Re: [vps-mail] Challenge Response

[Matt Cohen <lists@xxxxxxxxxx>]

You're welcome to use whatever you like on your systems, but FYI 
here's a post I made on the iserver list regarding challenge-response 
systems:

-------
1)As a business, if someone signs up for my newsletter, I'm going to 
be assaulted with many of these 'challenge' emails to send out every 
time I send a new issue.  Some systems require that you re-send the 
email from a specific address with a key-code in the subject line. 
For a large automated list using mailman or majordomo, this can be 
cost-prohibitive and will probably result in me not completing any of 
them.

2)What if my online store sends an email receipt which gets blocked 
by a challenge response system?  I don't want to take the time to 
reply to all the challenges, and then a customer complains that he 
never got his receipt, or figures that it didn't go thru and places 
the order again, etc., etc.,

3)What if a virus sends this person an email, and it bounces with the 
challenge to the original virus victim? (or a third party?)  What if 
THAT person has a challenge system and sends a challenge BACK to the 
first recipient.  Will this create a mail loop?  If not, how does the 
challenge system detect that it is another challenge and not send a 
reply?  how long will it take for spammers to figure out that system 
to get their emails to bypass the challenge system?

4)As a consumer, if I'm trying to contact a business, I don't want 
the 3rd degree when trying to buy Something.  Think about the dial-up 
user:  They send an email, get off line until the next day, when they 
find that they have to send a challenege response back just to make 
their FIRST email (from yesterday) get delivered, which is just 
frustrating and will negatively impact their feeling of this business.

5)As an ISP/mail host, some spammer uses your domain as a reply-to 
address.  So you get all these challenges to emails you never sent 
that you now have to sort thru one-by-one, since you're not sure 
which of them are real and which are as a result of a spammer abusing 
your domain name.

True, no system is perfect, but I'd much rather take my chances with 
spamassassin letting spam thru then deal with a '100% spam solution' 
(their words) that has these major problems with them.
--------

Also, here's an old but still valid opinion from CNET:

http://news.com.com/2010-1071_3-1009745.html

Have fun!
Matt

At 8:38 AM -0700 1/17/05, Jonathan Duncan said something about:
> This was discussed a while back.  Which, if any, Challenge Response 
> Systems (CRS) are people using and liking?  spam.abuse.net refers to 
> Spam Interceptor as something that works with SpamAssassin but just 
> glancing over the site did not indicate to me how.
>
> http://si20.com/
>
> I think that qmail has some built-in challenge response options, but 
> qmail is not something that I relish moving to.
>
> It looks like Spam Interceptor takes the mail off my server and 
> people get their mail there.  I would like to keep mail on my 
> servers.  Does anyone know of a good CRS's that rule either on the 
> server or on the client?
>
> Thanks,
> --
> Jonathan Duncan
> http://www.nacnud.com
>
> ======================================================================
> This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
> Before posting a question, please search the archives (see above URL).

--
:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+:-:+
Matthew I. Cohen                                   http://www.iwbyte.com/
It Won't Byte Web Design & Hosting.     Ob. Quote: "Reality is for those
email: lists@xxxxxxxxxx                  people who can't handle Fantasy"
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).