Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Certified Email Not Here to Reduce Spam 197

Posted by ScuttleMonkey from the you've-got-spam dept.
An anonymous reader writes "Goodmail CEO Richard Gingras surprised Legislators and advocacy groups today when he announced that the CertifiedMail program being implemented by AOL and Yahoo is not meant to reduce spam. Rather than helping to reduce spam Gingras claimed that the point is to allow users to verify who important messages are really from, like a message from your bank or credit card company."
This discussion has been archived. No new comments can be posted.

Certified Email Not Here to Reduce Spam More

Certified Email Not Here to Reduce Spam

Comments Filter:

  • Also (Score:5, Interesting)

    by MankyD ( 567984 ) on Tuesday April 11, 2006 @07:17PM (#15109756) Homepage
    Perhaps also to work as an effective, if limited, white list. Not only will it tell you what emails are "important" but it would certainly be an easy to way to keep a small-sized good-guy mailing list.
    • Been there. Tried it for 50-odd users. Impossible.

    • Re:Also (Score:2, Insightful)

      by wish bot ( 265150 )
      However, I wouldn't want to be getting email from my credit card company or bank, and I certainly don't want to encourage them to start sending important info by email.

      Besides the obvious problem of everything being intercepted by NSA+AT&T in the first place, it will only make it more difficult to tell phishing from the real thing, mainly because you'll be expecting it to be trustworthy. Old phishing techniques may have used mass mailings which could be blocked by spam filters, but that's not necessari

      • Re:Also (Score:5, Interesting)

        by tsm_sf ( 545316 ) on Tuesday April 11, 2006 @08:26PM (#15110117) Journal
        Maybe we need an anti-phishing motto along the lines of publishing's "money flows towards the writer" (aka Yog's Law [sff.net]). Something like "you travel to the bank, the bank doesn't travel to you" to discourage unsuspecting email link clickers.

        • Re:Also (Score:3, Informative)

          by stunt_penguin ( 906223 )
          That's as succinct a way as I've seen anyone put advice on phishing, I'll file that one away for the next time I'm lecturing someone on spam, viruses and phishing :o]

          Another way of explaining it person-to-person would be to ask them if they got a phonecall on their mobile phone by someone saying they were from their bank, would they actually give out their detiails? Sure as hell they wouldn't.
    • Wow! Where can I pay AOL to get my spam company on that list?

  • Thats my motto. (Score:5, Insightful)

    by Bill, Shooter of Bul ( 629286 ) on Tuesday April 11, 2006 @07:17PM (#15109757) Journal
    Its much easier to succeed, if you never try anything difficult.

  • Secondary Effects (Score:2, Insightful)

    by Kuukai ( 865890 )
    Rather than helping to reduce spam Gingras claimed that the point is to allow users to verify who important messages are really from, like a message from your bank or credit card company

    ...leading to more efficent prevention of phishing, and ultimately... reducing.. spam... D'oh!

    • Re:Secondary Effects (Score:5, Insightful)

      by dgatwood ( 11270 ) on Tuesday April 11, 2006 @07:23PM (#15109797) Homepage Journal
      Only if all of the banks and credit card companies use it, only if it is sufficiently standardized, and only if users are smart enough to notice that the message isn't "verified".

      The problem is, if most of the users were smart enough to realize that, we wouldn't have phishing because people wouldn't fall for it in the first place. I mean, it isn't exactly hard for users to realize that http://666.43.123.666/bankofamerica/mylogin.php [666.43.123.666] isn't a valid BOA website. If they can't figure that out, why do you think this will be any different?

      *sigh*

      • > Only if all of the banks and credit card companies use it, only if it is sufficiently standardized, and only if users are smart enough to notice that the message isn't "verified".
        >
        > The problem is, if most of the users were smart enough to realize that, we wouldn't have phishing because people wouldn't fall for it in the first place. I mean, it isn't exactly hard for users to realize that http://666.43.123.666/bankofamerica/mylogin.php [666.43.123.666] isn't a valid BOA website. If they can't figure that out, w
        • I know I'm not being phished, because I see my "SiteKey" challenge image - but if I had been phished, I'd have already given up the keys to the kingdom.

          So... You're saying that SiteKey works in that scenario?

          Luser enters ID, which is picked up by keylogger. Luser is shown their "SiteKey" challenge image - but the author of the keylogger doesn't give a rat's ass if it's correct or not. He logs the password. Luser is pwn3d.

          How the hell is a website supposed to prevent keylogging?

          The weakest link

      • Can't login (Score:5, Funny)

        by Anonymous Coward on Tuesday April 11, 2006 @07:49PM (#15109947)
        It appears that site you posted, http://666.43.123.666/bankofamerica/mylogin.php [666.43.123.666], has already been slashdotted. Anyone know a mirror where I can login to my account?

      • Re:Secondary Effects (Score:4, Interesting)

        by xsarpedonx ( 707167 ) on Tuesday April 11, 2006 @08:38PM (#15110181)
        There are some users who might not notice that, but some aren't s obviously bad as that. What if they used http://bankofamerica.secure.com/ [secure.com] , do you expect everyone to realize that there is a huge difference between http://secure.bankofamerica.com/ [bankofamerica.com] and http://bankofamerica.secure.com/ [secure.com] ?
      • I'm a pretty smart guy. I'm 27 and have been using computers for 18 years, online for 17 and on the internet since '95 or so.

        I am starting to get emails where it is very difficult to tell if they are real or not - both fake emails that look real and REAL emails that look fake. Figuring out which is which takes time, and about a month ago I actually fell for my first phishing scam about 2 months ago (for an eBay password; I had just gotten up and didn't realize the email that looked EXACTLY like the other
        • Because it's just a matter of time until the non-certified mail messages are almost discernible from the certified ones, and you eventually end up having the exact same problem you have now.
          • Exactly. There is exactly one safe way to handle emails that direct you to a web site: don't click the links. Using HTML in email should be for layout purposes ONLY. (IMHO, the blame for the entire phishing problem can be placed squarely on the shoulders of Microsoft for pushing HTML email instead of a more sane, link-free, layout-only standard, but I digress.) If your company depends on people clicking links to take users from an email message to a login page on your company's website, you WILL become
    • Actually none of the ISPs have any interest in reducing spam. They make to much money off of the spam operators and the sites that host the products provided by the spammers. Taking actual measures to reduce spam would cost the ISPs to much money.

      Instead, they want to make money from legimate companies that want to get their messages to end users. This is a win win for the ISPs, but does nothing for end users.

      As discussed many times here the only way to defeat spam is to choke off the money flow to

      • Re:Secondary Effects (Score:5, Interesting)

        by brass1 ( 30288 ) <SlrwKQpLrq1FM.what@net> on Tuesday April 11, 2006 @09:12PM (#15110305) Homepage
        Actually none of the ISPs have any interest in reducing spam. They make to much money off of the spam operators and the sites that host the products provided by the spammers. Taking actual measures to reduce spam would cost the ISPs to much money.

        Spammers steal to advertise a "product." They steal resources from anyone they need to advertise their product. You don't suppose these people run the other parts of the their business the same way? Legitimate IPSs don't enjoy hosting spammers in any fashion. This is why nearly all spamming done using cracked botnet zombies (baring a sizable chunk of mainsleaze spam). A quick check of the spam in my Junk folder indicates that most spammers host their websites on non-US systems, or are broken. On a nearly weekly basis I watch a small shared webhosting provider get hosed when his spamming customer lies to him, then screws him out of payment when the webhoster's provider gets involved. The vast majority of the ISPs in the civilized universe want spammers to loose IP connectivity. The largest of sites spend *millions* blocking spam both inbound and outbound.

        Instead, they want to make money from legimate companies that want to get their messages to end users. This is a win win for the ISPs, but does nothing for end users.

        It's a win for the users as well. The AOL mail client will be able to tell the user that the mail they're reading is indeed from Bank of America, and that other piece of mail is not from BoA. If AOL and Yahoo! know that BoA's mail all has goodmail tokens, and BoA mail shows up that doesn't have mail, it must therefore be a phish (seriously, go look at Goodmail's website [goodmailsystems.com] complete with the AOL mail client screen shots [goodmailsystems.com]). AOL's goodmail implementation is ONLY for transctional mail. That was the basis of Gingras' statement.

        The handwaving about AOL charging to deliver mail is, of course, interesting. One would think that AOL is going to make out like bandits on all of the spam they'll be delivering now. That's simply not the case. The goodmail system is designed to support itself, not AOL or Yahoo!. Goodmail will be charging enough to keep themselves in business and keep the accreditation program working. I somehow doubt there's much left in the cost structure to kickback to AOL in any amount they can measure.

        As discussed many times here the only way to defeat spam is to choke off the money flow to the people that use spam to advertise. There are two ways to stop the flow of money. First is to go after the spammers and advertisers. So far this has proven ineffective.

        Is the strategy ineffective or is our execution of the strategy ineffective? We have weak anti-spam laws that do more to enable the practice than to actually put a stop to it. We have standards bodies that can't come up with effective reputation and sender authorization systems, leaving ISPs to invent their own solution (see goodmail). We have transit providers who don't have the guts to de-peer a rouge network who won't clean up what they're transiting.

        Second way is to go after the idiots that actually buy stuff from spammers.

        Wow. You don't actually think people *buy* real stuff from spammers? And that the spammers are really selling the stuff they're advertising? Ok, maybe the pharma spammers, but the rest of them? Not so much. These people are theves. They steal for a living.

        Going back a week in my Junk box, I see pharma spam, penis pill spam, p0rn spam, mortgage spam, 419 spam, and pump-n-dump spam. Exactly what products are being sold in the spam I've gotten in the last week? Of the things in my list that even sound like products (drugs, penis pills, p0rn, and mortgages) none of those are products that need to be sold by cost shifted advertising. If you have to resort to these tactics to see these products, there's something wrong with the products. That's assuming
        • Wow. You don't actually think people *buy* real stuff from spammers? And that the spammers are really selling the stuff they're advertising? Ok, maybe the pharma spammers, but the rest of them? Not so much. These people are theves. They steal for a living.

          These people are paying money for something, if no one was responding and giving money to these people why would the keep spamming like they do? True, the idiots may not get anything for the money, but if they respond then they should be stopped from
      • It costs us a quarter of a million dollars a month to handle spam. You want to reduce spam? Get those Windows boxes off the Internet. If the majority of people don't need anything more than webtv, let them stick with that. Block port 25 outbound for consumer grade connections.

        Oh, and bill people if their PCs get compromised regularly. Real money will drive security.
    • Nothing you do on the receiving end will ever end phishing.

      Yet it is very easy to kill 100% for almost every financial organization out there.

      Just do not use email to communicate with your customers. That's it. Unless you're PayPal, the problem is solved.

      The only reasons that banks continue to use email is because:
      #1. It provides a cheap way for them to send ads to their customers.
      #2. They don't bear the financial loss when customers lose money.

      The only way to change #1 is to change the law on #2.

      Today I re
    • Dunno if this will reduce spam at all - but if this provides a more effective way to filter the good stuff from the spam, then we don't *have* to reduce spam. The whole point in reducing spam (from the user's perspective - not the ISP's) isn't to reduce spam, per se, but to more easily find and read the good email.

  • CAKE! (Score:4, Informative)

    by Omnifarious ( 11933 ) * <eric-slash@omnif ... g minus language> on Tuesday April 11, 2006 @07:20PM (#15109773) Homepage Journal

    CAKE [cakem.net]

    But, I've not had much time to work on it since I've been employed. :-( And it's a much nicer, decentralized solution to this problem that has potentially much less weight and wider applicability than PGP.

  • Won't help a bit (Score:5, Insightful)

    by Opportunist ( 166417 ) on Tuesday April 11, 2006 @07:20PM (#15109777)
    Remember the paper from Harward [harvard.edu] dealing with phishing and why it works?

    People don't even notice security features. They don't notice HTTPS, they don't notice certificates, they don't even notice bogus URLs. Why should they notice a "verified" mail (or lack of this verification)?

    And those who do already know how to deal with phishing mails, they are already capable of discriminating between fraudulent and legit mails.
    • This is a big waste of time and will easily be circumvented by spammers/fishers by 'faking' to be an authorized message. They'll just make it look very similar and the average senior citizen will happily give their personal data away.
      May I point out that by combating spam one would 'implicitly' combat messages from data fishers? ;-)
      • They'll just make it look very similar

        Well, assuming the encryption scheme is good enough, it should be hard to spoof the header tokens. And the graphic that indicates "certified" mail is supposed to appear in the mail client UI (yes, it requires client support), not in the viewing area. So they'd have to spoof the UI, which is trickier than spoofing the layout or sticking a logo in the message body.

        All of which, of course, doesn't mean that people will actually pay any attention to it.
        • Spoofing the UI has been done in other cases before, so I don't think it'll provide much of an obstacle. I've seen tons of banner ads that are made to look like an windows error message. I'm not sure how effective that sort of thing is, but I imagine it gets the same sorts of people who wouldn't notice strange URLs or who don't look to see whether the site they're interacting with is using encryption (thats a UI icon too, but most people probably don't even know what it means).
      • The point of Goodmail is that the message can be cryptographically verified to be genuine. Faked signatures won't work (beyond what they do today).
        • Faked signatures won't work

          So instead of faking the signatures, you fake the most-used mail client's "signature-verified" icon instead.

          True, a faked icon will appear in the mail rather than in the GUI's "chrome", as it should, but the problem is that most non-technical users don't notice such "subtle" distinctions.

    • Imagine a color flag. Its encrypted by an organization. When that flag arrives in the email, your user agent puts up a color flag or icon or whatever, big enough to be noticed, next to the email.

