spam-resistant email

[stumpy]

Okay, here is an idea that occurred to me like ten years ago and I am still a little surprised that that it isn't out there in some form.

The basic notion is that you have a slightly different version of an email account. It's tied to a very basic secure e-commerce server and to a list of addresses that you maintain.

When someone sends you an email, if they are on your list (which is private and changable only by you), you get the email. If they are not on the list, they get a bounce that says they aren't on your list and you won't even see their message. They can send a message that gets to your mailbox and ask to be added by sending you five cents. At your option, the charge will be cancelled.

So, if someone you know and want to get mail from sends you an email, they are either already on your list or they send you the nickel along with a "Hey, remember me?" email and you cancel their charge and add them to your list. Essentially, you add them to your list free of charge.

If someone you don't know wants to email you, they are risking five cents and basically hoping that whatever they have to say is worth a nickel to you so you will cancel the charge. If what they have to say sounds like spam, they lose their money and that's the end of them.

The idea is that spammers who send out a million emails would never bother if it was going to cost them any non-negligable amount per email.

Obviously, there would have to be some system whereby the charge/cancel for petitioners is a simple button click for you and whereby the sender is assured that, though he might be charged, you aren't getting is credit card info or anything (he would actually have to send you another email to get charged again). And, for people already on your list, the system would be transparent, just like normal email. Obviously, you could add email addresses to your lists before they ever tried to email you, so new people you were expecting wouldn't have to go through the extra step. E.g., if someone here on FR PM's you for an email addy and you send it to him, you would add his address to your list at the same time. Same thing for online shopping sites that tell you they will send you a "confirm" email or receipt - they just have to mention what address it will be from.

Now, for sure, today's spam filters are pretty decent and that removes much of the incentive for any other system. But, I get several hundred spams a day and I still at least try to glance over the list to make sure it doesn't have any false rejections.  (Usually, I clear my spam box before signing up for any new service or site so that I can more easily spot their confirm email or whatever and add them to my okay list.) And it bugs me that spammers are even sending me crap at all. It should cost them something for me to even glance at it. If enough people were using a system like the one I describe, many spammers wouldn't even bother.

Anyway, I wonder if this sort of system exists? Is it too expensive to handle the transactions? I almost think it would pay for itself (in other words, the nickel would go to whoever deals with the transactions), but I would probably be willing to pay a small fee to have this sort of mailbox.

[Alaric]

How would such a system handle mailing lists? I'm currently on two mailing lists. One sends all its mail from the moderator's address, which would work just fine with your idea, but the other sends all its mail from the individual sender's address, which could be a problem. Of course, the messages do have to go through the list's address, but it still seems as if this could be problematic.

[stumpy]

I was thinking that your "accept" list could be much like ones we have today, where you can specify either a plain old email address, a domain (like everyone emailing from your company's or school's domain, for instance), or a match with any other field in the header. So, if there were a case like you describe, most list servers have email header fields like List-Owner: and X-List-Host: that you could add so that you get mail sent to that list.

(I would also assume acceptable mail would have to have a HELO line to, just to stop rookie forgers. But that sort of technical detail would be an option transparent to most users.)

[BlueBard]

There's nothing new about whitelisting... that is, limiting inbound email to those senders you've specifically added to your whitelist.  And it wouldn't be that hard to maintain.  All of the restricted mail schemes rely on whitelisting to one extent or another.

I've also heard of paymail before, which charges the sender to send the email.  I don't know of anyone who's actually doing it, but I'm sure someone is.

Another scheme that has promise is a bounce-back message that contains a keyword contained in a graphical image that is not machine-readable.  You have to reply with the keyword in order to get yourself added to the whitelist.  Anything that requires human-intervention on the sender's part will tend to work... it's not economical or feasible for a spammer to manually respond to email messages.

In and of itself, the bounce-back requirement alone means that many spammers won't or can't respond.  Most of the time they're spoofing a sender address anyway and will never see the bounce-back.

