Re: [Asrg] Forwarding again, was Adding a spam button to MUAs

Seth <> Thu, 10 December 2009 06:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0CFA73A6967 for <>; Wed, 9 Dec 2009 22:33:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.922
X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[AWL=0.521, BAYES_00=-2.599, SUBJECT_FUZZY_TION=0.156]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 0urV8d3xpyAT for <>; Wed, 9 Dec 2009 22:33:55 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 3429C3A6859 for <>; Wed, 9 Dec 2009 22:33:55 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 10DBE38E4D for <>; Thu, 10 Dec 2009 01:33:44 -0500 (EST)
Received: by (Postfix, from userid 756) id 0416424218; Thu, 10 Dec 2009 01:33:43 -0500 (EST)
From: Seth <>
In-reply-to: <> (message from John Levine on 10 Dec 2009 06:21:04 -0000)
References: <>
Message-Id: <>
Date: Thu, 10 Dec 2009 01:33:43 -0500 (EST)
Subject: Re: [Asrg] Forwarding again, was Adding a spam button to MUAs
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <>
List-Id: Anti-Spam Research Group - IRTF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 10 Dec 2009 06:33:56 -0000

John Levine <> wrote:

> This feels too abusable.  We know that spammers sign up for sham
> accounts at freemail services and send themselves lots of spam to
> game systems that use a complaint percentage.  They could easily set
> up a lot of fake forwards, which feel like they'd be useful for some
> kind of statistics gaming.

But the forward would only be validated for those users who validated
it, so the spammers gain only the ability to spam their own accounts.

> Also, in the real world, there are legitimate forwards to people who
> have only the dimmest concept that mail is being forwarded to them.
> For example, my church has a temporary Sunday school director with
> an AOL account.  His email skills are rudimentary, so rather than
> trying to set him up in the IMAP or web mail that everyone else
> uses, I forwarded the director's role account, which is in a lot of
> address books and mailing lists, to his AOL account.  Getting him to
> do a magic message thing would be non-trivial.

Does he know the address of the role account?  That's all he'd need.

(Also, the system need not work for everybody; 10% information is a
lot higher than providers get now.)