      Now the organization is affiliated with the user agent makers like mozilla and microsoft.. so only encrypted emails from that organization are read and used. Companies etc pay a small fee to the organization, and give them a string (name) and ip (from and reply-to servers, the dns domain name). Their smtp gateway is
      • > Imagine a color flag. Its encrypted by an organization. When that flag arrives in the email, your user agent puts up a color flag or icon or whatever, big enough to be noticed, next to the email.

        Imagine a compromised machine. When the user runs the email client and a (legitimate) "special" Subject: line has been fetched recently, the rootkit takes a screen grab and crops out the pixels where the flag is supposed to be (we go the extra mile because the user might have selected the color of the flag a

        • Yea a rootkit could just interupt your going to a website like your bank and display false SSL info even. There is really nothing a rootkit can't do, why would you use it to interupt emails.
        • Imagine a compromised machine.

          At that point they're screwed anyway. I think phishing someone whose box is already rootkitted falls under the category of Overkill.

    • Re:Won't help a bit (Score:3, Interesting)

      by NoMercy ( 105420 )
      With things like SPF at least, if someone recieves an email which comes from an un-authorised source, and my DNS records say that all my emails come from authorised sources, the email should get bounced before the user even sees it.

      Though, I'll admit dispite having a SPF record in my DNS records, I don't have any filters setup on my email server to bounce unwanted emails, but hopfully if one scheme takes off over the others, it'll become included in the examples and default configuration options of many ema

  • Money (Score:4, Insightful)

    by Dorion caun Morgul ( 851570 ) on Tuesday April 11, 2006 @07:22PM (#15109793)
    It's all about money. I just can't wait until I get to pay 33 cents to send my Parents an email.

  • In other words, we'll still get spam (Score:5, Insightful)

    by GrumblyStuff ( 870046 ) on Tuesday April 11, 2006 @07:23PM (#15109794)
    So this is just a paid for whitelist?

    Hello, McFly?! If I'm expecting emails from my bank, I'll be putting them on my safelist anyway! Them and everyone in contacts, emails for forum notifications, newsletters that I want.

    This doesn't seem to be doing anything other than making money for someone else.
    • If I'm expecting emails from my bank, I'll be putting them on my safelist anyway!

      And when the cleverly-crafted phish comes in, the one that uses the right layout, the right wording, the right logos, a browser vulnerability to disguise the fact that it's going to the wrong website?

      Most people here will probably recognize it by the fact that your bank wouldn't be asking for your SSN online, or you'll use your bookmark to visit the site instead of the fiendish link. But for the average Joe, this could help hi

    • If I'm expecting emails from my bank, I'll be putting them on my safelist anyway!

      When someone registers an account for Orb [orb.com], we send him an automatic email to welcome him. The "from" field contains a valid email address. I am one of the recipient to that email.

      And I can tell you that everyday we receive dozens of automated emails asking us to click a link to verify that we are human beings and not a spam bot.
      So good for you if you manually manage your safelist, but other people don't bother with it.

      T

    • If I'm expecting emails from my bank, I'll be putting them on my safelist anyway!

      Typical reply heard from someone that has given this 2 seconds of thought, and doesn't have to deal with sending legitimate email to real people on a day-to-day basis.

      So you're just going to whitelist everyone you "want" to get email from, like your bank. Uh huh. And which of their thousand email addresses and dozen domains will you know to put in your whitelist? What if they out-source their email sending to a different compan

    • If I'm expecting emails from my bank, I'll be putting them on my safelist anyway!

      And when it arrives, and the source address matches an entry on your safelist, how will you know who sent the e-mail? You don't believe the From: header, do you?

    • Hello, McFly?! If I'm expecting emails from my bank, I'll be putting them on my safelist anyway!

      And then you have customers like my mother, who a) is sufficiently behind the times enough to think "Hello, McFly?!" is an edgy reference from a hip new movie b) uses email and keeps bugging me to show her how to do banking online since I rave about the convinience and c) will learn what a "safelist" is the day I sprout wings and fly. Do you want to take a bet at how many AOL customers resemble my mother versu

    • The point is that confirmation messages for transactions often come from addresses you don't know in advance. This allows the server to verify those messages.

  • Blue Frog (Score:5, Interesting)

    by Spy der Mann ( 805235 ) <`moc.liamg' `ta' `todhsals.nnamredyps'> on Tuesday April 11, 2006 @07:25PM (#15109804) Homepage Journal
    Why not joining bluesecurity.com and report SPAM automatically? At 370K members, it's guaranteed to slow down the spammer's website (spam victims' slashdotting!) until they opt-out the complainers out of their lists.

    They got even a Firefox extension for reporting spam with Yahoo, Hotmail and GMail.