By the same token, the bounce-back is going to interfere with all sorts of legitimate mailing lists which would have to change the way they operate in order to deal with bounce-back whitelisting.  And online service providers such as online merchants, banks, etc. would have to publish their sending addresses in a way that they don't currently do.

Really, the only thing that's going to put spammers out of business is when people learn to never, ever, ever respond to any unsolicited message in any way and keep their personal firewalls and antivirus programs up-to-date.  When spamming is no longer economically feasible and doesn't reward the spammer in any way, then they'll stop doing it and move on to the next scam.  Probably some form of identity theft.

[stumpy]

There's nothing new about whitelisting... that is, limiting inbound email to those senders you've specifically added to your whitelist.  And it wouldn't be that hard to maintain.  All of the restricted mail schemes rely on whitelisting to one extent or another.

I've also heard of paymail before, which charges the sender to send the email.  I don't know of anyone who's actually doing it, but I'm sure someone is.

Cool. I didn't know the name for it. The idea I was proposing is that legitimate emailers would never end up paying anything and that most (that were on the list) would never even have to deal with the initial bounce.

The advantage over the whitelists I have seen is that legitimate emailers who aren't yet on the list have a way to get you to check if you want to add them.

Another scheme that has promise is a bounce-back message that contains a keyword contained in a graphical image that is not machine-readable.  You have to reply with the keyword in order to get yourself added to the whitelist.  Anything that requires human-intervention on the sender's part will tend to work... it's not economical or feasible for a spammer to manually respond to email messages.

In and of itself, the bounce-back requirement alone means that many spammers won't or can't respond.  Most of the time they're spoofing a sender address anyway and will never see the bounce-back.

That's a great idea. There isn't any necessity that money be involved - just that there's a disencentive to send out tons of spam and that you can safely ignore your spambox without worrying that someone who really wants to get ahold of you is getting ignored.

Of course, advances are being made in computer reading of the images (being able to do OCR on characters that are in different fonts, are distorted or angled, or are on multicolored or "noisy" backgrounds), so it will be a battle to keep ahead of them.

By the same token, the bounce-back is going to interfere with all sorts of legitimate mailing lists which would have to change the way they operate in order to deal with bounce-back whitelisting.  And online service providers such as online merchants, banks, etc. would have to publish their sending addresses in a way that they don't currently do.

Yeah, that's why there has to be flexibility in the whitelist.

Really, the only thing that's going to put spammers out of business is when people learn to never, ever, ever respond to any unsolicited message in any way and keep their personal firewalls and antivirus programs up-to-date.  When spamming is no longer economically feasible and doesn't reward the spammer in any way, then they'll stop doing it and move on to the next scam.

I agree. That's why I don't even have remote images/content turned on in my emails, except for confirmed senders. That way, the spammer never even knows if I saw or opened the email. (And, obviously, cookies are off by default.)

[catwhowalksbyhimself]

Actually it's been proposed before, and the rights and freedom people got all over that and were saying nasty things about money-grubbing companies, even though that had nothing to do with it, in this case.

[Uncle Yuan]

Odd, I had heard it was the business lobbies that were working against it.  Knowing what I do about this issue, it's probably both.  There's also been talk about instituting a nominal charge for emails - one cent or so.  Something that would not be onerous to the individual or to legitimate businesses, but would be enough to deter spammers.

On a personal note, I maintain two separate email addesses and use it as my own white list.  Friends and family have access to my personal account (through my ISP), any on-line business, contest or aquaintance gets my yahoo address.  I *never* get email at my personal address.  This might work less well though if one only uses a freemail account - I can imiage that anyone with Hotmail or Yahoo gets spam simply via random name generation.

[catwhowalksbyhimself]

Odd, I had heard it was the business lobbies that were working against it.  Knowing what I do about this issue, it's probably both.  There's also been talk about instituting a nominal charge for emails - one cent or so.  Something that would not be onerous to the individual or to legitimate businesses, but would be enough to deter spammers.

Yes, it probably was both.

[Panther_Gunn]

Stump, I absolutely *love* :wub: your idea.  If someone could actually make it feasible, I'd be all over it like white on rice!  The best marketing they could do for it would be to have a portion of the kept "charges" (like maybe 2-3 cents, each) goes to the account holder.  Of course, then there'd be plenty of people that would just create tons of accounts with them, just to get the free cash the spammers are throwing away.  ;)

I can imiage that anyone with Hotmail or Yahoo gets spam simply via random name generation.

I have two email accounts that I use -- one for (mostly) personal correspondence, and the other that I use for any website that needs my address.  Both are Hotmail accounts.  Whether by dint of who/where I give out the addy's, or due to the differences in the account names (private is a unique name, first & last, while the other appears to be just a couple of random letters & numbers), I get something like 1-2 spams in my private account every *month*, as opposed to the 10 or so a day I get on the other account (at one point, a few years ago, it was more like 30-90 a day....which was bad, due to Hotmail not having increased it's free account space yet).  The filters on both accounts are set to Exclusive, so any address that I haven't already ok'd gets sent to Junk first.  I don't know if Hotmail has other filters before things get to me, decreasing the amount of spam that I see to begin with or not.

[stumpy]

I have a few email accounts. Oddly enough, the one that gets the most spam is one of the ones that I don't use for anything but personal correspondence.  :(  My free hotmail accounts get relatively little spam, even the one I use for signing up for random sites that need to send a confirmation email but that I don't trust not to share my addy or or whose privacy policy is shot full of holes. I actually suspect that part of the reason my personal account gets such a flurry of spam is that some of my less savvy friends click on the "send this to a friend" buttons at various sites where they see something they think I would be interested in, instead of just sending me a normal email and pasting the site's URL into it.  <_<

As to the people against the idea of a whitelist with a low-cost petition option, I don't see why anyone would be opposed to it unless they were either spammers or didn't understand the concept. The whole goal is that people you know you want to get email from can send it for free and everyone else risks a small charge. That charge is small enough that a legitimate correspondent either won't care or will risk it. (For example, I have sent email to people who've written articles I found interesting. If it had cost me a nickel, I wouldn't really care.) But, someone whose goal is to send an email to a million people in hopes that 0.5% respond (which is roughly what spammers are up to) would never pay $50,000 to do that.

[catwhowalksbyhimself]

I don't see why anyone would be opposed to it unless they were either spammers or didn't understand the concept.

Because the internet, and the way certain things are done on the internet, is increasingly becoming a politically charged issue.

[Panther_Gunn]

As to the people against the idea of a whitelist with a low-cost petition option, I don't see why anyone would be opposed to it unless they were either spammers or didn't understand the concept.

The first logistical hurdle you'd have to face would be where to assess this charge.  The typical places (PayPal, credit card account, bank checking/savings account) all have their problems.  The paranoid portion of the populace (and they *do* exist....they just won't tell you! :lol:) will almost never submit to anything that requires them to link their money & credit history to something they can't prove is legit.  The younger slice of the population generally won't have access to these kinds of resources, along with those that have enough of a limited income that it makes no sense for them to even get a bank account.  I can almost hear the ACLU shooting this down because it "excludes the less affluent portion of the population, and is therefore unConstitutional".  <_< 

Charitable organizations (such as churches, et. al.) that send out messages to large amounts of their "customers" may not be able to withstand that kind of one-time hit from all the addressees.  Larger organizations that can handle the cashflow flux of this model would still require a rather large paradigm shift......and I'd be willing to bet that this last point is enough to keep it from ever coming about, or at least succeeding if someone even gets it off the ground.

As much as I endorse the concept, I wouldn't be willing to hold my breath over it ever coming to fruition.

[stumpy]

I think I see what you guys are talking about, but I want to make a couple things clear about the idea while, hopefully skirting the political aspects:

1. There is nothing mandatory about such a system. I.e., there is no governing body that says "This is how email must now be done." Therefore, there is no legal issue about anyone's freedoms being restricted. No one is restricted from doing anything that they can do now. At its base, this is just a slightly different filtering system.

