Microsoft aims to make spammers pay

[4me2]

Despite efforts to stem the billions of spam e-mails flooding inboxes, unwanted messages are still turning e-mail into a quagmire of misery.



<!-- S IIMA --><TABLE cellSpacing=0 cellPadding=0 width=203 align=right border=0><TBODY><TR><TD> The Penny Black revolutionised the British postal service

</TD></TR></TBODY></TABLE><!-- E IIMA -->Spammers send out tens of millions of e-mails to unsuspecting computer users every day, employing a myriad of methods to ensure their pills, loans and "requests for our lord" pleas fox e-mail filters.

Some are even turning to prose and poetry to fool the technological safeguards people put in place.

But a group of researchers at Microsoft think they may have come up with a solution that could, at least, slow down and deter the spammers.

The development has been called the Penny Black project, because it works on the idea that revolutionised the British postage system in the 1830s - that senders of mail should have to pay for it, not whoever is on the receiving end.

Stamp of approval

"The basic idea is that we are trying to shift the equation to make it possible and necessary for a sender to 'pay' for e-mail," explained Ted Wobber of the Microsoft Research group (MSR).

The payment is not made in the currency of money, but in the memory and the computer power required to work out cryptographic puzzles.

"For any piece of e-mail I send, it will take a small amount computing power of about 10 to 20 seconds."

<!-- S IBOX --><TABLE cellSpacing=0 cellPadding=0 width=208 align=right border=0><TBODY><TR><TD width=5></TD><TD class=sibtbg> For this scheme to work, it would want to be something all mail agents would want to do


Ted Wobber, MSR

</TD></TR></TBODY></TABLE><!-- E IBOX -->"If I don't know you, I have to prove to you that I have spent a little bit of time in resources to send you that e-mail.

"When you see that proof, you treat that message with more priority."

Once senders have proved they have solved the required "puzzle", they can be added to a "safe list" of senders.

It means the spammer's machine is slowed down, but legitimate e-mailers do not notice any delays.

Mr Wobber and his group calculated that if there are 80,000 seconds in a day, a computational "price" of a 10-second levy would mean spammers would only be able to send about 8,000 messages a day, at most.

"Spammers are sending tens of millions of e-mails, so if they had to do that with all the messages, they would have to invest heavily in machines."

As a result of this extra investment, spamming would become less profitable because costs would skyrocket in order to send as many e-mails.

All this clever puzzle-solving is done without the recipient of the e-mail being affected.

Bogging them down

The idea was originally formulated to use CPU memory cycles by team member Cynthia Dwork in 1992.

But they soon realised it was better to use memory latency - the time it takes for the computer's processor to get information from its memory chip - than CPU power.

<!-- S IIMA --><TABLE cellSpacing=0 cellPadding=0 width=203 align=right border=0><TBODY><TR><TD> Spam accounts for more than half of e-mails sent

</TD></TR></TBODY></TABLE><!-- E IIMA -->That way, it does not matter how old or new a computer is because the system does not rely on processor chip speeds, which can improve at rapid rates.

A cryptographic puzzle that is simple enough not to bog down the processor too much, but that requires information to be accessed from memory, levels the difference between older and newer computers.

It all sounds like a good idea, said Paul Wood, chief analyst at e-mail security firm MessageLabs.

"One of the fundamental problems with spam is that it costs nothing to send, but has associated costs for the recipient which include loss of bandwidth, problems with usage, and lost productivity," he said.

"Microsoft's idea is to shift this cost burden from the recipient to the sender, which in itself seems like a reasonable sentiment."

But, he said, for such a scheme to be all-encompassing, there would have to be some provision for open standards, so that it is not proprietary to Microsoft.

Work for all

MSR is in talks with various people to put the system into a useful anti-spam product.

It could easily be built into e-mail software like Outlook, e-mail servers or web browsers, said Mr Wobber.

"For this scheme to work, it would want to be something all mail agents would want to do," explained Mr Wobber.

And because it is the receiver who sets the puzzle requirement, spammers will not have any advantage by using non-Microsoft products.

It is certainly not going to stop all spam for good, admitted Mr Wobber.

"I don't think any one spam scheme is a panacea, we have to use a wide variety of schemes to be successful in stopping spam." "Spam is probably going to get worse before it gets better, and I really hope it does not get to a point that it deters people using e-mail." <!-- E BO -->

http://news.bbc.co.uk/1/hi/technology/3324883.stm

[Oracus]

Money = no. Computer time = great idea.
I get about 20 spam messages a day, and anything that can reduce these without me adding filters every day would be great!

Os`

[ABCMan]

i agree wholeheartedly, sadly there isnt an option for this in the poll

my only reservation is that if m$ have anything to do with it i'm afraid it will have so many security holes that its just not going to work for very long

[Oracus]

LOL - fresh install of XP yesterday on the folks PC, and just in updates I managed to top 130mb to get XP up to spec and past (the known) security problems... Lucky they stayed on ADSL after I moved out, otherwise it'd still be going now.

[Yazmon]

So they plan to keep the timing constant by using memory access? Doesnt sounds like it will work to me, what they need to do is change the SMTP protocol to something that is secure. (ie senders domain should always be part of the 'from' address, etc.)

[crack_it]

is there any programs 2 stop spam a bit coz my ntHell account gets about 100 spam e-mails a day now and its pi$$in me off

[dan288]

crack_it if your getting 100 spam emails a day, why dont u just block the senders addy.

As for me, spam doesnt bother me, I just hit the delete button

[crack_it]

how do you blokc the senders addy becoz i am useing outlook express ?

[MsDG]

Get "mailwasher". The best bit of software ever!!!

When you get mail - mailwasher lets you preview all your mail on the server (before you download it).

You get options to block mail and delete mail before it comes off your email server.

The best part is... you can "bounce" email back to the spammer!!! :thumbs

[hxbro]

bouncing the mail is pointless, the addresses are most likely to be invalid

[beansontoast]

I voted 'no' on this before reading the article properly. I think it is a good idea, it wouldn't affect normal email users.

[Porthos]

that poll is shit. 'would you be prepared to pay for sending emails like normal letters ?' is pretty misleadin and 4 people who cba 2 read the article they cud vote incorrectly.

[4me2]

that poll is shit. 'would you be prepared to pay for sending emails like normal letters ?' is pretty misleadin and 4 people who cba 2 read the article they cud vote incorrectly.

yep ,especially those who have trouble writing correctly and think they are writing an sms with every post and subsitute words with numbers . Those who are too lazy to make the effort to write correctly surely are too lazy to read in full before voting in the poll . Its a good job we dont have any like that on the forums. :whistle

[Porthos]

Those who are too lazy to make the effort to write correctly surely are too lazy to read in full before voting in the poll .

I am too lazy to write correctly but I did take the time to read the post. I didn't know that my writing was so offensive but since it seems to be I shall write correctly from now on.

[4me2]

I am too lazy to write correctly but I did take the time to read the post. I didn't know that my writing was so offensive but since it seems to be I shall write correctly from now on.

I seem to remember pointing it out a couple of times in the past and your reply being the same as above.

[Porthos]

Anyway why does my writing really have anything to do with my comment about the poll? If my writing was a problem as it seems it is why didn't you drop me a PM?

[Porthos]

Sorry, wen I posted above I had not read your post. If you had told me before and I hadn't done anything then I'm sorry, I genuinely didn't notice. Anyway, as you can see my writing has been fixed.

[maverick_15]

i would probably be prepared to 'pay' although it might get a bit annoying