RE: [Asrg] Consent Proposal

Here's an idea about validating a message before I can ever see it.  This
can be considered a consent-based concept, as it can be a parameter at the
ISP end for each mail user. It adds quite a bit of overhead to the mail
server as it requires two additional messages for each one sent.  I see it
being part of the MTA process.  I send a message to someone.  The MTA
replies to the message with a "proof of sender request, " basically a
specially formatted email message that goes back to the server that sent it
based on the return address.  The sender's MTA responds with a "confirmation
request"  if it did send the message and the message is now available for
download based on moving it from the pending directory to a user directory.
If there is no response within a certain period the message is discarded.
It's a similar concept that I use when I get a telemarketer who I may want
to pursue what they are selling.  I ask for their phone number and call then
back. Granted I don't do this very often as I usually tell them to take me
off their call list and hang up.  If this has been mentioned I apologize as
the volume of messages is quite large on this list.

In terms of Yakovs' consent based system:  I like the idea of an ISP form
that allows me to check boxes to deny HTML or non-signed messages.  And
probably enter a few basic filters like deny any message that mentions
Viagra.  Also you could determine what lists to use to deny or accept
messages.  I prefer not to filter messages on my machine, but I don't see
the typical ISP processing all these rules and filters without a substantial
increase in cost of doing business. So I think having something at both ends
makes sense in the short term.  The long term it should be an issue for the
MTA to manage based on some parameters that the user or ISP set.

I like the idea of a white list that is supported by some industry entity
like the DMA.  But I also like the way I can put my phone number in the
DMA's database and all those marketers who subscribe to their service won't
call me.

The bottom line is that consent should be easy for the general user to deal
with and understand.

Howard Roth

-----Original Message-----
From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Yakov
Shafranovich
Sent: Thursday, June 26, 2003 2:23 PM
To: asrg@ietf.org
Subject: [Asrg] Consent Proposal

I would like to provide a generic proposal for consent-based system as per
charter:

1. Users and/or ISP define rules and filters to filter incoming email.
Rules/filters are decided by end users and ISPs, and are not mandated.
Every user/ISP can define its own policies ranging from banning all email
not digitally signed to blocking HTML.
2. For each email user, the MUA or the ISP maintains a whitelist of trusted
senders, blacklist of blocked senders and a graylist of unknown senders.
Whitelisted senders go the inbox, graylisted senders go to the bulk folder,
and blacklisted senders are either in the spam folder or erased.
3. Whitelists are not only a list of email addresses of trusted senders,
but to avoid sender spoofing also have additional features such as digital
signatures, certificates, passwords, tokens, etc.
4. Additional automatic whitelist rules are defined as such email from
trusted senders (e.g. Habeas) is automatically goes to the inbox unless
blacklisted, etc. C/R systems are also integrated and upon receiving a
positive response automatically whitelist the sender.
5. Additional automatic blacklist rules are defined such as email coming
from known open relays is blocked.
6. Whitelists, graylists and blacklists are stored hashed or encrypted to
protect privacy.

Any thoughts?

Yakov

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg