Comments on: Challenge/Response Email Verification http://ben.dechrau.com/2007/04/27/challengeresponse-email-verification Programmer, Property Tycoon, Media Mogul Mon, 30 Aug 2010 16:18:52 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Ben Balbo http://ben.dechrau.com/2007/04/27/challengeresponse-email-verification/comment-page-1#comment-3957 Ben Balbo Sun, 29 Apr 2007 23:23:23 +0000 http://benbalbo.com/2007/04/27/challengeresponse-email-verification/#comment-3957 Regarding the open relay, I'm sure it won't be long until the open relay is added to the black-list, so I'm not too worried about that scenario. The fight against spam is an ever evolving one, and I'm sure grey-listing will be rendered useless at some point, as the spammers keep circumventing current mechanisms. I'm not sure what the next step is after grey-listing is. I hope it's not CREV, which also has its loopholes. <a href="http://en.wikipedia.org/wiki/Sender_Policy_Framework" rel="nofollow">SPF</a> is another option, but requires adoption in all domain records to be truly effective. There is a firm plan for my hosting company to support SPF in all domains it hosts, but if your timeline is accurate, this might be happening sooner than expected :-) Regarding the open relay, I’m sure it won’t be long until the open relay is added to the black-list, so I’m not too worried about that scenario.

The fight against spam is an ever evolving one, and I’m sure grey-listing will be rendered useless at some point, as the spammers keep circumventing current mechanisms. I’m not sure what the next step is after grey-listing is. I hope it’s not CREV, which also has its loopholes.

SPF is another option, but requires adoption in all domain records to be truly effective. There is a firm plan for my hosting company to support SPF in all domains it hosts, but if your timeline is accurate, this might be happening sooner than expected :-)

]]> By: anonymous http://ben.dechrau.com/2007/04/27/challengeresponse-email-verification/comment-page-1#comment-3856 anonymous Fri, 27 Apr 2007 07:18:11 +0000 http://benbalbo.com/2007/04/27/challengeresponse-email-verification/#comment-3856 Although I agree this is a cleaner solution I still have my reservations about the effectiveness. Matti Aarnio is currently doing the same Post-greying technique within the Linux kernel mailing list and although it works to a degree, it still has its problems. I'll explain one I can think of. Sam sends Bob an email. When he does this he uses an open relay (one of the most common spamming ways). Sam has now just broken the whole Post-greying because the open-relay will respond to the wait packet and resend when required (This is normally what happens anyway when a spammer hits an open relay because the quantity of emails exceeds the systems max throughput. It will however work on a standard drone system (normally desktops that have been compromised and rigged to send mass emails), but only for a little while. Most spam bots now use a trigger method to reiterate through the list after all the email addresses have been posted. It will (Matti says about another 50-100 days, I say about a month) soon be completely redundant. Although I agree this is a cleaner solution I still have my reservations about the effectiveness.

Matti Aarnio is currently doing the same Post-greying technique within the Linux kernel mailing list and although it works to a degree, it still has its problems.

I’ll explain one I can think of. Sam sends Bob an email. When he does this he uses an open relay (one of the most common spamming ways). Sam has now just broken the whole Post-greying because the open-relay will respond to the wait packet and resend when required (This is normally what happens anyway when a spammer hits an open relay because the quantity of emails exceeds the systems max throughput.

It will however work on a standard drone system (normally desktops that have been compromised and rigged to send mass emails), but only for a little while. Most spam bots now use a trigger method to reiterate through the list after all the email addresses have been posted.

It will (Matti says about another 50-100 days, I say about a month) soon be completely redundant.

]]>