Re: [Asrg] Statistical Analysis shows SPF should work Pretty Well

To use an analogy, this approach still strikes me as trying to cut
traffic down 25% on a four lane highway by blocking one lane with
orange cones.

The traffic will just flow around it.

And "studies" showing that 25% of the traffic does in fact use the
lane to be blocked aren't really persuasive, which is how these
studies claiming that spammers frequently forge big domains into their
heads strike me.

It's not like spammers can't change their behavior, they often do, and
this one isn't even hard to change.

I think it's all somewhat similar to what John Gilmore is usually
credited with saying; that censorship on the internet is viewed as
damage and routed around. This isn't censorship (anyone who jumps on
that gets my idiot award), but it's very similarly flawed, it's too
easy to just route around this to get excited about it.

On the other hand these schemes are possibly useful outside of the
spam context as a weak form of authentication (hence, I think, outside
of the scope of this research group.)

For example, did this letter from my bank actually come from my bank?

If it's just a notice that there's a special on car loans this month
it's comforting to know it's probably really from my bank and clicking
the link probably won't take me to a throbbing H0T L0LlTAZ!!! site.

However, if it demands I respond with my account and PIN numbers I
think it would be better to be suspicious even if it did appear to
have come from my bank by this method of verification. So, a weak
authentication scheme.

But I think its potential effect on spam is minimal.

-- 
        -Barry Shein

Software Tool & Die    | bzs@TheWorld.com           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg