Advertisement
Advertisement

Digital ID would restrict spammer nuisance

It has become fashionable to sue spammers - Microsoft and AOL are doing it. Soon, we'll begin to see one-man-crusade lawsuits.

The problem is that most spammers have moved offshore - to places, such as Pakistan or Colombia, where foreign governments either do not care or do not have the resources to prosecute spammers.

Filtering can limit spam, but a spammer's cost of sending one million e-mail messages is only marginally higher than sending 100. To counter filtering, spammers send out significantly more spam.

The second problem with filtering is that it will eliminate all the most obvious spam. But spammers have mechanisms for tracking what gets through. Then they tweak their messages to evade filters. Hence the rise of messages bearing believable subject lines such as 'lost your e-mail address, please resend'.

Spammers have increasingly resorted to a graphical e-mail format, which is encoded in hypertext mark-up language. Filters cannot read such messages for the same reason scanners cannot pick out simple messages hidden in fuzzy backgrounds. It is a tricky mathematical problem of pattern recognition.

Anti-spam crusaders see promise in a sort of spam directorate that helps internet service providers easily spot unwanted e-mail. Something like this is already enforced: huge bombardments of messages now trip alarms at the major ISPs. So spammers have started to chop up their attacks into smaller blocks, sent at random intervals and often using randomly sequenced connections with multiple ISPs. And they're getting their pesky solicitations through.

The problem with this approach is that a considerable percentage of spam comes from mail servers of unsuspecting organisations.

The real solution lies in the system's masters - the backbone connectivity providers, the router makers, the big telecoms and the big ISPs - getting together and requiring anyone wishing to send e-mail over their networks to identify themselves.

This is the only approach that will ever strike at the root of the spam problem. Every message entering the e-mail system would need to have a unique digital postage stamp that is difficult to forge. It is not a novel concept: websites have a system like this already with digital certificates designed to give assurances that they are who they say they are.

Cyber-libertarians cry foul whenever someone suggests a way to strip the anonymity out of e-mail. Fair enough. But such fears can be addressed. ISPs could allow e-mail users to encrypt their message but still carry an authentication stamp. Or individuals concerned about maintaining their privacy could use third-party proxy organisations to strip out their identity but still validate a message as legitimate. A company called Anonymizer already does just that for websurfers. Such validating would allow, say, people inside repressive countries to use encryption to communicate privately.

The Internet Engineering Task Force is already looking at ways of designing such a system.

Top Net designers, such as Paul Vixie and Paul Mockapetris, think an e-mail-authentication system could be rolled into the next version of internet backbone software.

Name and address supplied

Post