
John Levine, author of best-sellers Internet for Dummies, the new
Fighting Spam for Dummies, and Windows XP: the Complete Reference, says that challenge-response systems are as harmful as spam. Certain flaws is because C-R system rely on the From: line for authentication, and most current ones ("reply to this message" or "click on this link") can be trivially bypassed by spammers. These two are considered security problems.
The first problem is probably the most serious; it can probably be solved through micropayments, hash cash, digital signatures (web-of-trust or
certification authority), but none of those technologies will be deployed in a hurry, and an alternative is painful and awkward. There is also an issue regarding poor integration and list-intelligence because spammers do not understand mailing lists.
Finally, C-R system fails to address techno-economic underpinnings of spam. As with most recipient-side filtering systems, C-R imposes negligible incremental overhead on the spammer. A delivery is made, then the
spam server moves on, and the cost is a single SMTP connection for a fractional second. Collateral costs are high: for legitimate senders, spoofed reply addresses, mailing lists, and retaliatory actions on the challenge-response user.
Spam Blocker Comments