  • Oh Really! (Score:2, Insightful)

    by protich ( 961854 )
    Nothing to see here...we already knew it.

  • Certified delivery of spam (Score:5, Insightful)

    by kitzilla ( 266382 ) <paperfrogNO@SPAMgmail.com> on Tuesday April 11, 2006 @07:31PM (#15109845) Homepage Journal
    In other words, CertifiedMail is here to certify the delivery of spam by the "important" spammers who have the resources to pay for it.
    • Exactly. Except if they're big and have the money for it, they're called "bulk advertisers", "certified targeted marketing" or a whole lot of other jargon that might lead you to believe they really are in fact something other than spam.
    • CertifiedMail is here to certify the delivery of spam by the "important" spammers who have the resources to pay for it.

      Those who can pay, yes, and also agree to abide [goodmailsystems.com] by responsible mailing list practices, use only opt-in lists (it doesn't require confirmed opt-in, unfortunately) with working unsubscribe procedures, eschew email harvesting and list sharing, use accurate headers, maintain a low level of complaints... and submit to a background check to show that they aren't spammers.

      If they enforce their TOS
      • Precisely. Most spammers call their lists 'opt-in'. Most lists of scraped email addresses sold by spammers are 'opt-in'. Their responsible practices mean nothing unless they mandate proper confirmed opt in.
    • And then it gets a whole lot harder to profit, given the little (but still existing) profitability from spam. I have to wonder if it's still possible.

  • There Will Be Spam (Score:3, Insightful)

    by Gamzarme ( 799219 ) on Tuesday April 11, 2006 @07:32PM (#15109849)
    Oh yes, there will be spam..it seems to be here to stay.
    Just like every other problem the 'bad guys' face when exploiting the rest of the population, they will find away around this too.

    The news will be that if this practice does go into wide usage, spammers will turn toward draining large, anonymous bank accounts to fund their e-mail influxes.
    This 'tax' will only create more problems than necessary.

    My advice: leave what isn't broken alone and if you do have problems, then I suggest you install a good e-mail filter to pick out the spam that does get through.

  • My bank ?.... (Score:3, Interesting)

    by i.r.id10t ( 595143 ) on Tuesday April 11, 2006 @07:35PM (#15109863)
    My bank or CC company, or just *any* bank/cc company ?
    • My bank or CC company, or just *any* bank/cc company ?

      Hell if I know! I'm still wondering why Citibank mailed me several times to tell me that they were going to cancel an account that I didn't open in the first place :P

  • Nothing to see here. (Score:3, Insightful)

    by rholliday ( 754515 ) on Tuesday April 11, 2006 @07:43PM (#15109909) Homepage Journal
    We all knew this wouldn't reduce spam. This is just a launching point for email blackmail, along the lines of BellSouth's bandwidth threats. The legal people at AOL are just trying to cover their butts so people don't have a leg to stand on when they complain that they don't get less spam. Totally stupid program.

  • Anyone detect hypocrisy? (Score:5, Interesting)

    by suv4x4 ( 956391 ) on Tuesday April 11, 2006 @07:43PM (#15109912)
    Goodmail's service is built around one single idea: easy to pitch to CEO's of large mail providers.

    The providers get paid, and they get a good excuse for charging those fees. End of story.

    If Goodmail's intentions were genuine, they wouldn't charge the "businesses" for every separate mail provider, but create globally valid certificates and then discuss with mail providers of accepting them.

    However who would care to accept the certificates if he doesn't get the dough (the fees)? So there, we arrive at what Goodmail did.

    Can you imagine paying up completely independently to every single ISP in the world so it can accept your SSL certificate? Yea, it's THAT bad...
    • You can also look at it this way. Legitimate companies would not tarnish their name by mercilessly spamming people. They have working opt-in/opt-out mechanics and play by all the rules. By having these people pay a fee to stay in the rules, you can bet that gives you an incentive to ensure you have on your list only people who really want to get your messages. Sending to people who don't want it will cost them money, so they keep their lists clean.

      Also, right now there is sure to be a good deal of media

  • Not meant to reduce spam but to verify sender...SPF/Sender-ID/DomainKeys anyone?

  • "Certified" (Score:3, Funny)

    by oGMo ( 379 ) on Tuesday April 11, 2006 @07:50PM (#15109959)
    Certified [reference.com], v.tr.
    4. To declare to be in need of psychiatric treatment or confinement.

    Yeah someone's certifiable here.