2. a) No one ever has to pay a cent to send an email. b) No one is ever charged who doesn't explicitely choose to be charged. c) Once someone is added to a list, they are never charged again to send that person an email. d) The receiver can choose to cancel the charge if they recognize the sender or want to cancel the charge for any other reason.

I belong to a couple of not-for-profit groups and they would still be able to send me email at no charge because I would add them to my list. If I didn't add them to my list, then I won't necessarily see their emails, but it won't cost them anything and the next time I am at a meeting, they will probably mention that "some people have forgotten to add us to their accept lists and they aren't getting the emails."

I agree that people who aren't able to deal with e-commerce may have trouble with this. They will either have to adapt, get the people to whom they want to send email to add them to their lists, or deal with not being able to get an email through to people who won't add them.

And I agree that some people might not like it for other reasons. But, it really isn't a problem for poor people. Anyone can afford a one-time fve cent cost (and it might be not even cost that much if the receiver chooses not to charge). Unless, of course, they are trying to send thousands of emails to people they don't know, in which case they are spammers and I don't have much sympathy, whether they are rich or poor.

[catwhowalksbyhimself]

I think I see what you guys are talking about, but I want to make a couple things clear about the idea while, hopefully skirting the political aspects:

Too late, this is inherently a political issue to begin with, although no one here seems to take it as such, but trust me, it is.  The specific points you are making are themselves VERY politically charges, or are become that, anyway.  Most people just aren't as aware of internet political issues.

Anyway, here's some things to think about.

Let's say once company does this.  They charge 5 cents to incoming emails unless the user waves the charges.

1.  This WILL be legally challenged--because the person sending the email hasn't approved this charge.  They may not have even been aware that this could happen when they sent the email.

2.  There's no way for the email company to even get the information to make the charge anyway unless they get personal information from the sender's email company, and even then, there's no way to enforce it.

3.  Somebody will figure out how to exploit this. Hackers will wrack up charges by turning personal computers to be spambots (it already happens)  Other exploits will be possible.

The only way to resolve issues 1 and 2 would be for ALL email to be done this way.  Contrary to what you may think, the US military and some other companies they've approved do indeed have control over the internet.  They just choose to use it subtilely. If SOMEONE wasn't in control, there'd be no way to decide who gets what url, for example.  In fact, a couple of years ago, the EU was trying to force the US to give up its control the internet, which they refused, of course.

Anyway, there would be plenty of problems with this solution too.

[stumpy]

Let's say once company does this.  They charge 5 cents to incoming emails unless the user waves the charges.

1.  This WILL be legally challenged--because the person sending the email hasn't approved this charge.  They may not have even been aware that this could happen when they sent the email.

No! This is what I was trying to clear up. No one is charged without approving the charge. Period.

When someone sends an email to you and they aren't on your accept list, the email gets bounced with a message saying they aren't on your list and you will only accept unsolicited email if the sender agrees to pay a nickel, which you may refund at your discretion. They are directed to a commerce site (a very simple page like paypal uses) if they choose to go ahead. They have to approve the transaction just as they would any other online transaction. They always have the option of dropping the whole thing.

There may be other issues but all of the other points you mention are resolved once you understand the above.

[catwhowalksbyhimself]

That solves that issue and reintroduces another.

Many people would absolutely refuse to email anyone using that service.  I certainly would.

[stumpy]

Why? Do you not use PayPal or do any business online? It would be no different.

And, as I have said several times now, no commerce is involved at all for people who are alrerady on your list. The only people who would deal with the five cents worth of e-commerce are those emailing you for the first time (after which you can put them on your list) or people who insist on emailing you even though you refuse to add them to your list. On top of all that, if someone you know emails you and has to spend a nickel the first time, you can still cancel the charge and it costs him nothing.

Effectively, the only people who ever have to pay are those you don't want emailing you.

[catwhowalksbyhimself]

Yes, if I were on there list, it wouldn't matter, but

a.  I like to avoid signing up for things and giving away personal information.

b.  I'm the type of guy who almost never leave answering machine messages.  If I can't get through right away, I'm not going to waste my time.  In this, case, I'm not going to waste several minutes to ask permission to email someone.  I'd probably call him instead and avoid emailing him ever again if it could be avoided.  Even if I wouldn't get charged, it would be the principle of the thing.

[stumpy]

You are correct. It wouldn't be a good system for you. For people like myself (and I have no idea if this is typical or not), I only email a new person a few times a month, so spending a couple minutes filling out a little form is not too much of a hassle for me. And, most of those times, the new addressee is someone I know from some other venue, either online or from RL. For example, if I have need to mail someone from FR, I usually could get in contact via PM and, if we lived in the anti-spamverse that I am describing, I would ask him to add my email address to his list before I emailed him. If I meet someone at a party and decide to communicate via email, we just enter our emails into our cell phones, so I could add that person to my list (and vice-versa) without any need for commerce.

Just as an aside, if the payment system were like PayPal (which is my model for this), the recipient doesn't get any of your personal or financial information. He just gets your email address, your email message, and your nickel. I would never participate in a system where everyone that I emailed got all of my personal info or my credit card number.

[catwhowalksbyhimself]

I'm not concerned about the recipient at all.  I'm concerned about the company.  The less people out their with my sensitive data the better.

[stumpy]

I am concerned about companies having my data, too. But, since some of the people that I email are total strangers (E.g. "I read your paper on Petri Net DES Fault Diagnosis in January's _IEEE T-ASE_. Would it be possible to get the extended research paper with the full data set? ..."), I don't want them having my credit card info, either.

Either one is a legitimate concern and I agree that finding a company that could be trusted as an honest broker would be an important implementation detail.

Honestly, the method BlueBard mentioned (making non-list emailers decode obscured text from an image) is a very good way to go. It gets us past all the complications of an e-commerce system and it's easy to set up while still requiring effort on the part of the unknown sender. That would ruin a spam scheme. The only problem is the one I mentioned earlier: the technology for OCR is pretty good and always advancing. If such a filtering system became commonplace, it wouldn't be long before spammers had software to do the decoding automatically and then there is an "arms race" of sorts in trying to keep ahead of that software. Of course, at least then the spammers would need a real email address, so it would still stop most of them.  ^_^

[catwhowalksbyhimself]

Or you simple have a quiz with laughably easy questions and change them constantly.  Bots aren't really intelligent and couldn't deal with that.

[stumpy]

Or, at least a side-benefit would be spurred development of Turing-bots.  :P

Seriously, that's a good idea, but not as easy as it seems to implement. The problem with quizzes like that (general knowledge, reading comprehesion, etc.) is that they tend to be multiple choice or fill-in-the-blank quizzes so that they have practical grading rubriks. And, surprisingly, it is possible to write programs that do amazingly well at answering them! These are serious pieces of software, of course, but they exist. This is part of why search engines like Google do such a good job of coming up with useful query results.

I'm not saying quizzes couldn't be designed to differentiate bots from people, but it would be something of an effort to write them automatically, which is what would be needed. That's why the "enter the letters" puzzles are still popular. They leverage something that humans are very good at (distinguishing visual symbols in noisy fields) that still trip up computers. But the computers are very good at creating the sequence of random characters, rendering them in different fonts, rotating and distorting them, then adding noise to the overall image. So, software can easily make puzzles that it can't easily solve. That may not last too much longer, but it works well for now.

But, as I mentioned, either approach has the advantage of forcing the spammer to actually have a return address to which the puzzle can be sent. That by itself would scare off most spammers. Most of them like to claim that the company to whom you actually send your money for the fake boob cream or stock market "insider picks" isn't related to whoever sent out millions of spam emails that fortuitously directed you to their site.  <_<