Re: [Rucus] [spitstop] Botnets, take 2... Re: Draft RUCUS charter

On 2008/02/22 13:02, Saverio Niccolini <Saverio.Niccolini@nw.neclab.eu> wrote:
> 
> > Let's take an example:
> > When Henning's host is compromised and a bot is using 
> > Henning's account to send me spam then I would contact 
> > Henning (by using various ways) to tell him that something is 
> > wrong with his PC/phone/etc. I would not tell my VoIP 
> > provider that there is something wrong with Henning's account. 
> > Typically, this will lead to more problems rather than less 
> > -- such as no communication to Columbia University anymore 
> > because my VoIP provider just blocks all calls from that domain.
> > 
> > (Just to reflect my experience with email problems in the company....)
> 
> You do not contact Henning directly to tell him that something
> is wrong. You have to rely on your infrastructure to take the
> necessary countermeasures otherwise it is the anarchy...

No, not when strong identity is used. Just translate the scenario
to email: when I receive a PGP-signed mail (using a trusted key)
from a friend which contains a typical spam (V!ag_ra, 419, ...) then
I'll phone him up to tell him that he has a security problem.

> That is why exchanging reputation of identities (as perceived by
> end-users or domains) is an important building block.

Yes, it can be helpful to simplify the initial contact problem. 

Positive reputation is useful, negative one will just lead to
the spitter getting a new account.

> Such reputation system (one of the points of RFC 5039) can be built
> using mechanisms like feedbacks:
> http://tools.ietf.org/html/draft-niccolini-sipping-spam-feedback-00
> and spam scores:
> http://tools.ietf.org/html/draft-wing-sipping-spam-score-01
> of course there are privacy issues that apply (but this is 
> a problem of reputation systems as well) :-)

Another trouble here is that if you want worldwide calling based on
a reputation system, you also need a reputation system which is used
worldwide and not a plethora of these. 

Who will be trusted to run it?

/ol
-- 
-=-  Otmar Lendl  --  ol@bofh.priv.at  -=-
_______________________________________________
Rucus mailing list
Rucus@ietf.org
http://www.ietf.org/mailman/listinfo/rucus