  • Yeah, this is what we've been saying all along (Score:4, Interesting)

    by wile_e_wonka ( 934864 ) on Tuesday April 11, 2006 @07:53PM (#15109977)
    This really isn't news. This is just an acknowledgment of the deceit behind their earlier statements. They did a real crappy job of deceit though, as everyone saw this as something that wouldn't block spam. Instead I'll have spam with little blue ribbons that was paid for. And then I'll have spam that I can't tell apart from my normal mail because it wasn't paid for, but it made it through the spam filter (except really we all cann t311 1t apart fr0m 0ur normal mail for the 0b>i0us reasons).

  • Trust but verify. That it's crap. (Score:5, Funny)

    by DysenteryInTheRanks ( 902824 ) on Tuesday April 11, 2006 @07:57PM (#15109995) Homepage
    The only real solution to stop from being misled by online con artists is to examine each link in a chain of Internet communication to ensure it is from a trustworthy, reliable source.

    Email address, Web URL, refering party -- each should be bulletproof BEFORE you extend your trust. Otherwise, you might get scammed.

    Take this article. We know it's reliable and trustworthy. How?

    Well it was submitted by "anonymous reader," who has posted many a fine gem on this here site.

    Then it was filtered by an "editor" named "ScuttleMonkey." How can you not trust a monkey? Monkeys rock!

    Then, when you click on the link, you see you have been taken to "Spam Daily News," a bastion of journalistic integrity that makes the New York Times look like the New York Times before Judy Miller got fired.

    Finally, the whole thing originated from a little place we like to call "Slashdot." I think the quality of this brand needs no elaboration.

    So as you can see, it is not hard to recognize a secure, reliable, not-at-all-misleading-or-shady chain of Internet links. Happy surfing!

  • Capital punishment.
  • Is this just going to be RSA message-signing in a shiny package?
    • Indeed. If their aim is really to cut down phishing, they don't actually need to invent a new protocol or charge money; they should just get on with implementing the standards we already have, S/MIME.

      If Apple Mail can do it seamlessly, why can't AOL?

  • They presented to my organization (Score:5, Interesting)

    by StanSmith ( 100966 ) on Tuesday April 11, 2006 @08:14PM (#15110069) Homepage
    I spent an hour beating them up on a number of issues, much to the embarrassment of my 'far too ready to sign anything' CTO.

    Their VP kept harping on how "it will tell users they can trust your mail". My point that the real challenge was getting users NOT to trust things was not well received, to say the least. I also mercilessly attacked their constant assertion that their widget is "unspoofable", on the simple grounds that a similar widget in a similar location would be sufficient to fool many users.

    My CTO has been asking me when we're going to implement Goodmail ever since. Khaaan!

  • Not to curb spam? Then this is BS (Score:4, Interesting)

    by moochfish ( 822730 ) on Tuesday April 11, 2006 @08:25PM (#15110111)
    Wait. I don't get it. If the purpose is to ensure the sender really IS the sender, why do I have to pay up again?? If I'm the BankofSlashdot and I send emails to my customers from the email accountdetails@bankofslashdot.org, why is it they can't just add me to a registered senders list with my server's IP recorded? Why's that suddenly cost money?

    If the purpose isn't to reduce spam, what does this new pay-for-being-recognized service offer that current ISPs don't already? Most ISPs will begin taking actions against your spam if you start spamming without contacting them anyway, and you are looking at legal trouble if you spam with forged headers or people who have opted out. Through whitelists and regulations, the framework is already in place for the legit spammers to spam. AOL already has whitelists. AOL already negotiates and limits email volume with mass email marketers. AOL already uses blacklists. And this whole thing isn't even mandatory!

    So I'm really not sure what this pay system is supposed to do except earn AOL an extra dime at no added cost.
    • "So I'm really not sure what this pay system is supposed to do except earn AOL an extra dime at no added cost."

      That is the whole point, to add cash to AOhell's sagging profits. Why do you think The boardroom is talking about splitting the company and sending AOhell back out on it's own?

      As a tech I only remove more problems from Norton infected machines than I do AOL.

  • broken way to fix phishing too (Score:3, Insightful)

    by Anonymous Coward on Tuesday April 11, 2006 @08:26PM (#15110120)
    say you're the bank of america, and you send your "transactional" mail with this GoodMail thing turned on and the little flag set. what about your other emails that you don't pay for? if any of your mail is sent uncertified, then phishers can just impersonate that "oh this is just one of those uncertified emails we the bank of america send you occasionally - click here to see our latest offers (requires SSN)".

    so suddenly you have to pay for _all_ your mail just to maintain your credibility. and then what if you cross the spam-complaint level goodmail sets accidentally and they throw you off their system (as they are contractually obliged to do)? does that mean that nobody will ever trust your mails again? do you get to send out one last certified mail saying "okay from now on pay no attention to that little flag?"

    it seems a really bad idea for a big company to place their credentials in trust with a third party and then let them charge them for every mail they send

  • I'll sort my own mail, thank you... (Score:3, Insightful)

    by Ossifer ( 703813 ) on Tuesday April 11, 2006 @08:40PM (#15110191)
    I already sort my incoming email, by many categories. What purpose is there to having two classifications: "important" and "other"?

