posting
> token.  These tokens are available, in limited number, anonymously.  Tokens
> remain valid unless canceled for abuse.  However, if too many posts are
> received with a given token, TCP performance on sockets using that token
> may become arbitrarily slow (or the circuit may be dropped).
> 
> (3) In order to limit the number of posting tokens, the list server will
> only issue a few per day.  The lucky few who get them, everyone who asks
> under normal circumstances, may be determined by an algorithm designed to
> limit token collection by future attackers.  (This area is where this
> proposal needs work!)
> 
> -------------------------------------------------------------------------> Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
> (408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
> frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA

Bill Frantz wrote:
> The Christmas attack against this list shows the need to develop lists
> which are resistant to attacks.  If cyberspace is to become the town square
> of the next century, we need to be able to discourage brown shirts attacks
> on political gatherings.  If lists are to be a major part of the political
> life of the community, then they must be resistant to attacks from
> knowledgeable, well financed attackers, not just the shits who were the
> most recent perps.

[snip]

> All messages sent to the list must be encrypted with the list's public key.

So in order to post here, I hafta install and run PGP?  Well, people
were looking for the perfect formula to deny service to guys like me,
and guess what?  You found it!  I will *not* install and run PGP.

On Tue, 31 Dec 1996, Dale Thorn wrote:

> Bill Frantz wrote:
> > The Christmas attack against this list shows the need to develop lists
> > which are resistant to attacks.  If cyberspace is to become the town square
> > of the next century, we need to be able to discourage brown shirts attacks
> > on political gatherings.  If lists are to be a major part of the political
> > life of the community, then they must be resistant to attacks from
> > knowledgeable, well financed attackers, not just the shits who were the
> > most recent perps.
> 
> [snip]
> 
> > All messages sent to the list must be encrypted with the list's public key.
> 
> So in order to post here, I hafta install and run PGP?  Well, people
> were looking for the perfect formula to deny service to guys like me,
> and guess what?  You found it!  I will *not* install and run PGP.
> 
I agree with Dale here...requiring PGP in order to post would probably 
deter low-level, idiot spammers, but it would also keep those people off 
the list who, for one reason or another, don't like/want/use PGP.  Also, 
what about people who post to and read the list from someplace other than 
their home computer, like school or work?  I have access to this account 
from my college, but I'm sure not going to leave my keys lying around 
my account just so I can post to a mailing list.




Zach Babayco 

zachb@netcom.com <-------finger for PGP public key

If you need to know how to set up a mail filter or defend against 
emailbombs, send me a message with the words "get helpfile" (without the 
" marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!*  I have 
several useful FAQs and documents available.

Babayco wrote:
> I agree with Dale here...requiring PGP in order to post would probably 
> deter low-level, idiot spammers, but it would also keep those people off 
> the list who, for one reason or another, don't like/want/use PGP.  Also, 

     This is cypherpunks, if we can't be bothered to use crypto software,
then how can we tell others they should? 

> what about people who post to and read the list from someplace other than 
> their home computer, like school or work?  I have access to this account 
> from my college, but I'm sure not going to leave my keys lying around 
> my account just so I can post to a mailing list.

     Seperate key for that account/mailing list.


Petro, Christopher C.
petro@suba.com <prefered for any non-list stuff>
snow@smoke.suba.com

On Tue, 31 Dec 1996, snow wrote:

> Babayco wrote:
>      This is cypherpunks, if we can't be bothered to use crypto software,
> then how can we tell others they should? 
	Do you think there is a difference between encouragement and dogma?
Sorry. I apologize for my emotional involvement; I find this issue 
annoying, mainly because it will affect me directly. 

> 
> > what about people who post to and read the list from someplace other than 
> > their home computer, like school or work?  I have access to this account 
> > from my college, but I'm sure not going to leave my keys lying around 
> > my account just so I can post to a mailing list.
> 
>      Seperate key for that account/mailing list.
	What about those without persistent storage? Many computer labs 
in schools and libraries choose to install security software of some 
sort. This causes their machines to behave in odd ways, insofar as they 
find and delete all foreign data. A variant of the same quirk prevents 
one from recognizing any but a select set of applications, no matter 
where they are placed.

