Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Spam and Authentication 3 Comments More | Login | Reply /

 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • Two reasons auth won't work. Firstly that Ralsky is going around cracking SMTP AUTH servers because of weak passwords - you can enforce AUTH all you like but you can't enforce strong passwords.

    So you switch to keys, right? Well no, in the long term that won't work either. Witness the Swem virus - it prompts users for their username, password and SMTP servers and users *gladly* put that info in!
    • Bad security on user computers is one reason I think authenticating the servers is more important than clients.

      Not to mention that is easier to deploy to the servers instead of forcing every client to upgrade their software.

      When money is involved, the users would have an incentive to keep their accounts secure. If a breakin into an account results in a $100 charge and email being disabled for the rest of the month, then people might take the security seriously.

      The involvement of money and more rob

      • It all comes down to cost at the end of the day.

        Make sure all servers are authenticated. Great. No problem.

        Make sure all clients are neither spammers, nor insecure. Not an easy problem.

        It takes large amounts of resources in terms of abuse desk costs, and support costs (if you shut down 200,000 users at an ISP because they run infected versions of windows, how much do you think that will cost in terms of support? Think 1 hour on the phone to each customer). And you have to offer that support because people simply aren't technical enough to secure their computers.

        On the margins that ISPs run at, this is simply impossible.

        Want to change the margins? Fine, but who's going to do that first and see all his customers run to the next ISP?

        I'm not saying this is impossible - MessageLabs handles this pretty well. But we only sell to businesses and we *still* get spam emanating from our network due to insecurities on our customers networks, despite a huge amount of effort put into stopping this. And if we see this occurring the first thing we do is shut down email for that customer (which has a much larger than $100 cost to them I assure you), yet it still occurs.
Stories, comments, journals, and other submissions on use Perl; are Copyright 1998-2006, their respective owners.