  • So it is to stop phising (Score:3, Interesting)

    by fermion ( 181285 ) on Tuesday April 11, 2006 @08:44PM (#15110203) Homepage Journal
    If it is about the verfing the sender, then it is a nobel goal. Even though banks do not do the sort of stupid things they used to do, the ability to spoff the URL location bar and universal font sets still allow the motivated phisher to fool the unwary customer.

    So there is clearly a need for someone to help the average user discriminate between legitimate and nefarious email. The need could result in a significant market opportunity if an ISP developed appropriate technology and backed up the technology with a meaningful guarantee. People will pay for security, even shallow security.

    I also believe this will reduce email that maight be strictly catagorized as spam. Not the broad definition of unsolicited email that has resulting in no meaningful agreement on how to deal with the problem, but email that has a misleading subject, spoofed headers, clearly obtuse text content meant to disguise the HTML rendered message, and links to shady websites. If the ISP allowed users to set up a list of safe addresses, provided the level of protection that the USPS service does for unsolicited mail, and provided a good customer crisis line, that would provide a big competitive advantage. If, however it is just charging spamers for email while the user dangles on the vine, that it is quite useless.

  • The USPS was suppsoed to do that! (Score:4, Informative)

    by netringer ( 319831 ) <.maaddr-slashdot. .at. .yahoo.com.> on Tuesday April 11, 2006 @08:44PM (#15110205) Journal
    The US Postal Service demoed just such a thing many, many years ago. They had an email encryption and delivery service to verify that the message was not altered. I suppose the problem in certifying the sender and receiver and proving delivery (to a person - not a mail spool) were technical issues they couldn't handle.

    The difference of the USPS vs. Goodmail is that the USPS has official legal authority for such thing as mail tampering and proof of delivery.

    I suppose if they were to offer the service now, Goodmail would buy a law to prohibit to USPS from competing against a private business as Sen. Santorum is trying to do with the weather service.
    • The USPS has internal people that know lots about encryption and servers. Generally though they like partner with companies for their services (i.e. company A buys from company B who buy from the post office) so now worry there. My guess is that people won't pay for verified email.

  • uh, GPG (Score:2, Insightful)

    by Anonymous Coward
    uh, isn't this what PGP/GPG are for?
  • is to fork over some money to AOL to phish. You'd think this would stop them, but since the mail is now "certified" or whatever you want to call it, people will believe it and probably increase their response proportions.

  • We already have a better way to do this (Score:5, Interesting)

    by NightHwk1 ( 172799 ) <.ten.ksalfytpme. .ta. .noj.> on Tuesday April 11, 2006 @09:31PM (#15110377) Homepage
    GnuPG / PGP signing, with peer-based levels of trust. Or even better: get the public key direct from your bank when you first log in to your account. Added bonus, you have the option of turning on encrypted email.

    This might bring up the question of encrypted spam, but your keyring would act as a whitelist. If some random person sent you an encrypted or signed message, then you would be presented with a message asking if it should be accepted.

    All we need is a simplified way to do this for the general public. Too bad Thunderbird doesn't come with Enigmail preinstalled. We'd probably need something else for webmail. (FF extension?)
    • What about when you want to add or delete accounts to your on-line banking
      What happens when you lose you private key, and can't decrypt those important messages about your accounts and the cotracts for service (banking, deposit holding, interest etc are all contracted servies)? And then a tax audit, bankruptcy, or civil suit that requires legal discovery?

      Without evidence to defend yourself, life is sooooo much mre difficult.
      These sorts of reasons are why PGP, gpg and S/MIME never work in corporate environm
  • I keep all of my received spam at home. All of 5714 this year and 20493 last year total on 14 addresses. And of course feeding filters with it, so my family did never see any. It takes some 0.0000000000??% of my bandwith, I am vasting much more bandwith just reading Slashdot. More, I can study time patterns, botnet spread and even bugs in spamming software passively on that data set with some interesting conclusions.

  • Why can't personal certificates do this? (Score:4, Informative)

    by AusChucky ( 967709 ) on Tuesday April 11, 2006 @10:01PM (#15110513)
    Can I ask what happened to using Personal certificates?? Why, when we use SSL certificates to verify that a website we are visting is actually the true company, can't we use personal certificates to verify that the email we are reciving is actually from the company?? Surely they could configure their mail servers to filter out email on this basis without requiring a 3rd part solution that makes you pay for it. Hate to state the obvious but this is just the big companies way to getting their hands in on a great free thing that the internet provides
    • Don't we use 3rd parties for SSL certificates?