Netscape is one of these apps. PGP is not.

My only access to e-mail, during much of the year, is through just such 
a lab. As a result, I am in the unenviable position of using hotmail.com and 
mailmasher.com for most of my correspondence. Even if it were possible to 
install PGP on these machines, there is no provision as yet for the kind 
of integration possible with, say, Eudora, PIdaho, or pine. Special 
client software might ameliorate the problem, but will not be installed 
without much administrative hand-wringing.

I am fortunate enough to have my own computer. I can create messages 
there w/PGP and then bring them to a networked computer for sending. My 
chances of doing so are about equal to the chance that UNLV will win the 
Rose Bowl next year. 

The simple fact is that I am lazy. I respond to messages on cypherpunks 
spontaneously, as I see topics of interest (and this is one of 'em!). 
Rather than somehow forcing me to spend more "thought" and "energy" in my 
posts, these kinds of measures will create frustration and 
disillusionment, _ESPECIALLY_ when things fail to interface correctly and 
cause my messages to bounce. I have no patience for such arbitrary criteria.

Making message delivery harder will not magically cause me to spend more 
time on the actual composition. It will simply take time away from the 
next message. I try to spend a fair amount of time on each post 
already...why should I be penalized for attempting to contribute?

In any case, what bogeyman are we worried about, anyway? Pseudonyms? This 
list is already full of 'em. That's nothing new. Forged messages? If you 
trust anything you read on the Internet...well.. Privacy? It's a public 
mailing list, and one which I have long respected for its tradition of 
openness and inclusion.
<casts nervous glance>

Sorry about the ranting, but as I noted above, my own ox is being gored 
here. :-) 

-David Molnar

application/pgp-message

snow wrote:
> The Thorn wrote:
> > Bill Frantz wrote:
> > > All messages sent to the list must be encrypted with the list's public key.

> > So in order to post here, I hafta install and run PGP?  Well, people
> > were looking for the perfect formula to deny service to guys like me,
> > and guess what?  You found it!  I will *not* install and run PGP.

> Why not? There are acceptable email interfaces for just about every
> platform out there (pgp-elm, Eudora hooks, Private Idaho etc), and it
> really isn't _that_ much of a hassle to do.

I should clarify:  I won't use it if I don't have to, and I could make
a list of reasons if need be.  I think the requirement to use PGP could
be an excellent way to shake off a lot of subscribers/posters, many of
whom heavy users of the list would like to see go away anyway.

All I'm really pointing up is the exclusion of a class of subscribers.

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 31 Dec 1996, snow wrote:


  [NON-Text Body part not included]

That message said:

>-----BEGIN PGP SIGNED MESSAGE-----
>
>The Thorn wrote:
>> Bill Frantz wrote:
>> > All messages sent to the list must be encrypted with the list's
>public key.
>> 
>> So in order to post here, I hafta install and run PGP?  Well, people
>> were looking for the perfect formula to deny service to guys like me,
>> and guess what?  You found it!  I will *not* install and run PGP.
>
>     Why not? There are acceptable email interfaces for just about every
>platform out there (pgp-elm, Eudora hooks, Private Idaho etc), and it 
>really isn't _that_ much of a hassle to do.
>
>    It isn't enough to _write_ the code, or even to talk about it, you
>have 
>to USE it as well.
>
>
>Petro, Christopher C.
>petro@suba.com <prefered for any non-list stuff>
>snow@smoke.suba.com
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.3i
>Charset: noconv
>
>iQCVAwUBMsmcRPee0/pvOCipAQH0fQP/aUpiKWhsR5l7IYKOHQ0KbW6haFee0IYB
>PS191z1Mb/yVdqlbVCoQrqIAMCNTnWWMsLzwJDwczFrNcCO/Gn9T+jD3Vcv3D9Jx
>mkXLSGBJUXW4/JosUJWHHh3yJFL0dYFveGPkkM4LUpe9waVdAbhUcXX7zbleK+Fs
>mXMRLOqhHf4=
>=uAlw
>-----END PGP SIGNATURE-----


I am using one of those email interfaces (premail + pine) and had trouble
reading your last message.  I had to save the PGP attachement to a file.
To quote it, I had to read it in from a file.  No big deal, and if I
changed software I could probably make it automatic.  I suspect most
people on the list have yet to set up any software of this type.  So if I,
already using such software, had a little trouble with one message, how
much trouble would others have?  Then if the entire list were encrypted?
I suspect the list would lose a lot of subscribers.


- --------------------
Scott V. McGuire <svmcguir@syr.edu>
PGP key available at http://web.syr.edu/~svmcguir
Key fingerprint = 86 B1 10 3F 4E 48 75 0E  96 9B 1E 52 8B B1 26 05



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBMsn4/d7xoXfnt4lpAQGVjgQAtBUbc4+1NJza4Dkpb5e5iH8oqkimPN1y
L2OBkEwczlOmibGGQXju24jcubqbj5a+yl9GvmpA5kqoWvgMPSMWhHy0dya0nuZ5
f+9k1MqIBJzcC92GK3YM0e2kTL5GW8w+6FKgg7qNh5Tj3pSIq6o94pjNt05CO5qG
O9dz0HNaOl0=
=8CFz
-----END PGP SIGNATURE-----

I guess from reading Scott McGuire's message I should have described the
posting procedure as well as the token issuing procedure.  Here is what you
do to post:

Poster writes the post and include the token in the required place
(wherever that turns out to be).  Poster encrypt the message with the
list's secret key and sends it to the list.  Majordomo decrypts the
message, checks the token, and if the token check passes, sends the
plaintext of the message to the list members.

Important points:

(1) You do not need a secret key to post.  This feature allows you to post
from machines where you don't want to store your secret key ring.
(2) List members do not need PGP, only posters.
(3) People who want to post who can't due to local policy (e.g. no PGP)
have choices:
 (a) Get a real ISP and machine and become a first class citizen.
 (b) Send the post to someone who can post via private mail, explain
     the situation and ask to have it posted.

The principle reason for using PGP for posting is to protect the token from
theft.  I don't know a single-message, one-way protocol where a person can
show possession of a token without reveling it.  If there is such a
protocol, then PGP is no longer required.

David Molnar asks:
>In any case, what bogeyman are we worried about, anyway? Pseudonyms? This
>list is already full of 'em. That's nothing new. Forged messages? If you
>trust anything you read on the Internet...well.. Privacy? It's a public
>mailing list, and one which I have long respected for its tradition of
>openness and inclusion.
><casts nervous glance>

The bogeyman is flooding attack which make the list server effectivity
unavailable.  I have tried to preserve all the features he lists.


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA

There seems to some confusion about what I actually proposed.  (I never
seem to be able to write clearly the first time.)  Let me describe in more
detail my currently preferred token distribution system.

First some definitions:
  Majordomo - The rule based administrator for the list
  List administrator - The rule maker.  Also does the things majordomo can't.
  poster - someone who wants to post a message to the list
  list member - those who receive the list.

Token distribution works like this:  A poster desiring a token sends a
request to majordomo and includes a public key.  This request can be sent
thru a remailer chain.  Majordomo generates a token (think of it as a
secret key), encyphers it with the public key, and posts it to the list.
Note that the poster does not have to be subscribed to the list.  The token
can be recovered from the archives or from a reflector list.  (Thanks to
Tim May for the suggestion of this method of distribution.)

Now we have given poster an anonymous token.  Since tokens are good
forever, true anonymity requires a new token for each post.  Otherwise the
poster only has a pseudonym.  I consider this feature an advantage.

Since tokens are good forever, majordomo will only give out a limited
number per day.  I suggest four.  This limit will somewhat protect against
the attack Ray Arachelian pointed out of having one abusive user collect
10,000,000 tokens.


It is important to recognize the class of problems I am trying to solve.
While I would like to solve the sporadic "make money fast" spam problem, I
agree with Tim that, at today's levels, it is only an annoyance.  I also
agree that the drivel that comes from some of our more prolific posters is
best handled by filtering by the list members themselves.  (I currently
have 3 of them going directly to the trash.  Perhaps aga should get
kickbacks from Qualcomm.  He managed to sell a copy of EudoraPro.)

