CSC 379:Week 1, Group 4

Internal Use Only

Group members: Nick Principe / naprinci@gmail.com / AIM: mahoubaka
Ken Ganong / kjganong@ncsu.edu / AIM: C4P0droid

• block domains or even top-level domains "known" to be large senders of spam
  • Spamhaus Block List
    • see faq also
• require users to request permission to send you e-mail (eg Earthlink spam blocker)
• Charge for e-mail sent
  • see article
  • PDF paper on charging for email
• opt-in for commercial email
• domain authentication
  • what canada has to say about it
  • seemingly useful article with links to domain authentication related concepts
• bounties
  • MSNBC article
  • another article about same event
• the "goodmail" approach
  • goodmail article
  • goodmail web page
• bond with escrow agencies
  • Nice summary on escrow spam fighting
• client-side filtering

huge paper on this subject

Example rating system

Spam Prevention Techniques

Comparison of Techniques

Technique	Pros	Cons	Authors' Rating
Block domains of "known" spammers	Gets rid of a large amount of spam Low chance of blocking legitimate email (sbl-faq) Mechanism to allow legitimate sources to know they were blocked (sbl-faq)	Some spam still gets through, especially from new sources (put in percent from sbl/sbl-faq)
Require users to request permission to send you e-mail (e.g. Earthlink spam blocker)	Robots cannot easily send spam False identity doesn't work	Emergency emails don't send quickly Time consuming to send short notes Impossible to implement correctly
Charge for e-mail sent	Forces targeted selection	Defeats the purpose of email Where does the money go?
Opt-in for commercial email	Companies can send advertisements without sending spam Users can freely restrict the influx of mail from their many online affiliations	Fraudulent emails have an opt-out link that sends you to an unwanted web page. Only stops unwanted spam from companies that abide by this rule.
Domain authentication	Very little spam gets through	Lots of false positives Could be very difficult for mail servers to initiate contact (certificate negotation crap (see SSH/SSL)) Lots of infrastructure and therefore money involved for something as simple as a mail server Hard for independents/individuals to set up their own mail server
Bounties	Gets rid of big spammers with incentive Possible deterrent	Costs government (tax-payers) money
The "Goodmail" approach	Mass emails cost money so mass spammers don't work	Companies can bypass the spam filter by paying money
Bonds with escrow agencies	Whitelisted email accounts don't take out a bond Only spammers have to pay.	Lots of infrastructure and processing behind 'micro-payments' Somebody has to pay for the escrow agency. Users can subvert the system by collecting even when not spam.
Client-side filtering	pro	Only as good as user or algorithms/heuristics at identifying spam Spam emails are stopped, they are simply not read.

Technique Details

Block domains of "known" spammers

• Summary point 1
• Summary point 2
• Link 1

Opt-in for commercial email

Commercial advertisements are often considered spam even when the user has had a previous relationship with the company sending the email. In order for companies to send such advertisements without causing a lot of unwanted email, a simple opt-in or opt-out system should be implemented by the company. If an opt-out link or instructions appear in an email, the result of a user following them is that that user will no longer be sent similar advertisements. This much is required to be CAN-SPAM compliant. The preferred method, however, is an opt-in. In this way, when a company and a user first achieve contact (usually by the user making a user account with the company), there is a method for the user to configure which types of email advertisements he or she desires from the company.

Such a system allows a user to decide and configure which companies and which types of advertisements they would like to receive email about from each company for which they have an online affiliation. However, this requires the company to implement and abide by such a rule. Also, since this system is so common, many fraudulent spam emails have opt-out options which are fake. By responding to such an opt-out option, you actually submitting yourself to more spam because the sender knows that your e-mail account is active.

Bonds with escrow

This spam fighting technique works based on whitelists, blacklists, graylists, and a third party (escrow agency) separate from the email sender or receiver. A whitelisted sender simply sends email and it goes through without the escrow agency intercepting. A blacklisted sender cannot send email to the would-be receiver. The contents of the graylist is essentially everyone on neither of the other lists.

A graylisted sender opens a bond for a small amount of money (one cent) with the escrow agency in order to send email. If the receiver blacklists the sender as a result of the email, the bond is collected and the sender is charged. Thus, only spammers have to pay for their email unlike the charge-for-email approach.

The escrow agency, however, must be paid. One way of doing this is having the collected spammer money go to the escrow agency. There is a lot of processing for any type of internet payment, so the penny (or so) that is charged to the spammer may not be enough to cover the escrow agency's cost regarding. Also, non-profit groups would possibly often be blacklisted and therefore be forced to pay more than they can afford similar to the Goodmail approach. Since the email cost is mean to deter spammers, Users can subvert the system by blacklisting emails that aren't spam. For example, I could charge my professors for sending me email that they must send for class or users could charge ebay for requested notifications.