      I think the major players can't make as much money without the 3rd party scheme so they push it. Note how difficult it is for you to create a certificate to sign your email with that outlook will understand/respect (without using 3rd party).

      The large email providers are seeing $$$. I think the delay is in thinking up schemes that people feel the need to pay for. Its funny that we can protect a damn movie through unwanted inconvenience and mandated cost to the

  • We're not trying for anything (Score:3, Informative)

    by SeaFox ( 739806 ) on Wednesday April 12, 2006 @03:24AM (#15111842)
    Goodmail CEO Richard Gingras surprised Legislators and advocacy groups today when he announced that the CertifiedMail program being implemented by AOL and Yahoo is not meant to reduce spam.

    Of course not, that way when it does not reduce spam, they can't say CertaifiedMail was a failure.
    *****
      This article advocates a
     
    ( ) technical ( ) legislative (x) market-based ( ) vigilante
     
    approach to fighting spam. Your idea will not work. Here is why it won't work.
    (One or more of the following may apply to your particular idea, and it may
    have other flaws which used to vary from state to state before a bad federal
    law was passed.)
     
    ( ) Spammers can easily use it to harvest email addresses
    (x) Mailing lists and other legitimate email uses would be affected
    ( ) No one will be able to find the guy or collect the money
    ( ) It is defenseless against brute force attacks
    ( ) It will stop spam for two weeks and then we'll be stuck with it
    ( ) Users of email will not put up with it
    ( ) Microsoft will not put up with it
    ( ) The police will not put up with it
    ( ) Requires too much cooperation from spammers
    (x) Requires immediate total cooperation from everybody at once
    (x) Many email users cannot afford to lose business or alienate potential
    employers
    ( ) Spammers don't care about invalid addresses in their lists
    ( ) Anyone could anonymously destroy anyone else's career or business
     
    Specifically, your plan fails to account for
     
    ( ) Laws expressly prohibiting it
    ( ) Lack of centrally controlling authority for email
    ( ) Open relays in foreign countries
    ( ) Ease of searching tiny alphanumeric address space of all email addresses
    ( ) Asshats
    ( ) Jurisdictional problems
    (x) Unpopularity of weird new taxes
    ( ) Public reluctance to accept weird new forms of money
    ( ) Huge existing software investment in SMTP
    ( ) Susceptibility of protocols other than SMTP to attack
    ( ) Willingness of users to install OS patches received by email
    ( ) Armies of worm riddled broadband-connected Windows boxes
    ( ) Eternal arms race involved in all filtering approaches
    ( ) Extreme profitability of spam
    ( ) Joe jobs and/or identity theft
    ( ) Technically illiterate politicians
    ( ) Extreme stupidity on the part of people who do business with spammers
    ( ) Dishonesty on the part of spammers themselves
    (x) Bandwidth costs that are unaffected by client filtering
    ( ) Outlook
     
    and the following philosophical objections may also apply:
     
    (x) Ideas similar to yours are easy to come up with, yet none have ever been
    shown practical
    ( ) Any scheme based on opt-out is unacceptable
    ( ) SMTP headers should not be the subject of legislation
    ( ) Blacklists suck
    (x) Whitelists suck
    ( ) We should be able to talk about Viagra without being censored
    ( ) Countermeasures should not involve wire fraud or credit card fraud
    ( ) Countermeasures should not involve sabotage of public networks
    ( ) Countermeasures must work if phased in gradually
    (x) Sending email should be free
    (x) Why should we have to trust you and your servers?
    ( ) Incompatiblity with open source or open source licenses
    ( ) Feel-good measures do nothing to solve the problem
    ( ) Temporary/one-time email addresses are cumbersome
    ( ) I don't want the government reading my email
    ( ) Killing them that way is not slow and painful enough
     
    Furthermore, this is what I think about you:
     
    (x) Sorry dude, but I don't think it would work.
    ( ) This is a stupid idea, and you're a stupid person for suggesting it.
  • It's not meant to limit SPAM (unless your idea of email, as some want it to become,
    is a communication medium where you only accept people you "trust" and reject the
    others). It's meant to protecte trademarks, and push responsibility away from the
    sender (i.e.: "you should have checked who the mail came from, ours are signed).
    Yahoo, and of course banks and other institutions who want to defend their
    credentials love SPF and similar systems. They don't care about SPAM, they just
    don't want to get blamed by cust

Slashdot Top Deals

"God is a comedian playing to an audience too afraid to laugh." - Voltaire

Close