The problem I am really concerned with is denial of service attacks via
flooding.  With 1000 list members, each message to the list requires a lot
of resources to handle compared with the ones it requires to send.  This
fact gives an attacker a bit advantage.  Tokens are designed to enable
majordomo to recognize the source of messages and provide lower performance
reception to those who are sending a lot of messages.  This technique is
similar to the technique used by the Whitehouse mail system to limit
flooding attacks.  (And the idea came from a description of that system
posted here some months ago.)

Tokens would also give the list administrator a tool to discourage certain
posters.  If John Gillmore wanted to make it hard for Dimitri to post, he
could cancel Dimitri's token.  Dimitri could get another one (under a
different name if Majordomo's instructions prevented it from giving him
one), but John could continue the cancel the new ones.  (N.B. There is no
evidence that John actually wanted to keep Dimitri from posting.  This
example is only a hypothetical.)


Sandy suggests gateways (i.e. distributed moderators) to preserve
anonymity.  While I don't think they are needed to preserve anonymity, they
will be useful for those who can't or won't encrypt their posts.  It is
important to note here that anyone with a token can act as a gateway.


I was trying to make only small changes in the dynamics of the list.  As
such, the market based solutions are more radical than I was willing to
consider.  I would like to see a market based system in actual use, but
perhaps elsewhere.  The idea seems better fitted to Robert Hettinga's e$pam
list.


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA

> [...] the drivel that comes from some of our more prolific posters is
> best handled by filtering by the list members themselves.  (I currently
> have 3 of them going directly to the trash.  Perhaps aga should get
> kickbacks from Qualcomm.  He managed to sell a copy of EudoraPro.)

It would be nice if each user could install filters on Majordomo itself.
Not only would we not need to buy Eudora Pro, but we wouldn't have to
pay to download messages we didn't want to read, and without having
to employ a moderator (censor). The most serious drawback 
I can think of is the slight loss of privacy involved in revealing
one's filtering preferences to the server - however, the people who
get filtered are generally no secret.  You just told the list you
filter aga for example. 

In conjunction with your token scheme (maybe even without it), something 
like that could cut volume really nicely.  In conjunction with anonymous
subscription, people might be willing to run more powerful filters on 
the server end (positive filtering, keyword search, etc) [that would need 
some kind of token scheme, else spammers/mailbombers could just stuff 
their articles with keywords].  It might even be possible to implement 
a feature like 'subscribe cypherpunks-lite', where you get subscribed to 
a list minus the most filtered posters...

Cheers,
Frank O'Dwyer

Frank O'Dwyer writes:
 
 
> > [...] the drivel that comes from some of our more prolific posters is
> > best handled by filtering by the list members themselves.  (I currently
> > have 3 of them going directly to the trash.  Perhaps aga should get
> > kickbacks from Qualcomm.  He managed to sell a copy of EudoraPro.)
> 
> It would be nice if each user could install filters on Majordomo itself.
> Not only would we not need to buy Eudora Pro, but we wouldn't have to
> pay to download messages we didn't want to read, and without having
> to employ a moderator (censor).


Bad idea.  It's tough enough on the host running a list with 1500 or
2000 people on it.  Adding outbound filtering for each user would
be a real burden on the list host.  It's better to distribute the
processing by making the user agent (or mail transport that's delivering
to the user) do the filtering.

In addition, a filtering majordomo will only 'protect' the lists that it
serves.  I don't know about you but I get a lot of spam from all sorts
of different sources.  I need to have a filter anyhow.  It's not hard to
add some more rules to filter out each lists's bozos.  It's a lot
simpler to do that than it would be to upload filter rules to each
of the 10 or 12 listservers I get mail from.


There's also a security issue.  How are you going to set it up so
that I can't say hack Tim May's filters to send him nothing but posts
from Phil H-B and Detwiler?  Yea, you can do it with passwords or
PGP or whatever, but it's still more overhead.  Why bother with it
when you don't need to?


