Why We Havent Stopped Spam - ' Sender Bond Theory vs' (
Page 3 of 3 )
. Practice">
The sender bond is an old idea. It may have some beautiful economic theory behind it (look at all those integrals!) but there are a number of major technical problems with it from the standpoint of practical Internet engineering.
Heres one technical problem that Joseph Heller would have appreciated: You cant enforce the bond through the e-mail system unless you have an authentication process. How is the system supposed to know who to pay? In fact, youd need an authentication system far stronger than DKIM, which only authenticates the domain of the sender, not the user.
Turn on your imagination and envision sender bonds being implemented in the real world. How soon would it be before gangs all over the world enlisted botnets into harvesting bond proceeds by massively signing up for bonded e-mail, using fake bonds and other social engineering attacks? The system would need to be resistant to all of these attacks, or otherwise its just trading off one fraud system for another, and the new one would give direct remuneration to the attackers.
Then theres the absence of a practical micropayments system. The only payments system in the world that has a chance of handling the volume the authors propose is the credit card system. The capacity of that network is possible because of transaction fees that would make micropayments impractical. Even so, we all know its not as secure as it could be, and in an effort to make it more secure, new costs are being imposed on merchants.
Getting back to the DKIM end of this, its also mandatory in any article that touches on the subject of SMTP authentication to point out, as Koomey, Van Alstyne and Brynjolfsson did not, that any such scheme, including DKIM, is inadequate all by itself. Just because you know who the person is doesnt mean you want their e-mail. They could be a pornographer or some other such undesirable type.
Popular Web sites are being used in a new attack thats targeting eBay accounts. Click here to read more.
You need to combine authentication with reputation and accreditation services in order to get value out of them. Its not clear if this is a major problem for Koomey, Van Alstyne and Brynjolfssons plan: Is a bond required only if the reputation is above a certain level? These considerations could get complicated and political, the worst possible situation.
The authors blame the slow uptake of DKIM on a standard "chicken and egg" problem, but its not really that. Its just that change is unpleasant and, unless the payoff is obvious, risky. DKIM may yet become ubiquitous now that a formal standard has been issued, but I think everyones expectations are a little lower than back when Bill and I could see the end of the spam problem.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
