'do-not-spam' List

[boxturt]

Feds Decline to Create 'Do-Not-Spam' List

By TED BRIDIS, AP Technology Writer

 

WASHINGTON - The Bush administration said Tuesday it will not create a national

do-not-spam registry to discourage unwanted e-mail, fearing it could backfire

and become a target list for new victims.

 

The Federal Trade Commission told Congress that senders of unwanted sales pitches

might mine such a registry for names. Its chairman, Timothy Muris, quipped that

consumers "will be spammed if we do a registry and spammed if we do not."

 

The commission was obligated by lawmakers to consider the proposal under the "can spam"

legislation that Bush signed in December, an idea patterned after the FTC's enormously

successful do-not-call registry to limit telemarketing calls.

 

But the FTC concluded that on the Internet, unlike within the highly regulated U.S.

telephone network, regulators would be "largely powerless to identify those responsible

for misusing the registry."

 

Muris said that, given the risks of consumers adding their names to a do-not-spam registry,

"I wouldn't put my e-mail address on such a list."

 

Sen. Charles Schumer, D-N.Y., the leading supporter in Congress for a no-spam registry,

said the FTC's decision was disappointing.

 

"The registry is not the perfect solution, but it is the best solution we have," Schumer said.

 

Regulators instead proposed broad adoption of new authentication technology that

will make it more difficult to disguise the origin of unwanted e-mails. Several

proposals from leading technology companies, including Microsoft Corp., are under

consideration by industry.

 

"A national do-not-e-mail registry, without a system in place to authenticate

the origin of e-mail messages, would fail to reduce the burden of spam and may

even increase the amount of spam received by consumers," the commission said.

 

If new authentication plans fail to emerge, the FTC will convene a federal

advisory committee to determine whether the government could require

Internet providers to adopt one.

 

"Without effective authentication of e-mail, any registry is doomed to fail,"

the commission said.

 

The government said it was particularly worried about issues of security

and privacy with respect to children whose addresses might be added to such a registry.

 

"A registry that identified accounts used by children, for example, could

assist legitimate marketers to avoid sending inappropriate messages to

children," the commission said. "At the same time, however, the Internet's

most dangerous users, including pedophiles, also could use this

information to target children."

[samporras]

Hey guys...would this be possible?

 

Marketing emails (the legal ones from actual marketing companies) are usually deployed from one main source....which would be a certain IP address. What if the government were to require these companies to register their IP address. Then, any mass email or spam mail without a registered IP address can be traced and prosecuted on that basis.

 

Does that affect any privacy issues? It wouldn't really affect consumers or companies that are doing it legally. It would just create a way to target illegal spammers they could trace their IP addresses....There's got to be some way to combat spammers. We just have to outwit them!

[TCH-Bruce]

Well, even if they did create this list I would not put any of my email addresses on it. I agree that something needs to be done to curb Spam but this isn't it.

[samporras]

Nevermind...my idea would never work....I didn't take into consideration that not everyone has a static IP address.

 

oops.

 

But there has to be SOMETHING we can do!

[DarqFlare]

I'm certainly not putting my email address in a central location with many others...

[annie]

But I might put my domain name on such a list. Saying any mail to that domain name was outlawed.

[Glath]

I can see their point in not making a spam list. Spammers are always looking for active email accounts (they record when users open their spammed emails).

[MikeJ]

Marketing emails (the legal ones from actual marketing companies) are usually deployed from one main source....which would be a certain IP address.  What if the government were to require these companies to register their IP address.  Then, any mass email or spam mail without a registered IP address can be traced and prosecuted on that basis.

There are proposals out there similar to this, but not so much for tracing, but for allowing. That is, policies focused on some way of authenticating that an email server is valid for certain domains. Basically, they would help figure out what to allow, not help trace what shouldn't be allowed.

 

Somewhat along those lines, one such solution that already exists is Sender Policy Framework (SPF) ( http://spf.pobox.com/ ). Basically, the way it works is you define what servers are valid for your domain. So if you have an SPF record defined, and someone attempts to spoof your address from a non-valid server (such as what viruses do), a mail server that checks SPF will deny the email. It's beginning to gain popularity as more major providers incorporate it into their mail systems. AOL, for example, will require companies on their whitelist to have SPF configured by the end of the summer or they will be booted off their whitelist (which means it'd be harder to send email to AOL customers).

 

Nevermind...my idea would never work....I didn't take into consideration that not everyone has a static IP address.

 

Users may not have static IP addresses, but the mailservers they send email through should be on static IP's. Many major providers will already block any email from dynamic ip blocks.

[samporras]

Thanks Mike. Very Informative!

 

Here's another question....is anyone credited for "inventing" spam. I'm sure they're not the most popular person in the world, but to whom do we owe the thanks to (or the death threats! )??

 

My sister (not very technically versed) tried to tell me that her friend's brother invented spam. I tried to tell her that spam is not a "thing" it's just a label that people put on unwanted unsolicited email. Am I wrong or is she?

[TCH-Rob]

Go here http://www.templetons.com/brad/spamterm.html for a history of SPAM.

[Hockeypuck]

The problem with this is that most spam e-mail probably doesn't come from servers within the United States. How could we enforce it?

 

All putting our e-mail addresses on a big list is going to do is open the door for some hacker to steal 3/4 of the e-mail addresses in the US and send spam to it from some country that ends in "stan".

[TCH-Thomas]

The problem with this is that most spam e-mail probably doesn't come from servers within the United States. How could we enforce it?

In sweden (and in most european community i think) the word is that most spam comes from the U.S. Wonder which is the truth?

[Hockeypuck]

The problem with this is that most spam e-mail probably doesn't come from servers within the United States. How could we enforce it?

In sweden (and in most european community i think) the word is that most spam comes from the U.S. Wonder which is the truth?

http://blogs.officezealot.com/marc/archives/000400.html

 

Well, according to this, I was wrong. Interesting. I'd think the US would have more strict spam laws than this.

 

--Edit--

 

Even better: http://www.sophos.com/spaminfo/articles/dirtydozen.html

[Hockeypuck]

Ahh, but I have to read the whole article to get the whole story...

 

Sophos research has revealed that although a large amount of spam is being sent from USA computers, much is being sent without the computer owner's knowledge.

 

"Our intelligence suggests that a large amount of spam originates in Russia, even though it appears at only number 28 in the chart. Hackers appear to be breaking into computers in other countries and sending out spam via 'infected' PCs," continued Cluley. "Some Trojan horses and worms allow spammers to take over third-party computers belonging to innocent parties, and use them for sending spam. More than 30 percent of the world's spam is sent from these compromised computers, underlining the need for a co-ordinated approach to spam and viruses."

[Kolibri]

There are a number of solutions to battling spam:

 

- Redesign the entire email system.

- Make senders of spam solve a slightly cpu consuming problem for the receivers to accept them.

 

Personally I'm in favor of the first option.

The whole email protocol is laughable.