-- 
Eric Murray  ericm@lne.com  ericm@motorcycle.com  http://www.lne.com/ericm
PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03  92 E8 AC E6 7E 27 29 AF

> > It would be nice if each user could install filters on Majordomo itself.
> > Not only would we not need to buy Eudora Pro, but we wouldn't have to
> > pay to download messages we didn't want to read, and without having
> > to employ a moderator (censor).
>  
> Bad idea.  It's tough enough on the host running a list with 1500 or
> 2000 people on it.  Adding outbound filtering for each user would
> be a real burden on the list host.  It's better to distribute the
> processing by making the user agent (or mail transport that's delivering
> to the user) do the filtering.

I guess you're not paying for your mail then :-)  Just stand back from
this for a moment -  doesn't it seem just nonsensical to have a robot 
(majordomo) cranking out 10s of messages to 1000s of users, day in day 
out, just for other robots (filters) to delete them?  And to pay for 
the privilege?

I mean, is it really better to consume the cycles on _everybody's_ 
machine, _plus_ use all that bandwidth? I'd say that's not obvious.  
Granted, it takes my creaking old 486 about 10 minutes for exmh to do 
a filtered 'inc' on the new mail. However I have to pay the phone bills 
to download all the cruft in the first place, just in order to get the 
rare nugget. And I can't use my mailer while the 'inc' is running. And if 
everyone else is paying and and waiting too, then maybe it turns out to 
be better for the messages to be filtered centrally, so we all waste less 
time and money, even if the server does heat up a little. (Hell, I might 
even chip in to upgrade the list server if that's what it took, and still 
save money.)

Besides, it's not necessarily true that filtering would make the server load
significantly worse (certainly not if PGP is the other option), or even 
that it makes it worse at all. For example, the overhead on doing a lookup 
on a short list of filtered users might well be more than offset by not 
having to send the message. (Having once seen a DEC alpha brought to its 
knees by 'sendmail', I can believe that...).  If processing turned
out to be a genuine problem then maybe the list could be split over 
several servers. (In an ideal world, of course, the filtering agents 
would be mobile, and would learn to back all the way up the pipe and 
would eventually run on the spammer's machines :-)

> In addition, a filtering majordomo will only 'protect' the lists that it
> serves.  I don't know about you but I get a lot of spam from all sorts
> of different sources.  I need to have a filter anyhow.  It's not hard to
> add some more rules to filter out each lists's bozos.  It's a lot
> simpler to do that than it would be to upload filter rules to each
> of the 10 or 12 listservers I get mail from.

True, but I'd sure love not to have to download some of the cruft down 
the old 28.8 line in the first place...I suppose IMAP would have the same
thing going for it but it's not here yet (plus you still have all that
list cruft that 99% of people filter or delete going up and down the 
internet).  

[ deletia ... The security issues you mention are real, but so are 
the solutions you mention :-) ]

Cheers,
Frank O'Dwyer.

Frank O'Dwyer wrote:
> > [...] the drivel that comes from some of our more prolific posters is
> > best handled by filtering by the list members themselves.  (I currently
> > have 3 of them going directly to the trash.  Perhaps aga should get
> > kickbacks from Qualcomm.  He managed to sell a copy of EudoraPro.)

> It would be nice if each user could install filters on Majordomo itself.
> Not only would we not need to buy Eudora Pro, but we wouldn't have to
> pay to download messages we didn't want to read, and without having
> to employ a moderator (censor). The most serious drawback
> I can think of is the slight loss of privacy involved in revealing
> one's filtering preferences to the server

[snip]

The most serious drawback is the precedent you'd be setting.

Bill Frantz <frantz@netcom.com> writes:

> There seems to some confusion about what I actually proposed.  (I never
> seem to be able to write clearly the first time.)  Let me describe in more
> detail my currently preferred token distribution system.
...

There's no confusion. You propose even more censorship than there is now.

> Since tokens are good forever, majordomo will only give out a limited
> number per day.  I suggest four.  This limit will somewhat protect against
> the attack Ray Arachelian pointed out of having one abusive user collect
> 10,000,000 tokens.

Ray "Arsenic" Arachelian of ASALA/Earthweb is a lying piece of shit, like
the rest of the "cypher punks".

You can complain about Ray Arachelian's libel, spam, forgery, and other
net-abuse to the owners of Earthweb, LLC - the Web designer employing Ray
as an associate network administrator - Jack Hidary <jack@earthweb.com>,
Murray Hidary <murray@earthweb.com>, and Nova Spivack <nova@earthweb.com>.

> have 3 of them going directly to the trash.  Perhaps aga should get
> kickbacks from Qualcomm.  He managed to sell a copy of EudoraPro.)

Qualcomm fired Kent Paul Dolan, so they're not all that bad.

> Tokens would also give the list administrator a tool to discourage certain
> posters.  If John Gillmore wanted to make it hard for Dimitri to post, he
> could cancel Dimitri's token.  Dimitri could get another one (under a
> different name if Majordomo's instructions prevented it from giving him
> one), but John could continue the cancel the new ones.

I'm sure the cocksucker John Gilmore would masturbate every time he did that.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Bill Frantz writes:

[snip lots of good ideas about token distribution]

A very good scheme, but why not give each subscriber a token when s/he
subscribes? Something along the lines of:

- - - - - - - - - - - - - - - - - - - -
Welcome to Cypherpunks.

Your unique token is: 0A553FC1771623109504522E31C07F44

This token must appear either as the first line of the message body or in an
X-Token: header for any mail you send to the list. Any messages sent to the
list
address without this information will be discarded.

Your token is initially good for <n> postings per day.
- - - - - - - - - - - - - - - - - - - -

Generate a token thus:

Let X be some known information like the From: line of a subscriber's message.
Let T be some unique information for each subscriber, like the exact time that
Majordomo processed the subscribe request.
Let F be the contents of some (non-changing) file on the machine running
         Majordomo (a "secrets" file).

Use a hash function H(X+T+F) to generate your token. Store the token, the
unique information (time, in my example) and the number of posts allowed per
day in a file you can use to validate user requests.

Every time a user sends mail to the list address, Majordomo checks for a token.
If there's a valid one, it strips it out and distributes the message. Otherwise
it throws it away. This way no one else sees which token was used to post a
message.

Alice posts all the time using her real name. She just sticks her token in the
first line of her post. Majordomo sees it, validates it, and strips it out
before passing the message along. It decrements Alice's remaining message count
for the day.

Bob wants to post something anonymously. His token isn't associated with his
user ID -- the only thing Majordomo knows about it is that it's in the token
file and it's flagged as active. He sends the message through the remailer
network with his token in it, and Majordomo validates it, strips it out, and
passes the message to the subscribers, decrementing the number of messages Bob
has remaining for that day.

Charlie wants to unsubscribe from the list. He sends an unsubscribe message to
majordomo with his token in it. Majordomo uses the known information (his
"From:" line in my example), plus the time it kept from when his token was
generated and the secrets file to validate his request. If it matches up, he's
unsubscribed and his token's invalidated; if not, he's warned that someone else
tried to unsubscribe him. (In order to allow people whose tokens have been
invalidated to unsubscribe, don't make sure the token is valid -- just that it
matches up with the user.)

Mallory wants to spam the list. He subscribes and gets a token, which he
uses to
forward commercial announcements to the list. The list manager checks the logs
to see which token was used, and reduces its posting limit or invalidates it.
Mallory is no longer allowed to post, unless his token is reinstated (or he
unsubscribes and resubscribes).

Majordomo also has to keep track of how many posts have been associated with a
token in any give day, but that seems like a small problem. Users could appeal
to the list admin if they wanted a higher limit than the default. Keeping the
number fairly low also discourages protracted flamewars somewhat.

This isn't an extremely "hard" mechanism (I know it's still vulnerable to
eavesdropping attacks), but it'd preserve the ability to post anonymously and
make it tougher for spammers to decrease the S/N. Abusers would have to
unsubscribe and resubscribe repeatedly to get new tokens, which would make
them easier for the list admin to track down.

Thoughts?